The Kibana UI provides beautiful visualizations that help with analyzing and detecting anomalies in data in real time. However, as an administrator or an analyst, it wouldn't be possible to sit in front of dashboards for hours to detect anomalies and take action. It would be nice if the administrator gets notified when, for example, the following events occur:

• There is an outage in one of the servers being monitored
• An Elasticsearch Cluster turns red/yellow due to some nodes leaving the cluster
• Disk space/CPU utilization crosses a specific threshold
• There is an intrusion in the network
• There are errors reported in the logs

This is where the X-Pack Alerting component comes to the rescue. The X-Pack Alerting component, named Watcher, provides the ability to automatically watch for changes/anomalies in data stored on Elasticsearch and take the required action. X-Pack Alerting is enabled by default as part of the X-Pack default installation. 

Watcher provides a set of REST APIs for creating, managing, and testing watches. Kibana also provides a Watcher UI for creating, managing, and testing. The Watcher UI internally makes use of Watcher REST APIs for the management of watches.