Elastic Docs ›Kibana Guide ›APIs
« Machine learning APIs Deleted pages »

Alert and rule APIsedit

This functionality is in technical preview and may be changed or removed in a future release. Elastic will apply best effort to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.

Access

  1. APIKey KeyParamName:ApiKey KeyInQuery:false KeyInHeader:true
  2. HTTP Basic Authentication

Methods

[ Jump to Models ]

Table of Contents

Alerting

Alerting

Up 
post /s/{spaceId}/api/alerting/rule
Creates a rule with a randomly generated rule identifier. (createRule)
To create a rule, you must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule you're creating. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Consumes

This API call consumes the following media types via the Content-Type request header:
  • application/json

Request body

create_rule_request create_rule_request (required)
Body Parameter —

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Return type

rule_response_properties

Example data

Content-Type: application/json
{
  "throttle" : "10m",
  "created_at" : "2022-12-05T23:36:58.284Z",
  "api_key_created_by_user" : false,
  "enabled" : true,
  "running" : true,
  "notify_when" : "notify_when",
  "next_run" : "2022-12-06T00:14:43.818Z",
  "updated_at" : "2022-12-05T23:36:58.284Z",
  "execution_status" : {
    "last_execution_date" : "2022-12-06T00:13:43.89Z",
    "last_duration" : 55,
    "status" : "ok"
  },
  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "consumer" : "alerts",
  "last_run" : {
    "alerts_count" : {
      "ignored" : 6,
      "new" : 1,
      "recovered" : 5,
      "active" : 0
    },
    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
    "outcome_order" : 5,
    "warning" : "warning",
    "outcome" : "succeeded"
  },
  "params" : {
    "key" : ""
  },
  "created_by" : "elastic",
  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
  "rule_type_id" : "monitoring_alert_cluster_health",
  "revision" : 2,
  "tags" : [ "tags", "tags" ],
  "api_key_owner" : "elastic",
  "schedule" : {
    "interval" : "1m"
  },
  "name" : "cluster_health_rule",
  "updated_by" : "elastic",
  "mute_all" : false,
  "actions" : [ {
    "alerts_filter" : {
      "timeframe" : {
        "hours" : {
          "start" : "08:00",
          "end" : "17:00"
        },
        "timezone" : "Europe/Madrid",
        "days" : [ 1, 2, 3, 4, 5 ]
      },
      "query" : {
        "kql" : "kql",
        "filters" : [ {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        }, {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        } ]
      }
    },
    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
    "params" : {
      "key" : ""
    },
    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
    "connector_type_id" : ".server-log",
    "frequency" : {
      "summary" : true,
      "throttle" : "10m",
      "notify_when" : "onActiveAlert"
    },
    "group" : "default"
  }, {
    "alerts_filter" : {
      "timeframe" : {
        "hours" : {
          "start" : "08:00",
          "end" : "17:00"
        },
        "timezone" : "Europe/Madrid",
        "days" : [ 1, 2, 3, 4, 5 ]
      },
      "query" : {
        "kql" : "kql",
        "filters" : [ {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        }, {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        } ]
      }
    },
    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
    "params" : {
      "key" : ""
    },
    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
    "connector_type_id" : ".server-log",
    "frequency" : {
      "summary" : true,
      "throttle" : "10m",
      "notify_when" : "onActiveAlert"
    },
    "group" : "default"
  } ]
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call. rule_response_properties

401

Authorization information is missing or invalid. 401_response

404

Object is not found. 404_response
Up 
post /s/{spaceId}/api/alerting/rule/{ruleId}
Creates a rule with a specific rule identifier. (createRuleId)
To create a rule, you must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule you're creating. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
ruleId (required)
Path Parameter — An UUID v1 or v4 identifier for the rule. If you omit this parameter, an identifier is randomly generated. default: null

Consumes

This API call consumes the following media types via the Content-Type request header:
  • application/json

Request body

create_rule_request create_rule_request (required)
Body Parameter —

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Return type

rule_response_properties

Example data

Content-Type: application/json
{
  "throttle" : "10m",
  "created_at" : "2022-12-05T23:36:58.284Z",
  "api_key_created_by_user" : false,
  "enabled" : true,
  "running" : true,
  "notify_when" : "notify_when",
  "next_run" : "2022-12-06T00:14:43.818Z",
  "updated_at" : "2022-12-05T23:36:58.284Z",
  "execution_status" : {
    "last_execution_date" : "2022-12-06T00:13:43.89Z",
    "last_duration" : 55,
    "status" : "ok"
  },
  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "consumer" : "alerts",
  "last_run" : {
    "alerts_count" : {
      "ignored" : 6,
      "new" : 1,
      "recovered" : 5,
      "active" : 0
    },
    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
    "outcome_order" : 5,
    "warning" : "warning",
    "outcome" : "succeeded"
  },
  "params" : {
    "key" : ""
  },
  "created_by" : "elastic",
  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
  "rule_type_id" : "monitoring_alert_cluster_health",
  "revision" : 2,
  "tags" : [ "tags", "tags" ],
  "api_key_owner" : "elastic",
  "schedule" : {
    "interval" : "1m"
  },
  "name" : "cluster_health_rule",
  "updated_by" : "elastic",
  "mute_all" : false,
  "actions" : [ {
    "alerts_filter" : {
      "timeframe" : {
        "hours" : {
          "start" : "08:00",
          "end" : "17:00"
        },
        "timezone" : "Europe/Madrid",
        "days" : [ 1, 2, 3, 4, 5 ]
      },
      "query" : {
        "kql" : "kql",
        "filters" : [ {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        }, {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        } ]
      }
    },
    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
    "params" : {
      "key" : ""
    },
    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
    "connector_type_id" : ".server-log",
    "frequency" : {
      "summary" : true,
      "throttle" : "10m",
      "notify_when" : "onActiveAlert"
    },
    "group" : "default"
  }, {
    "alerts_filter" : {
      "timeframe" : {
        "hours" : {
          "start" : "08:00",
          "end" : "17:00"
        },
        "timezone" : "Europe/Madrid",
        "days" : [ 1, 2, 3, 4, 5 ]
      },
      "query" : {
        "kql" : "kql",
        "filters" : [ {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        }, {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        } ]
      }
    },
    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
    "params" : {
      "key" : ""
    },
    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
    "connector_type_id" : ".server-log",
    "frequency" : {
      "summary" : true,
      "throttle" : "10m",
      "notify_when" : "onActiveAlert"
    },
    "group" : "default"
  } ]
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call. rule_response_properties

401

Authorization information is missing or invalid. 401_response

404

Object is not found. 404_response
Up 
delete /s/{spaceId}/api/alerting/rule/{ruleId}
Deletes a rule. (deleteRule)
To delete a rule, you must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule you're deleting. For example, the Management > Stack Rules feature, Analytics > Discover or Machine Learning features, Observability, or Security features. WARNING: After you delete a rule, you cannot recover it. If the API key that is used by the rule was created automatically, it is deleted.

Path parameters

ruleId (required)
Path Parameter — An identifier for the rule. default: null
spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response

404

Object is not found. 404_response
Up 
post /s/{spaceId}/api/alerting/rule/{ruleId}/_disable
Disables a rule. (disableRule)
You must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features.

Path parameters

ruleId (required)
Path Parameter — An identifier for the rule. default: null
spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response

404

Object is not found. 404_response
Up 
post /s/{spaceId}/api/alerting/rule/{ruleId}/_enable
Enables a rule. (enableRule)
To enable a rule, you must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs.

