[Request] Document enhanced "Execution results" tab on Rule Details page

[nikitaindik]

Description

We are going to release an improved version of the Execution results tab on the Rule Details page in v9.4.0. The "Execution log" is now more usable. Users will get more detailed insights into rule execution. The table now displays new metrics + there's a details flyout with more info about each run. This should help users understand rule performance better and aid in troubleshooting failures.

Deployment: https://nikitaindik-pr-260721-enhancements-for-execution-results-ta.kbndev.co

Screen.Recording.2026-04-02.at.15.29.03.mov

What's new for users

Before

The Execution results tab showed a table with execution status, timestamp, duration, an indexing duration breakdown and message. It provided limited insight into what actually happened during a rule run.

After

The tab now shows richer information per execution and introduces a details flyout for deep-diving into individual runs.

Reworked table

The table now displays the following columns:

Column	Description
Status	Overall status of execution.
Run type	Whether this was a standard scheduled execution or a manual backfill run.
Timestamp	Datetime rule execution initiated.
Execution duration	The length of time it took for the rule to run.
Alerts created	Number of new alerts generated during this execution.
Message	Relevant message from execution outcome.

Row actions:

• Filter alerts by rule execution ID – this existed in the old UI as well. It takes the user to the Alerts table filtered by the rule execution ID. Disabled (with tooltip "No alerts were created during this run") when the execution produced no alerts.
• View details - opens the execution details flyout.

In the old table there were toggles to see additional columns – they are now gone and replaced with a flyout.

The table supports filtering by execution status and run type, and includes a date picker for narrowing down the time range. Same as the old one.

Execution details flyout

Clicking "View details" on a row opens a side panel with the execution ID (copyable) and the following sections:

Message - The outcome message, contains error or warning if it happened during the execution.

Source event time range (shown for manual aka backfill runs only) - The time range of source events that were queried during this backfill execution.

• From - Start of the source event time range queried by this execution.
• To - End of the source event time range queried by this execution.

Alerts

• Candidate alerts - Number of detected alerts before applying de-duplication and suppression.
• Alerts created - Number of alerts eventually indexed in Elasticsearch after de-duplication and suppression.

Indices

• Matched indices - Number of indices matching rule's index patterns.
• Frozen indices queried - Number of frozen-tier indices included in the search.

Timing

• Gap duration - Duration of gap in rule execution. Adjust rule look-back or see documentation for mitigating gaps.
• Scheduling delay - The length of time from rule scheduled till rule executed.
• Execution duration - The length of time it took for the rule to run.

Execution duration breakdown

• Search - Time spent on Elasticsearch search requests in total during rule execution.
• Indexing - Time spent on indexing detected alerts.

Prerequisites, privileges, feature flags

Feature flag: newExecutionResultsTableEnabled (enabled by default, so no need to tweak any configs)

No additional privileges are required beyond the standard privileges needed to view rule details.

Which documentation set does this change impact?

ESS and Serverless

ESS release

v9.4.0

Serverless release

April 7, 2026

API docs impact

No public API docs impact. The feature uses an internal API.

Background & resources

• PRs:
  • #257203 - Execution metrics collection (merged)
  • #257740 - API endpoint for execution results (merged)
  • #259105 - UI PR
• Previous (now closed) docs request: [Request] Document the new "Execution Events" tab on Rule Details page #5282
• Point of contact: @nikitaindik

Screenshots