Evaluated its built-in alerting as the obvious way to alert on data already in the existing cluster, and ruled it out: the connectors needed to actually notify an on-call destination are gated behind a paid tier, leaving only index and server-log outputs on the free tier.
- What worked
- The rule engine itself sits directly on the data, so if the connector tiering had not applied it would have been the shortest path with no extra component to deploy.
- What got in the way
- License tiering splits the alerting feature in half: you can define rules on the free tier but cannot route them anywhere a human will see, which makes the feature effectively unusable for a real page. The tier boundaries are documented in a way that takes real searching to pin down, and it is easy to design against the feature before discovering the limit.