Path parameters

ruleId (required)
Path Parameter — An identifier for the rule. default: null
spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response

404

Object is not found. 401_response
Up 
get /s/{spaceId}/api/alerting/rules/_find
Retrieves information about rules. (findRules)
You must have read privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rules you're seeking. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. To find rules associated with the Stack Monitoring feature, use the monitoring_user built-in role.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Query parameters

default_search_operator (optional)
Query Parameter — The default operator to use for the simple_query_string. default: OR
fields (optional)
Query Parameter — The fields to return in the attributes key of the response. default: null
filter (optional)
Query Parameter — A KQL string that you filter with an attribute from your saved object. It should look like savedObjectType.attributes.title: "myTitle". However, if you used a direct attribute of a saved object, such as updatedAt, you must define your filter, for example, savedObjectType.updatedAt > 2018-12-22. default: null
has_reference (optional)
Query Parameter — Filters the rules that have a relation with the reference objects with a specific type and identifier. default: null
page (optional)
Query Parameter — The page number to return. default: 1
per_page (optional)
Query Parameter — The number of rules to return per page. default: 20
search (optional)
Query Parameter — An Elasticsearch simple_query_string query that filters the objects in the response. default: null
search_fields (optional)
Query Parameter — The fields to perform the simple_query_string parsed query against. default: null
sort_field (optional)
Query Parameter — Determines which field is used to sort the results. The field must exist in the attributes key of the response. default: null
sort_order (optional)
Query Parameter — Determines the sort order. default: desc

Return type

findRules_200_response

Example data

Content-Type: application/json
{
  "per_page" : 6,
  "total" : 1,
  "data" : [ {
    "throttle" : "10m",
    "created_at" : "2022-12-05T23:36:58.284Z",
    "api_key_created_by_user" : false,
    "enabled" : true,
    "running" : true,
    "notify_when" : "notify_when",
    "next_run" : "2022-12-06T00:14:43.818Z",
    "updated_at" : "2022-12-05T23:36:58.284Z",
    "execution_status" : {
      "last_execution_date" : "2022-12-06T00:13:43.89Z",
      "last_duration" : 55,
      "status" : "ok"
    },
    "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
    "consumer" : "alerts",
    "last_run" : {
      "alerts_count" : {
        "ignored" : 6,
        "new" : 1,
        "recovered" : 5,
        "active" : 0
      },
      "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
      "outcome_order" : 5,
      "warning" : "warning",
      "outcome" : "succeeded"
    },
    "params" : {
      "key" : ""
    },
    "created_by" : "elastic",
    "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
    "rule_type_id" : "monitoring_alert_cluster_health",
    "revision" : 2,
    "tags" : [ "tags", "tags" ],
    "api_key_owner" : "elastic",
    "schedule" : {
      "interval" : "1m"
    },
    "name" : "cluster_health_rule",
    "updated_by" : "elastic",
    "mute_all" : false,
    "actions" : [ {
      "alerts_filter" : {
        "timeframe" : {
          "hours" : {
            "start" : "08:00",
            "end" : "17:00"
          },
          "timezone" : "Europe/Madrid",
          "days" : [ 1, 2, 3, 4, 5 ]
        },
        "query" : {
          "kql" : "kql",
          "filters" : [ {
            "$state" : "{}",
            "meta" : {
              "field" : "field",
              "controlledBy" : "controlledBy",
              "negate" : true,
              "alias" : "alias",
              "index" : "index",
              "disabled" : true,
              "params" : "{}",
              "type" : "type",
              "value" : "value",
              "isMultiIndex" : true,
              "key" : "key",
              "group" : "group"
            },
            "query" : "{}"
          }, {
            "$state" : "{}",
            "meta" : {
              "field" : "field",
              "controlledBy" : "controlledBy",
              "negate" : true,
              "alias" : "alias",
              "index" : "index",
              "disabled" : true,
              "params" : "{}",
              "type" : "type",
              "value" : "value",
              "isMultiIndex" : true,
              "key" : "key",
              "group" : "group"
            },
            "query" : "{}"
          } ]
        }
      },
      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
      "params" : {
        "key" : ""
      },
      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
      "connector_type_id" : ".server-log",
      "frequency" : {
        "summary" : true,
        "throttle" : "10m",
        "notify_when" : "onActiveAlert"
      },
      "group" : "default"
    }, {
      "alerts_filter" : {
        "timeframe" : {
          "hours" : {
            "start" : "08:00",
            "end" : "17:00"
          },
          "timezone" : "Europe/Madrid",
          "days" : [ 1, 2, 3, 4, 5 ]
        },
        "query" : {
          "kql" : "kql",
          "filters" : [ {
            "$state" : "{}",
            "meta" : {
              "field" : "field",
              "controlledBy" : "controlledBy",
              "negate" : true,
              "alias" : "alias",
              "index" : "index",
              "disabled" : true,
              "params" : "{}",
              "type" : "type",
              "value" : "value",
              "isMultiIndex" : true,
              "key" : "key",
              "group" : "group"
            },
            "query" : "{}"
          }, {
            "$state" : "{}",
            "meta" : {
              "field" : "field",
              "controlledBy" : "controlledBy",
              "negate" : true,
              "alias" : "alias",
              "index" : "index",
              "disabled" : true,
              "params" : "{}",
              "type" : "type",
              "value" : "value",
              "isMultiIndex" : true,
              "key" : "key",
              "group" : "group"
            },
            "query" : "{}"
          } ]
        }
      },
      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
      "params" : {
        "key" : ""
      },
      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
      "connector_type_id" : ".server-log",
      "frequency" : {
        "summary" : true,
        "throttle" : "10m",
        "notify_when" : "onActiveAlert"
      },
      "group" : "default"
    } ]
  }, {
    "throttle" : "10m",
    "created_at" : "2022-12-05T23:36:58.284Z",
    "api_key_created_by_user" : false,
    "enabled" : true,
    "running" : true,
    "notify_when" : "notify_when",
    "next_run" : "2022-12-06T00:14:43.818Z",
    "updated_at" : "2022-12-05T23:36:58.284Z",
    "execution_status" : {
      "last_execution_date" : "2022-12-06T00:13:43.89Z",
      "last_duration" : 55,
      "status" : "ok"
    },
    "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
    "consumer" : "alerts",
    "last_run" : {
      "alerts_count" : {
        "ignored" : 6,
        "new" : 1,
        "recovered" : 5,
        "active" : 0
      },
      "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
      "outcome_order" : 5,
      "warning" : "warning",
      "outcome" : "succeeded"
    },
    "params" : {
      "key" : ""
    },
    "created_by" : "elastic",
    "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
    "rule_type_id" : "monitoring_alert_cluster_health",
    "revision" : 2,
    "tags" : [ "tags", "tags" ],
    "api_key_owner" : "elastic",
    "schedule" : {
      "interval" : "1m"
    },
    "name" : "cluster_health_rule",
    "updated_by" : "elastic",
    "mute_all" : false,
    "actions" : [ {
      "alerts_filter" : {
        "timeframe" : {
          "hours" : {
            "start" : "08:00",
            "end" : "17:00"
          },
          "timezone" : "Europe/Madrid",
          "days" : [ 1, 2, 3, 4, 5 ]
        },
        "query" : {
          "kql" : "kql",
          "filters" : [ {
            "$state" : "{}",
            "meta" : {
              "field" : "field",
              "controlledBy" : "controlledBy",
              "negate" : true,
              "alias" : "alias",
              "index" : "index",
              "disabled" : true,
              "params" : "{}",
              "type" : "type",
              "value" : "value",
              "isMultiIndex" : true,
              "key" : "key",
              "group" : "group"
            },
            "query" : "{}"
          }, {
            "$state" : "{}",
            "meta" : {
              "field" : "field",
              "controlledBy" : "controlledBy",
              "negate" : true,
              "alias" : "alias",
              "index" : "index",
              "disabled" : true,
              "params" : "{}",
              "type" : "type",
              "value" : "value",
              "isMultiIndex" : true,
              "key" : "key",
              "group" : "group"
            },
            "query" : "{}"
          } ]
        }
      },
      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
      "params" : {
        "key" : ""
      },
      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
      "connector_type_id" : ".server-log",
      "frequency" : {
        "summary" : true,
        "throttle" : "10m",
        "notify_when" : "onActiveAlert"
      },
      "group" : "default"
    }, {
      "alerts_filter" : {
        "timeframe" : {
          "hours" : {
            "start" : "08:00",
            "end" : "17:00"
          },
          "timezone" : "Europe/Madrid",
          "days" : [ 1, 2, 3, 4, 5 ]
        },
        "query" : {
          "kql" : "kql",
          "filters" : [ {
            "$state" : "{}",
            "meta" : {
              "field" : "field",
              "controlledBy" : "controlledBy",
              "negate" : true,
              "alias" : "alias",
              "index" : "index",
              "disabled" : true,
              "params" : "{}",
              "type" : "type",
              "value" : "value",
              "isMultiIndex" : true,
              "key" : "key",
              "group" : "group"
            },
            "query" : "{}"
          }, {
            "$state" : "{}",
            "meta" : {
              "field" : "field",
              "controlledBy" : "controlledBy",
              "negate" : true,
              "alias" : "alias",
              "index" : "index",
              "disabled" : true,
              "params" : "{}",
              "type" : "type",
              "value" : "value",
              "isMultiIndex" : true,
              "key" : "key",
              "group" : "group"
            },
            "query" : "{}"
          } ]
        }
      },
      "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
      "params" : {
        "key" : ""
      },
      "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
      "connector_type_id" : ".server-log",
      "frequency" : {
        "summary" : true,
        "throttle" : "10m",
        "notify_when" : "onActiveAlert"
      },
      "group" : "default"
    } ]
  } ],
  "page" : 0
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call. findRules_200_response

