Connect Slack to Kibana
When something happens in Slack, Notis takes the next step in Kibana. Describe what you want in plain English, or start from one of the examples below.
When this happens · Trigger
Do this · Action
Ways Notis can move work from Slack to Kibana
Turn Slack incidents into Kibana cases
When a team reports an operational incident in a Slack channel, open a Kibana case with the relevant context so the investigation has a clear home.
Create Kibana alert rules from outage requests
Turn an explicit Slack request for outage monitoring into a Kibana alerting rule, so the team can move from discussion to a defined signal.
Turn Slack dashboard requests into Kibana dashboards
When a teammate asks for a specific operational dashboard in Slack, create a Kibana dashboard that gives the request a concrete next step.
Save recurring Kibana query requests from Slack
Capture a Slack request for a repeatable operational view and create or update a Kibana saved object, reducing the need to reconstruct the same analysis.
Create Kibana data views from Slack requests
When a teammate explicitly asks to make a data source available for analysis, create a Kibana data view from that Slack request.
Open Kibana cases when a team flags an incident
Use a chosen Slack reaction as a lightweight signal to create a Kibana case from a message that needs investigation.
Create Kibana dashboards from reacted-to requests
Let a designated Slack reaction mark a dashboard request worth taking forward, then create a Kibana dashboard from the message context.
Check Kibana alerts when Slack reports an outage
When someone reports a possible outage in a Slack channel, find relevant Kibana alerts so responders can start with available evidence.
Find existing Kibana cases from Slack incident threads
When a new Slack message describes an incident, find related Kibana cases to help the team avoid duplicate investigations.
Supported Triggers and Actions
Notis builds workflows that link Slack to Kibana. A trigger fires from one place; an action lands in another.
Slack triggers
Kibana actions
Recurring trigger
Notis starts this workflow on a schedule, such as daily, weekly, or during business hours.
Delete Action
Tool to delete an action in kibana. use when you need to remove a specific action by its id, optionally within a specific space.
Webhook trigger
Notis starts this workflow when an external tool or custom backend sends an HTTP request.
Delete Alerting Rule
Tool to delete an alerting rule in kibana. use when you need to remove a specific alerting rule by its id.
New Channel Created Trigger
Triggered when a new channel is created in Slack.
Delete Connector
Tool to delete a connector in kibana. use when you need to remove an existing connector.
Channel Message Received
Triggered when a message is posted in a Slack channel (public, private, or multi-party IM). Does NOT match direct messages.
Delete Fleet Output
Tool to delete a specific output configuration in kibana fleet. use when you need to remove an existing output by its id.
Direct Message Received
Triggered when a new direct message (DM) is sent to a user in Slack. Catches all DMs across all DM channels.
Delete Fleet Proxy
Tool to delete a specific fleet proxy configuration by its id. use when you need to remove an existing proxy setup.
Message Reaction Added
Triggered when a reaction is added to a message in Slack. Supports optional filtering by channel and emoji name.
Delete List
Deletes a list. use when you want to delete a list by its id.
Message Reaction Removed
Triggered when a reaction is removed from a message in Slack. Supports optional filtering by channel and emoji name.
Delete Osquery Saved Query
Tool to delete a saved osquery query by its id. use when you need to remove a specific osquery saved query.
Reaction Added Trigger
DEPRECATED: use `SLACK_MESSAGE_REACTION_ADDED` instead. Triggered when a reaction is added to a message in Slack.
Delete Saved Object
Tool to delete a saved object in kibana. use when you need to remove a specific saved object like a visualization or dashboard.
Four ways to start an automation.
A trigger is the event that kicks a workflow off. Notis supports four kinds: an event in a connected app, an inbound webhook, a recurring schedule, and soon, your own database.
Integration triggers
Fire when something happens inside a connected app. New Notion page, Stripe charge, Linear issue: any of 1,000+ apps can start a workflow.
Webhook triggers
A unique URL per workflow. Anything that can send an HTTP POST can start an automation, including no-code tools that speak webhooks.
Recurring triggers
Cron-style schedules run a workflow on the clock. Daily standups, hourly syncs, business-hours-only digests: the workhorse of Notis.
Database triggers
Watch a row, query, or threshold in your own database and fire the moment the data changes. Row inserted, value crosses a limit, query starts matching.
Classic automation breaks. AI adapts.
Same triggers and actions, smarter middle. AI handles the fuzziness that breaks traditional Zapier-style workflows the moment a field gets renamed.
Describe it. Notis builds it.
Skip the visual builder. Tell Notis what you want, in plain English. It writes the workflow, you review and deploy.
You · in the Notis Builder
NEW“When a row gets added to the Q4 OKRs Notion database and the status is Blocked, send a Telegram message to the owner with a summary of what's blocking, and ping me if there's no reply within 24 hours.”
Notis built this automation:
Watch every run.
Notis Desktop is Mission Control for your AI automations. See every run, replay, edit, or rewind. Set approval gates so Notis pauses before destructive actions.
- Full run history with inputs, outputs and traces
- Replay any run with edited inputs
- Approval inbox, confirm via chat in one tap
- Audit logs for compliance teams
Automations
Inbox
Migrate background jobs to a durable queue You can cancel it through Stripe
3 daysNotis v3 release update This one’s v3: Notis Manager (desktop app with …
8 daysAdd multi-tenant RBAC User initiates a voice call
13 daysDraft pricing v (tiers, limits, overages) and sanity-check margins
2 weeksVerify analytics events for new features That’s a really interesting automat…
1 monthEverything in the box.
Whatever starts the workflow, the platform underneath is the same: a thinking brain, full visibility, and you in control.
AI in the middle
Every step can include an LLM call: summarise, classify, extract, rewrite.
Full observability
Every run, every step, every input, all replay-able from Mission Control.
Human in the loop
Pause for approval. Notis pings you in chat with one-tap approve.
Self-healing
When an API changes shape, Notis adapts the parser. Less midnight fire-fighting.
More ways to connect Slack and Kibana
Connect any two apps with Notis in the middle.
Slack and Kibana, or any other combination from 1,000+ integrations.
When this happens · Trigger
Do this · Action
Save your first hour today.
7-day trial of any paid plan, with 20$ of usage included.
No card. Works with personal or business Kibana.