Kibana Alerts - Is there a way to schedule rule execution at a specific time daily?

[Tortoise]

Hello Community,

I am working with Kibana Alerting rules and have a use case where I need an alert to execute at a fixed time every day (e.g., every day at 03:00 UTC), rather than on a recurring interval like "every 1 hour" or "every 24 hours from whenever it was first enabled."

The interval-based scheduling in Kibana rules means the execution time drifts depending on when the rule was created or last enabled which doesn't work for our requirement.

My questions:

1. Is there any native way in Kibana Alerting (Stack Alerts, Security Rules, or otherwise) to schedule a rule at a specific clock time (cron-style) rather than a fixed interval?
2. If not, is Elasticsearch Watcher currently the only supported path for time-of-day-specific scheduled execution?
3. Are there any workarounds within Kibana?

Any ElasticStack version 8.x , 9.x ?

Thanks in advance!!

[leandrojmp (Leandro Pereira)]

@Tortoise

1. Is there any native way in Kibana Alerting (Stack Alerts, Security Rules, or otherwise) to schedule a rule at a specific clock time (cron-style) rather than a fixed interval?

Unfortunately no, they are only interval based.

@Tortoise

2. If not, is Elasticsearch Watcher currently the only supported path for time-of-day-specific scheduled execution?
3. Are there any workarounds within Kibana?

If you are on 9.3+ and have an Enterprise license you can use the new Workflow features to do scheduled actions, like run an ESQL query for example.

[Tortoise]

Thank you @leandrojmp