401

Authorization information is missing or invalid. 401_response
Up 
get /s/{spaceId}/api/alerting/_health
Retrieves the health status of the alerting framework. (getAlertingHealth)
You must have read privileges for the Management > Stack Rules feature or for at least one of the Analytics > Discover, Analytics > Machine Learning, Observability, or Security features.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Return type

getAlertingHealth_200_response

Example data

Content-Type: application/json
{
  "alerting_framework_health" : {
    "execution_health" : {
      "status" : "ok",
      "timestamp" : "2023-01-13T01:28:00.28Z"
    },
    "read_health" : {
      "status" : "ok",
      "timestamp" : "2023-01-13T01:28:00.28Z"
    },
    "decryption_health" : {
      "status" : "ok",
      "timestamp" : "2023-01-13T01:28:00.28Z"
    }
  },
  "has_permanent_encryption_key" : true,
  "is_sufficiently_secure" : true
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call. getAlertingHealth_200_response

401

Authorization information is missing or invalid. 401_response
Up 
get /s/{spaceId}/api/alerting/rule/{ruleId}
Retrieves a rule by its identifier. (getRule)
You must have read privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rules you're seeking. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. To get rules associated with the Stack Monitoring feature, use the monitoring_user built-in role.

Path parameters

ruleId (required)
Path Parameter — An identifier for the rule. default: null
spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Return type

rule_response_properties

Example data

Content-Type: application/json
{
  "throttle" : "10m",
  "created_at" : "2022-12-05T23:36:58.284Z",
  "api_key_created_by_user" : false,
  "enabled" : true,
  "running" : true,
  "notify_when" : "notify_when",
  "next_run" : "2022-12-06T00:14:43.818Z",
  "updated_at" : "2022-12-05T23:36:58.284Z",
  "execution_status" : {
    "last_execution_date" : "2022-12-06T00:13:43.89Z",
    "last_duration" : 55,
    "status" : "ok"
  },
  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "consumer" : "alerts",
  "last_run" : {
    "alerts_count" : {
      "ignored" : 6,
      "new" : 1,
      "recovered" : 5,
      "active" : 0
    },
    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
    "outcome_order" : 5,
    "warning" : "warning",
    "outcome" : "succeeded"
  },
  "params" : {
    "key" : ""
  },
  "created_by" : "elastic",
  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
  "rule_type_id" : "monitoring_alert_cluster_health",
  "revision" : 2,
  "tags" : [ "tags", "tags" ],
  "api_key_owner" : "elastic",
  "schedule" : {
    "interval" : "1m"
  },
  "name" : "cluster_health_rule",
  "updated_by" : "elastic",
  "mute_all" : false,
  "actions" : [ {
    "alerts_filter" : {
      "timeframe" : {
        "hours" : {
          "start" : "08:00",
          "end" : "17:00"
        },
        "timezone" : "Europe/Madrid",
        "days" : [ 1, 2, 3, 4, 5 ]
      },
      "query" : {
        "kql" : "kql",
        "filters" : [ {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        }, {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        } ]
      }
    },
    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
    "params" : {
      "key" : ""
    },
    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
    "connector_type_id" : ".server-log",
    "frequency" : {
      "summary" : true,
      "throttle" : "10m",
      "notify_when" : "onActiveAlert"
    },
    "group" : "default"
  }, {
    "alerts_filter" : {
      "timeframe" : {
        "hours" : {
          "start" : "08:00",
          "end" : "17:00"
        },
        "timezone" : "Europe/Madrid",
        "days" : [ 1, 2, 3, 4, 5 ]
      },
      "query" : {
        "kql" : "kql",
        "filters" : [ {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        }, {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        } ]
      }
    },
    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
    "params" : {
      "key" : ""
    },
    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
    "connector_type_id" : ".server-log",
    "frequency" : {
      "summary" : true,
      "throttle" : "10m",
      "notify_when" : "onActiveAlert"
    },
    "group" : "default"
  } ]
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call. rule_response_properties

401

Authorization information is missing or invalid. 401_response

404

Object is not found. 404_response
Up 
get /s/{spaceId}/api/alerting/rule_types
Retrieves a list of rule types. (getRuleTypes)
If you have read privileges for one or more Kibana features, the API response contains information about the appropriate rule types. For example, there are rule types associated with the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability features, and Security features. To get rule types associated with the Stack Monitoring feature, use the monitoring_user built-in role.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Return type

array[getRuleTypes_200_response_inner]

Example data

Content-Type: application/json
{
  "recovery_action_group" : {
    "name" : "name",
    "id" : "id"
  },
  "does_set_recovery_context" : true,
  "is_exportable" : true,
  "authorized_consumers" : {
    "alerts" : {
      "all" : true,
      "read" : true
    },
    "discover" : {
      "all" : true,
      "read" : true
    },
    "stackAlerts" : {
      "all" : true,
      "read" : true
    },
    "infrastructure" : {
      "all" : true,
      "read" : true
    },
    "siem" : {
      "all" : true,
      "read" : true
    },
    "monitoring" : {
      "all" : true,
      "read" : true
    },
    "logs" : {
      "all" : true,
      "read" : true
    },
    "apm" : {
      "all" : true,
      "read" : true
    },
    "ml" : {
      "all" : true,
      "read" : true
    },
    "uptime" : {
      "all" : true,
      "read" : true
    }
  },
  "action_groups" : [ {
    "name" : "name",
    "id" : "id"
  }, {
    "name" : "name",
    "id" : "id"
  } ],
  "minimum_license_required" : "basic",
  "action_variables" : {
    "context" : [ {
      "name" : "name",
      "description" : "description",
      "useWithTripleBracesInTemplates" : true
    }, {
      "name" : "name",
      "description" : "description",
      "useWithTripleBracesInTemplates" : true
    } ],
    "state" : [ {
      "name" : "name",
      "description" : "description"
    }, {
      "name" : "name",
      "description" : "description"
    } ],
    "params" : [ {
      "name" : "name",
      "description" : "description"
    }, {
      "name" : "name",
      "description" : "description"
    } ]
  },
  "rule_task_timeout" : "5m",
  "name" : "name",
  "enabled_in_license" : true,
  "producer" : "stackAlerts",
  "id" : "id",
  "default_action_group_id" : "default_action_group_id"
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
post /s/{spaceId}/api/alerts/alert/{alertId}
Create an alert. (legacyCreateAlert)
Deprecated in 7.13.0. Use the create rule API instead.

