# What does "OK" mean for a rule?

**URL:** <https://discuss.elastic.co/t/what-does-ok-mean-for-a-rule/278536>\
**Category:** Kibana\
**Created:** [July 13, 2021, 12:40pm UTC](https://discuss.elastic.co/t/what-does-ok-mean-for-a-rule/278536 "2021-07-13T12:40:58Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sandra\_Schlichting](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandra_schlichting/32/84122_2.png) [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\
**Post date:** [July 13, 2021, 12:40pm UTC](https://discuss.elastic.co/t/what-does-ok-mean-for-a-rule/278536/1 "2021-07-13T12:40:58Z")

</div>

Dear all =)

What does it mean that a rule is "ok" as seen on this screenshot?

I suppose I don't want anything but "Active"?

 ![rules-and-connectors-ui](https://us1.discourse-cdn.com/elastic/original/3X/f/c/fcfce252863eff2d21425cb71876d10d0c64da1f.png)

Hugs,  
Sandra =)

---

<div class="post-metadata">

**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\
**Post date:** [July 22, 2021, 10:02am UTC](https://discuss.elastic.co/t/what-does-ok-mean-for-a-rule/278536/2 "2021-07-22T10:02:19Z")

</div>

Hi, from the documentation [Create and manage rules | Kibana Guide [7.16] | Elastic](https://www.elastic.co/guide/en/kibana/7.x/create-and-manage-rules.html#_rule_status)

### Rule status

A rule can have one of the following statuses:

`active`

The conditions for the rule have been met, and the associated actions should be invoked.

`ok`

The conditions for the rule were previously met, but no longer. Changed to `recovered` in the 7.14 release.

`error`

An error was encountered during rule execution.

`pending`

The rule has not yet executed. The rule was either just created, or enabled after being disabled.

`unknown`

A problem occurred when calculating the status. Most likely, something went wrong with the alerting code.

---

<div class="post-metadata">

**Author:** ![Sandra\_Schlichting](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandra_schlichting/32/84122_2.png) [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\
**Post date:** [July 22, 2021, 11:27am UTC](https://discuss.elastic.co/t/what-does-ok-mean-for-a-rule/278536/3 "2021-07-22T11:27:54Z")

</div>

Dear Marco =)

Thanks a lot for looking into this!

What does "The conditions for the rule were previously met, but no longer" mean? In particularly "no longer"? I see `ok (recovered)` for 99% of all new rules I create, so I am concerned that they don't actually do anything.

How can I turn an `ok/recovered` rule into `active`?

Hugs,  
Sandra =)

---

<div class="post-metadata">

**Author:** ![markov00](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/markov00/32/33316_2.png) [@markov00](https://discuss.elastic.co/u/markov00)\
**Post date:** [July 22, 2021, 2:52pm UTC](https://discuss.elastic.co/t/what-does-ok-mean-for-a-rule/278536/4 "2021-07-22T14:52:31Z")

</div>

Hey sandra,  
You are right, the docs is not very clear, but the OK and Active mean:

- `Ok` means the rule is running fine, doesn’t detect anything worth alerting on
- `Active` means the rule is finding things worth alerting on (firing actions)

The alerting team opened a PR to improve the Docs

> <https://github.com/elastic/kibana/pull/106545>
>
> In this PR, I'm fixing the rule status documentation for "ok" status. It seemed …to previously define what the alert "ok" status meant.

---

<div class="post-metadata">

**Author:** ![Sandra\_Schlichting](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sandra_schlichting/32/84122_2.png) [@Sandra\_Schlichting](https://discuss.elastic.co/u/Sandra_Schlichting)\
**Post date:** [July 23, 2021, 8:50am UTC](https://discuss.elastic.co/t/what-does-ok-mean-for-a-rule/278536/5 "2021-07-23T08:50:27Z")

</div>

Dear Marco,

Those two last diescriptions, makes it very clear, that they mean. Thanks =)

I would say as an user, it is very confusing that health and activity are mixed in under the Status column. `Unknown`, `pending`, `error`, and `OK` are health related, and `active` doesn't belong in that category.

Changing `OK` to `recovering` will probably make it worse. Recovering sounds to me as, something have crashed (not been gracefully shut down), and that something is regenerating lost data. Think e.g. a database host with had its power cut.

To me it would be better to keep `OK` and then either change `Active` to `OK and recently been active` or add a new Activity column with `cold` and `hot` states.

Hugs,  
Sandra =)

---

<div class="post-metadata">

**Author:** ![mikecote](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mikecote/32/58549_2.png) [@mikecote](https://discuss.elastic.co/u/mikecote)\
**Post date:** [July 26, 2021, 12:28pm UTC](https://discuss.elastic.co/t/what-does-ok-mean-for-a-rule/278536/6 "2021-07-26T12:28:15Z")

</div>

Hi @Sandra_Schlichting,

The documentation was confusing rule and alert statuses. So we removed "recovering" from the terminology as it has nothing to do with the rule and kept "active" and "ok".

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 23, 2021, 12:29pm UTC](https://discuss.elastic.co/t/what-does-ok-mean-for-a-rule/278536/7 "2021-08-23T12:29:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