Path parameters

alertId (required)
Path Parameter — An UUID v1 or v4 identifier for the alert. If this parameter is omitted, the identifier is randomly generated. default: null
spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Consumes

This API call consumes the following media types via the Content-Type request header:
  • application/json

Request body

Legacy_create_alert_request_properties Legacy_create_alert_request_properties (required)
Body Parameter —

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Return type

alert_response_properties

Example data

Content-Type: application/json
{
  "alertTypeId" : ".index-threshold",
  "throttle" : "throttle",
  "updatedBy" : "elastic",
  "executionStatus" : {
    "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
    "status" : "ok"
  },
  "params" : {
    "key" : ""
  },
  "enabled" : true,
  "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
  "tags" : [ "tags", "tags" ],
  "createdAt" : "2022-12-05T23:36:58.284Z",
  "schedule" : {
    "interval" : "interval"
  },
  "notifyWhen" : "onActionGroupChange",
  "createdBy" : "elastic",
  "muteAll" : false,
  "name" : "my alert",
  "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "actions" : [ "{}", "{}" ],
  "apiKeyOwner" : "elastic",
  "updatedAt" : "2022-12-05T23:36:58.284Z"
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call. alert_response_properties

401

Authorization information is missing or invalid. 401_response
Up 
post /s/{spaceId}/api/alerts/alert/{alertId}/_disable
Disables an alert. (legacyDisableAlert)
Deprecated in 7.13.0. Use the disable rule API instead.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
Path Parameter — The identifier for the alert. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
post /s/{spaceId}/api/alerts/alert/{alertId}/_enable
Enables an alert. (legacyEnableAlert)
Deprecated in 7.13.0. Use the enable rule API instead.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
Path Parameter — The identifier for the alert. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
get /s/{spaceId}/api/alerts/alerts/_find
Retrieves a paginated set of alerts. (legacyFindAlerts)
Deprecated in 7.13.0. Use the find rules API instead. NOTE: Alert params are stored as a flattened field type and analyzed as keywords. As alerts change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Query parameters

default_search_operator (optional)
Query Parameter — The default operator to use for the simple_query_string. default: OR
fields (optional)
Query Parameter — The fields to return in the attributes key of the response. default: null
filter (optional)
Query Parameter — A KQL string that you filter with an attribute from your saved object. It should look like savedObjectType.attributes.title: "myTitle". However, if you used a direct attribute of a saved object, such as updatedAt, you must define your filter, for example, savedObjectType.updatedAt > 2018-12-22. default: null
has_reference (optional)
Query Parameter — Filters the rules that have a relation with the reference objects with a specific type and identifier. default: null
page (optional)
Query Parameter — The page number to return. default: 1
per_page (optional)
Query Parameter — The number of alerts to return per page. default: 20
search (optional)
Query Parameter — An Elasticsearch simple_query_string query that filters the alerts in the response. default: null
search_fields (optional)
Query Parameter — The fields to perform the simple_query_string parsed query against. default: null
sort_field (optional)
Query Parameter — Determines which field is used to sort the results. The field must exist in the attributes key of the response. default: null
sort_order (optional)
Query Parameter — Determines the sort order. default: desc

Return type

legacyFindAlerts_200_response

Example data

Content-Type: application/json
{
  "total" : 1,
  "perPage" : 6,
  "data" : [ {
    "alertTypeId" : ".index-threshold",
    "throttle" : "throttle",
    "updatedBy" : "elastic",
    "executionStatus" : {
      "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
      "status" : "ok"
    },
    "params" : {
      "key" : ""
    },
    "enabled" : true,
    "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
    "tags" : [ "tags", "tags" ],
    "createdAt" : "2022-12-05T23:36:58.284Z",
    "schedule" : {
      "interval" : "interval"
    },
    "notifyWhen" : "onActionGroupChange",
    "createdBy" : "elastic",
    "muteAll" : false,
    "name" : "my alert",
    "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
    "actions" : [ "{}", "{}" ],
    "apiKeyOwner" : "elastic",
    "updatedAt" : "2022-12-05T23:36:58.284Z"
  }, {
    "alertTypeId" : ".index-threshold",
    "throttle" : "throttle",
    "updatedBy" : "elastic",
    "executionStatus" : {
      "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
      "status" : "ok"
    },
    "params" : {
      "key" : ""
    },
    "enabled" : true,
    "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
    "tags" : [ "tags", "tags" ],
    "createdAt" : "2022-12-05T23:36:58.284Z",
    "schedule" : {
      "interval" : "interval"
    },
    "notifyWhen" : "onActionGroupChange",
    "createdBy" : "elastic",
    "muteAll" : false,
    "name" : "my alert",
    "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
    "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
    "actions" : [ "{}", "{}" ],
    "apiKeyOwner" : "elastic",
    "updatedAt" : "2022-12-05T23:36:58.284Z"
  } ],
  "page" : 0
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call. legacyFindAlerts_200_response

401

Authorization information is missing or invalid. 401_response
Up 
get /s/{spaceId}/api/alerts/alert/{alertId}
Retrieves an alert by its identifier. (legacyGetAlert)
Deprecated in 7.13.0. Use the get rule API instead.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
Path Parameter — The identifier for the alert. default: null

Return type

alert_response_properties

Example data

Content-Type: application/json
{
  "alertTypeId" : ".index-threshold",
  "throttle" : "throttle",
  "updatedBy" : "elastic",
  "executionStatus" : {
    "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
    "status" : "ok"
  },
  "params" : {
    "key" : ""
  },
  "enabled" : true,
  "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
  "tags" : [ "tags", "tags" ],
  "createdAt" : "2022-12-05T23:36:58.284Z",
  "schedule" : {
    "interval" : "interval"
  },
  "notifyWhen" : "onActionGroupChange",
  "createdBy" : "elastic",
  "muteAll" : false,
  "name" : "my alert",
  "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "actions" : [ "{}", "{}" ],
  "apiKeyOwner" : "elastic",
  "updatedAt" : "2022-12-05T23:36:58.284Z"
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call. alert_response_properties

401

Authorization information is missing or invalid. 401_response
Up 
get /s/{spaceId}/api/alerts/alerts/list_alert_types
Retrieves a list of alert types. (legacyGetAlertTypes)
Deprecated in 7.13.0. Use the get rule types API instead.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Return type

array[legacyGetAlertTypes_200_response_inner]

Example data

Content-Type: application/json
{
  "defaultActionGroupId" : "defaultActionGroupId",
  "isExportable" : true,
  "actionVariables" : {
    "context" : [ {
      "name" : "name",
      "description" : "description"
    }, {
      "name" : "name",
      "description" : "description"
    } ],
    "state" : [ {
      "name" : "name",
      "description" : "description"
    }, {
      "name" : "name",
      "description" : "description"
    } ],
    "params" : [ {
      "name" : "name",
      "description" : "description"
    }, {
      "name" : "name",
      "description" : "description"
    } ]
  },
  "actionGroups" : [ {
    "name" : "name",
    "id" : "id"
  }, {
    "name" : "name",
    "id" : "id"
  } ],
  "name" : "name",
  "producer" : "producer",
  "authorizedConsumers" : "{}",
  "recoveryActionGroup" : {
    "name" : "name",
    "id" : "id"
  },
  "enabledInLicense" : true,
  "id" : "id",
  "minimumLicenseRequired" : "minimumLicenseRequired"
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
get /s/{spaceId}/api/alerts/alerts/_health
Retrieves the health status of the alerting framework. (legacyGetAlertingHealth)
Deprecated in 7.13.0. Use the get alerting framework health API instead.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Return type

legacyGetAlertingHealth_200_response

Example data

Content-Type: application/json
{
  "hasPermanentEncryptionKey" : true,
  "alertingFrameworkHealth" : {
    "executionHealth" : {
      "status" : "ok",
      "timestamp" : "2023-01-13T01:28:00.28Z"
    },
    "decryptionHealth" : {
      "status" : "ok",
      "timestamp" : "2023-01-13T01:28:00.28Z"
    },
    "readHealth" : {
      "status" : "ok",
      "timestamp" : "2023-01-13T01:28:00.28Z"
    }
  },
  "isSufficientlySecure" : true
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call. legacyGetAlertingHealth_200_response

401

Authorization information is missing or invalid. 401_response
Up 
post /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_mute
Mutes an alert instance. (legacyMuteAlertInstance)
Deprecated in 7.13.0. Use the mute alert API instead.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
Path Parameter — An identifier for the alert. default: null
alertInstanceId (required)
Path Parameter — An identifier for the alert instance. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
post /s/{spaceId}/api/alerts/alert/{alertId}/_mute_all
Mutes all alert instances. (legacyMuteAllAlertInstances)
Deprecated in 7.13.0. Use the mute all alerts API instead.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
Path Parameter — The identifier for the alert. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
post /s/{spaceId}/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute
Unmutes an alert instance. (legacyUnmuteAlertInstance)
Deprecated in 7.13.0. Use the unmute alert API instead.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
Path Parameter — An identifier for the alert. default: null
alertInstanceId (required)
Path Parameter — An identifier for the alert instance. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
post /s/{spaceId}/api/alerts/alert/{alertId}/_unmute_all
Unmutes all alert instances. (legacyUnmuteAllAlertInstances)
Deprecated in 7.13.0. Use the unmute all alerts API instead.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
Path Parameter — The identifier for the alert. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
put /s/{spaceId}/api/alerts/alert/{alertId}
Updates the attributes for an alert. (legacyUpdateAlert)
Deprecated in 7.13.0. Use the update rule API instead.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
Path Parameter — The identifier for the alert. default: null

Consumes

This API call consumes the following media types via the Content-Type request header:
  • application/json

Request body

Legacy_update_alert_request_properties Legacy_update_alert_request_properties (required)
Body Parameter —

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Return type

alert_response_properties

Example data

Content-Type: application/json
{
  "alertTypeId" : ".index-threshold",
  "throttle" : "throttle",
  "updatedBy" : "elastic",
  "executionStatus" : {
    "lastExecutionDate" : "2022-12-06T00:13:43.89Z",
    "status" : "ok"
  },
  "params" : {
    "key" : ""
  },
  "enabled" : true,
  "mutedInstanceIds" : [ "mutedInstanceIds", "mutedInstanceIds" ],
  "tags" : [ "tags", "tags" ],
  "createdAt" : "2022-12-05T23:36:58.284Z",
  "schedule" : {
    "interval" : "interval"
  },
  "notifyWhen" : "onActionGroupChange",
  "createdBy" : "elastic",
  "muteAll" : false,
  "name" : "my alert",
  "scheduledTaskId" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "actions" : [ "{}", "{}" ],
  "apiKeyOwner" : "elastic",
  "updatedAt" : "2022-12-05T23:36:58.284Z"
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call. alert_response_properties

401

Authorization information is missing or invalid. 401_response
Up 
delete /s/{spaceId}/api/alerts/alert/{alertId}
Permanently removes an alert. (legaryDeleteAlert)
Deprecated in 7.13.0. Use the delete rule API instead. WARNING: After you delete an alert, you cannot recover it.

Path parameters

spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null
alertId (required)
Path Parameter — The identifier for the alert. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
post /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_mute
Mutes an alert. (muteAlert)
You must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature.

Path parameters

alertId (required)
Path Parameter — An identifier for the alert. The identifier is generated by the rule and might be any arbitrary string. default: null
ruleId (required)
Path Parameter — An identifier for the rule. default: null
spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
post /s/{spaceId}/api/alerting/rule/{ruleId}/_mute_all
Mutes all alerts. (muteAllAlerts)
This API snoozes the notifications for the rule indefinitely. The rule checks continue to occur but alerts will not trigger any actions. You must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature.

Path parameters

ruleId (required)
Path Parameter — An identifier for the rule. default: null
spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
post /s/{spaceId}/api/alerting/rule/{ruleId}/alert/{alertId}/_unmute
Unmutes an alert. (unmuteAlert)
You must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature.

Path parameters

alertId (required)
Path Parameter — An identifier for the alert. The identifier is generated by the rule and might be any arbitrary string. default: null
ruleId (required)
Path Parameter — An identifier for the rule. default: null
spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
post /s/{spaceId}/api/alerting/rule/{ruleId}/_unmute_all
Unmutes all alerts. (unmuteAllAlerts)
If the rule has its notifications snoozed indefinitely, this API cancels the snooze. You must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature.

Path parameters

ruleId (required)
Path Parameter — An identifier for the rule. default: null
spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

204

Indicates a successful call.

401

Authorization information is missing or invalid. 401_response
Up 
put /s/{spaceId}/api/alerting/rule/{ruleId}
Updates the attributes for a rule. (updateRule)
To update a rule, you must have all privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rule you're updating. For example, you must have privileges for the Management > Stack rules feature, Analytics > Discover and Machine Learning features, Observability features, or Security features. If the rule has actions, you must also have read privileges for the Management > Actions and Connectors feature. This API supports both key- and token-based authentication. To use key-based authentication, create an API key in Kibana and use it in the header of the API call. To use token-based authentication, provide a username and password; an API key that matches the current privileges of the user is created automatically. In both cases, the API key is subsequently used for authorization when the rule runs. NOTE: If the API key has different privileges than the key that created or most recently updated the rule, the rule behavior might change. Though some properties are optional, when you update the rule the existing property values are overwritten with default values. Therefore, it is recommended to explicitly set all property values.

Path parameters

ruleId (required)
Path Parameter — An identifier for the rule. default: null
spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Consumes

This API call consumes the following media types via the Content-Type request header:
  • application/json

Request body

update_rule_request update_rule_request (required)
Body Parameter —

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Return type

rule_response_properties

Example data

Content-Type: application/json
{
  "throttle" : "10m",
  "created_at" : "2022-12-05T23:36:58.284Z",
  "api_key_created_by_user" : false,
  "enabled" : true,
  "running" : true,
  "notify_when" : "notify_when",
  "next_run" : "2022-12-06T00:14:43.818Z",
  "updated_at" : "2022-12-05T23:36:58.284Z",
  "execution_status" : {
    "last_execution_date" : "2022-12-06T00:13:43.89Z",
    "last_duration" : 55,
    "status" : "ok"
  },
  "scheduled_task_id" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "id" : "b530fed0-74f5-11ed-9801-35303b735aef",
  "consumer" : "alerts",
  "last_run" : {
    "alerts_count" : {
      "ignored" : 6,
      "new" : 1,
      "recovered" : 5,
      "active" : 0
    },
    "outcome_msg" : [ "outcome_msg", "outcome_msg" ],
    "outcome_order" : 5,
    "warning" : "warning",
    "outcome" : "succeeded"
  },
  "params" : {
    "key" : ""
  },
  "created_by" : "elastic",
  "muted_alert_ids" : [ "muted_alert_ids", "muted_alert_ids" ],
  "rule_type_id" : "monitoring_alert_cluster_health",
  "revision" : 2,
  "tags" : [ "tags", "tags" ],
  "api_key_owner" : "elastic",
  "schedule" : {
    "interval" : "1m"
  },
  "name" : "cluster_health_rule",
  "updated_by" : "elastic",
  "mute_all" : false,
  "actions" : [ {
    "alerts_filter" : {
      "timeframe" : {
        "hours" : {
          "start" : "08:00",
          "end" : "17:00"
        },
        "timezone" : "Europe/Madrid",
        "days" : [ 1, 2, 3, 4, 5 ]
      },
      "query" : {
        "kql" : "kql",
        "filters" : [ {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        }, {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        } ]
      }
    },
    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
    "params" : {
      "key" : ""
    },
    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
    "connector_type_id" : ".server-log",
    "frequency" : {
      "summary" : true,
      "throttle" : "10m",
      "notify_when" : "onActiveAlert"
    },
    "group" : "default"
  }, {
    "alerts_filter" : {
      "timeframe" : {
        "hours" : {
          "start" : "08:00",
          "end" : "17:00"
        },
        "timezone" : "Europe/Madrid",
        "days" : [ 1, 2, 3, 4, 5 ]
      },
      "query" : {
        "kql" : "kql",
        "filters" : [ {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        }, {
          "$state" : "{}",
          "meta" : {
            "field" : "field",
            "controlledBy" : "controlledBy",
            "negate" : true,
            "alias" : "alias",
            "index" : "index",
            "disabled" : true,
            "params" : "{}",
            "type" : "type",
            "value" : "value",
            "isMultiIndex" : true,
            "key" : "key",
            "group" : "group"
          },
          "query" : "{}"
        } ]
      }
    },
    "id" : "9dca3e00-74f5-11ed-9801-35303b735aef",
    "params" : {
      "key" : ""
    },
    "uuid" : "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
    "connector_type_id" : ".server-log",
    "frequency" : {
      "summary" : true,
      "throttle" : "10m",
      "notify_when" : "onActiveAlert"
    },
    "group" : "default"
  } ]
}

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call. rule_response_properties

401

Authorization information is missing or invalid. 401_response

404

Object is not found. 404_response
Up 
post /s/{spaceId}/api/alerting/rule/{ruleId}/_update_api_key
Updates the API key for a rule. (updateRuleAPIKey)
The new API key has the credentials of the user that submits the request.

Path parameters

ruleId (required)
Path Parameter — An identifier for the rule. default: null
spaceId (required)
Path Parameter — An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used. default: null

Request headers

kbn-xsrf (required)
Header Parameter — Cross-site request forgery protection default: null

Produces

This API call produces the following media types according to the Accept request header; the media type will be conveyed by the Content-Type response header.
  • application/json

Responses

200

Indicates a successful call.

400

Bad request 400_response

Models

[ Jump to Methods ]

Table of Contents

  1. 400_response - Bad request
  2. 401_response - Unsuccessful rule API response
  3. 404_response -
  4. Count - Count
  5. Count_count -
  6. Count_criteria -
  7. Count_logView -
  8. Legacy_create_alert_request_properties - Legacy create alert request properties
  9. Legacy_create_alert_request_properties_schedule -
  10. Legacy_update_alert_request_properties - Legacy update alert request properties
  11. Legacy_update_alert_request_properties_actions_inner -
  12. Legacy_update_alert_request_properties_schedule -
  13. Ratio - Ratio
  14. actions_inner -
  15. actions_inner_alerts_filter -
  16. actions_inner_alerts_filter_query -
  17. actions_inner_alerts_filter_timeframe -
  18. actions_inner_alerts_filter_timeframe_hours -
  19. actions_inner_frequency -
  20. aggtype -
  21. alert_response_properties - Legacy alert response properties
  22. alert_response_properties_executionStatus -
  23. alert_response_properties_schedule -
  24. count_criterion - count criterion
  25. create_anomaly_detection_alert_rule_request - Create anomaly detection rule request
  26. create_anomaly_detection_jobs_health_rule_request - Create anomaly detection jobs health rule request
  27. create_apm_anomaly_rule_request - Create APM anomaly rule rule request
  28. create_apm_error_count_rule_request - Create APM error count rule request
  29. create_apm_transaction_duration_rule_request - Create latency threshold rule request
  30. create_apm_transaction_error_rate_rule_request - Create APM transaction error rate rule request
  31. create_es_query_rule_request - Create Elasticsearch query rule request
  32. create_geo_containment_rule_request - Create traacking containment rule request
  33. create_index_threshold_rule_request - Create index threshold rule request
  34. create_infra_inventory_rule_request - Create infra inventory rule request
  35. create_infra_metric_anomaly_rule_request - Create infrastructure anomaly rule request
  36. create_infra_metric_threshold_rule_request - Create infra metric threshold rule request
  37. create_log_threshold_rule_request - Create log threshold rule request
  38. create_monitoring_ccr_exceptions_rule_request - Create CCR read exceptions rule request
  39. create_monitoring_cluster_health_rule_request - Create cluster health rule request
  40. create_monitoring_cpu_usage_rule_request - Create CPU usage rule request
  41. create_monitoring_disk_usage_rule_request - Create disk usage rule request
  42. create_monitoring_elasticsearch_version_mismatch_rule_request - Create Elasticsearch version mismatch rule request
  43. create_monitoring_jvm_memory_usage_rule_request - Create JVM memory usage rule request
  44. create_monitoring_kibana_version_mismatch_rule_request - Create Kibana version mismatch rule request
  45. create_monitoring_license_expiration_rule_request - Create license expiration rule request
  46. create_monitoring_logstash_version_mismatch_rule_request - Create Logstash version mismatch rule request
  47. create_monitoring_missing_data_rule_request - Create missing monitoring data rule request
  48. create_monitoring_nodes_changed_rule_request - Create nodes changed rule request
  49. create_monitoring_shard_size_rule_request - Create shard size rule request
  50. create_monitoring_thread_pool_search_rejections_rule_request - Create thread pool search rejections rule request
  51. create_monitoring_thread_pool_write_rejections_rule_request - Create thread pool write rejections rule request
  52. create_rule_request - Create rule request body properties
  53. create_siem_eql_rule_request - Create event correlation rule request
  54. create_siem_indicator_rule_request - Create indicator match rule request
  55. create_siem_ml_rule_request - Create machine learning rule request
  56. create_siem_new_terms_rule_request - Create new terms rule request
  57. create_siem_notifications_rule_request - Create security solution notification (legacy) rule request
  58. create_siem_query_rule_request - Create custom query rule request
  59. create_siem_saved_query_rule_request - Create saved query rule request
  60. create_siem_threshold_rule_request - Create threshold rule request
  61. create_slo_burn_rate_rule_request - Create slo burn rate rule request
  62. create_synthetics_monitor_status_rule_request - Create synthetics monitor status rule request
  63. create_synthetics_uptime_duration_anomaly_rule_request - Create synthetics uptime duration anomaly rule request
  64. create_synthetics_uptime_tls_certificate_rule_request - Create TLS certificate rule request
  65. create_synthetics_uptime_tls_rule_request - Create synthetics uptime TLS rule request
  66. create_transform_health_rule_request - Create transform health rule request
  67. create_uptime_monitor_status_rule_request - Create uptime monitor status rule request
  68. custom_criterion - custom criterion
  69. custom_criterion_customMetric_inner -
  70. custom_criterion_customMetric_inner_oneOf -
  71. custom_criterion_customMetric_inner_oneOf_1 -
  72. filter -
  73. filter_meta -
  74. findRules_200_response -
  75. findRules_has_reference_parameter -
  76. findRules_search_fields_parameter -
  77. getAlertingHealth_200_response -
  78. getAlertingHealth_200_response_alerting_framework_health -
  79. getAlertingHealth_200_response_alerting_framework_health_decryption_health -
  80. getAlertingHealth_200_response_alerting_framework_health_execution_health -
  81. getAlertingHealth_200_response_alerting_framework_health_read_health -
  82. getRuleTypes_200_response_inner -
  83. getRuleTypes_200_response_inner_action_groups_inner -
  84. getRuleTypes_200_response_inner_action_variables -
  85. getRuleTypes_200_response_inner_action_variables_context_inner -
  86. getRuleTypes_200_response_inner_action_variables_params_inner -
  87. getRuleTypes_200_response_inner_authorized_consumers -
  88. getRuleTypes_200_response_inner_authorized_consumers_alerts -
  89. getRuleTypes_200_response_inner_recovery_action_group -
  90. groupby -
  91. legacyFindAlerts_200_response -
  92. legacyGetAlertTypes_200_response_inner -
  93. legacyGetAlertTypes_200_response_inner_actionVariables -
  94. legacyGetAlertTypes_200_response_inner_actionVariables_context_inner -
  95. legacyGetAlertTypes_200_response_inner_recoveryActionGroup -
  96. legacyGetAlertingHealth_200_response -
  97. legacyGetAlertingHealth_200_response_alertingFrameworkHealth -
  98. legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth -
  99. legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth -
  100. legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth -
  101. non_count_criterion - non count criterion
  102. notify_when -
  103. params_es_query_rule -
  104. params_es_query_rule_oneOf -
  105. params_es_query_rule_oneOf_1 -
  106. params_es_query_rule_oneOf_searchConfiguration -
  107. params_es_query_rule_oneOf_searchConfiguration_query -
  108. params_index_threshold_rule -
  109. params_property_apm_anomaly -
  110. params_property_apm_error_count -
  111. params_property_apm_transaction_duration -
  112. params_property_apm_transaction_error_rate -
  113. params_property_infra_inventory -
  114. params_property_infra_inventory_criteria_inner -
  115. params_property_infra_inventory_criteria_inner_customMetric -
  116. params_property_infra_metric_threshold -
  117. params_property_infra_metric_threshold_criteria_inner -
  118. params_property_log_threshold -
  119. params_property_slo_burn_rate -
  120. params_property_slo_burn_rate_longWindow -
  121. params_property_slo_burn_rate_shortWindow -
  122. params_property_synthetics_monitor_status -
  123. params_property_synthetics_monitor_status_availability -
  124. params_property_synthetics_monitor_status_filters -
  125. params_property_synthetics_monitor_status_filters_oneOf -
  126. params_property_synthetics_monitor_status_timerange -
  127. params_property_synthetics_uptime_tls -
  128. rule_response_properties - Rule response properties
  129. rule_response_properties_execution_status -
  130. rule_response_properties_last_run -
  131. rule_response_properties_last_run_alerts_count -
  132. schedule -
  133. thresholdcomparator -
  134. timewindowunit -
  135. update_rule_request - Update rule request

400_response - Bad request Up

error
String
Enum:
Bad Request
message
String
statusCode
Integer
Enum:
400

401_response - Unsuccessful rule API response Up

error (optional)
String
Enum:
Unauthorized
message (optional)
String
statusCode (optional)
Integer
Enum:
401

404_response - Up

error (optional)
String
Enum:
Not Found
message (optional)
String
statusCode (optional)
Integer
Enum:
404

Count - Count Up

criteria (optional)
array[Count_criteria]
count
Count_count
timeSize
BigDecimal
timeUnit
String
Enum:
s
m
h
d
logView
Count_logView
groupBy (optional)
array[String]

Count_count - Up

comparator (optional)
String
Enum:
more than
more than or equals
less than
less than or equals
equals
does not equal
matches
does not match
matches phrase
does not match phrase
value (optional)
BigDecimal

Count_criteria - Up

field (optional)
String
comparator (optional)
String
Enum:
more than
more than or equals
less than
less than or equals
equals
does not equal
matches
does not match
matches phrase
does not match phrase
value (optional)
oneOf

Count_logView - Up

logViewId (optional)
String
type (optional)
String
Enum:
log-view-reference

Legacy_create_alert_request_properties - Legacy create alert request properties Up

actions (optional)
array[Legacy_update_alert_request_properties_actions_inner]
alertTypeId
String The ID of the alert type that you want to call when the alert is scheduled to run.
consumer
String The name of the application that owns the alert. This name has to match the Kibana feature name, as that dictates the required role-based access control privileges.
enabled (optional)
Boolean Indicates if you want to run the alert on an interval basis after it is created.
name
String A name to reference and search.
notifyWhen
String The condition for throttling the notification.
Enum:
onActionGroupChange
onActiveAlert
onThrottleInterval
params
Object The parameters to pass to the alert type executor params value. This will also validate against the alert type params validator, if defined.
schedule
Legacy_create_alert_request_properties_schedule
tags (optional)
array[String] A list of keywords to reference and search.
throttle (optional)
String How often this alert should fire the same actions. This will prevent the alert from sending out the same notification over and over. For example, if an alert with a schedule of 1 minute stays in a triggered state for 90 minutes, setting a throttle of 10m or 1h will prevent it from sending 90 notifications during this period.

Legacy_create_alert_request_properties_schedule - Up

The schedule specifying when this alert should be run. A schedule is structured such that the key specifies the format you wish to use and its value specifies the schedule.
interval (optional)
String The interval format specifies the interval in seconds, minutes, hours or days at which the alert should execute.

Legacy_update_alert_request_properties - Legacy update alert request properties Up

actions (optional)
array[Legacy_update_alert_request_properties_actions_inner]
name
String A name to reference and search.
notifyWhen
String The condition for throttling the notification.
Enum:
onActionGroupChange
onActiveAlert
onThrottleInterval
params
Object The parameters to pass to the alert type executor params value. This will also validate against the alert type params validator, if defined.
schedule
Legacy_update_alert_request_properties_schedule
tags (optional)
array[String] A list of keywords to reference and search.
throttle (optional)
String How often this alert should fire the same actions. This will prevent the alert from sending out the same notification over and over. For example, if an alert with a schedule of 1 minute stays in a triggered state for 90 minutes, setting a throttle of 10m or 1h will prevent it from sending 90 notifications during this period.

Legacy_update_alert_request_properties_actions_inner - Up

actionTypeId
String The identifier for the action type.
group
String Grouping actions is recommended for escalations for different types of alert instances. If you don't need this functionality, set it to default.
id
String The ID of the action saved object to execute.
params
Object The map to the params that the action type will receive. params are handled as Mustache templates and passed a default set of context.

Legacy_update_alert_request_properties_schedule - Up

The schedule specifying when this alert should be run. A schedule is structured such that the key specifies the format you wish to use and its value specifies the schedule.
interval (optional)
String The interval format specifies the interval in seconds, minutes, hours or days at which the alert should execute.

Ratio - Ratio Up

criteria (optional)
array[array[Object]]
count
Count_count
timeSize
BigDecimal
timeUnit
String
Enum:
s
m
h
d
logView
Count_logView
groupBy (optional)
array[String]

actions_inner - Up

An action that runs under defined conditions.
alerts_filter (optional)
actions_inner_alerts_filter
connector_type_id (optional)
String The type of connector. This property appears in responses but cannot be set in requests.
frequency (optional)
actions_inner_frequency
group
String The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to default.
id
String The identifier for the connector saved object.
params
map[String, oas_any_type_not_mapped] The parameters for the action, which are sent to the connector. The params are handled as Mustache templates and passed a default set of context.
uuid (optional)
String A universally unique identifier (UUID) for the action.

actions_inner_alerts_filter - Up

Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.
query (optional)
actions_inner_alerts_filter_query
timeframe (optional)
actions_inner_alerts_filter_timeframe

actions_inner_alerts_filter_query - Up

Defines a query filter that determines whether the action runs.
kql (optional)
String A filter written in Kibana Query Language (KQL).
filters (optional)
array[filter]

actions_inner_alerts_filter_timeframe - Up

Defines a period that limits whether the action runs.
days (optional)
array[Integer] Defines the days of the week that the action can run, represented as an array of numbers. For example, 1 represents Monday. An empty array is equivalent to specifying all the days of the week.
hours (optional)
actions_inner_alerts_filter_timeframe_hours
timezone (optional)
String The ISO time zone for the hours values. Values such as UTC and UTC+1 also work but lack built-in daylight savings time support and are not recommended.

actions_inner_alerts_filter_timeframe_hours - Up

Defines the range of time in a day that the action can run. If the start value is 00:00 and the end value is 24:00, actions be generated all day.
end (optional)
String The end of the time frame in 24-hour notation (hh:mm).
start (optional)
String The start of the time frame in 24-hour notation (hh:mm).

actions_inner_frequency - Up

The properties that affect how often actions are generated. If the rule type supports setting summary to true, the action can be a summary of alerts at the specified notification interval. Otherwise, an action runs for each alert at the specified notification interval. NOTE: You cannot specify these parameters when notify_when or throttle are defined at the rule level.
notify_when
notify_when
summary
Boolean Indicates whether the action is a summary.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

aggtype - Up

The type of aggregation to perform.

alert_response_properties - Legacy alert response properties Up

actions (optional)
array[Object]
alertTypeId (optional)
String
apiKeyOwner (optional)
String
createdAt (optional)
Date The date and time that the alert was created. format: date-time
createdBy (optional)
String The identifier for the user that created the alert.
enabled (optional)
Boolean Indicates whether the alert is currently enabled.
executionStatus (optional)
alert_response_properties_executionStatus
id (optional)
String The identifier for the alert.
muteAll (optional)
Boolean
mutedInstanceIds (optional)
array[String]
name (optional)
String The name of the alert.
notifyWhen (optional)
String
params (optional)
map[String, oas_any_type_not_mapped]
schedule (optional)
alert_response_properties_schedule
scheduledTaskId (optional)
String
tags (optional)
array[String]
throttle (optional)
String
updatedAt (optional)
String
updatedBy (optional)
String The identifier for the user that updated this alert most recently.

alert_response_properties_executionStatus - Up

lastExecutionDate (optional)
Date format: date-time
status (optional)
String

alert_response_properties_schedule - Up

interval (optional)
String

count_criterion - count criterion Up

threshold (optional)
array[BigDecimal]
comparator (optional)
String
Enum:
<
<=
>
>=
between
outside
timeUnit (optional)
String
timeSize (optional)
BigDecimal
warningThreshold (optional)
array[BigDecimal]
warningComparator (optional)
String
Enum:
<
<=
>
>=
between
outside
aggType (optional)
String
Enum:
count

create_anomaly_detection_alert_rule_request - Create anomaly detection rule request Up

A rule that checks if the anomaly detection job results contain anomalies that match the rule conditions.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for an anomaly detection rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
xpack.ml.anomaly_detection_alert
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_anomaly_detection_jobs_health_rule_request - Create anomaly detection jobs health rule request Up

An rule that monitors job health and alerts if an operational issue occurred that may prevent the job from detecting anomalies.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for an anomaly detection jobs health rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
xpack.ml.anomaly_detection_jobs_health
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_apm_anomaly_rule_request - Create APM anomaly rule rule request Up

A rule that detects when either the latency, throughput, or failed transaction rate of a service is anomalous.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_property_apm_anomaly
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
apm.anomaly
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_apm_error_count_rule_request - Create APM error count rule request Up

A rule that detects when the number of errors in a service exceeds a defined threshold.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_property_apm_error_count
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
apm.error_rate
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_apm_transaction_duration_rule_request - Create latency threshold rule request Up

A rule that detects when the latency of a specific transaction type in a service exceeds a threshold.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_property_apm_transaction_duration
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
apm.transaction_duration
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_apm_transaction_error_rate_rule_request - Create APM transaction error rate rule request Up

A rule that sends notifications when the rate of transaction errors in a service exceeds a threshold.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_property_apm_transaction_error_rate
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
apm.transaction_error_rate
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_es_query_rule_request - Create Elasticsearch query rule request Up

A rule that runs a user-configured query, compares the number of matches to a configured threshold, and schedules actions to run when the threshold condition is met.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_es_query_rule
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
.es-query
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_geo_containment_rule_request - Create traacking containment rule request Up

A rule that runs an Elasticsearch query over indices to determine whether any documents are currently contained within any boundaries from the specified boundary index. In the event that an entity is contained within a boundary, an alert may be generated.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for an tracking containment rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
.geo-containment
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_index_threshold_rule_request - Create index threshold rule request Up

A rule that runs an Elasticsearch query, aggregates field values from documents, compares them to threshold values, and schedules actions to run when the thresholds are met.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_index_threshold_rule
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
.index-threshold
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_infra_inventory_rule_request - Create infra inventory rule request Up

A rule that sends notifications when a metric has reached or exceeded a value for a specific resource or a group of resources within your infrastructure.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_property_infra_inventory
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
metrics.alert.inventory.threshold
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_infra_metric_anomaly_rule_request - Create infrastructure anomaly rule request Up

actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for an infrastructure anomaly rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
metrics.alert.anomaly
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_infra_metric_threshold_rule_request - Create infra metric threshold rule request Up

A rule that sends notifications when a metric has reached or exceeded a value for a specific time period.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_property_infra_metric_threshold
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
metrics.alert.threshold
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_log_threshold_rule_request - Create log threshold rule request Up

A rule that detects when a log aggregation exceeds a threshold.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_property_log_threshold
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
logs.alert.document.count
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_ccr_exceptions_rule_request - Create CCR read exceptions rule request Up

A rule that detects cross-cluster replication (CCR) read exceptions.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a CCR read exceptions rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_ccr_read_exceptions
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_cluster_health_rule_request - Create cluster health rule request Up

A rule that detects when the health of the cluster changes.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a cluster health rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_cluster_health
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_cpu_usage_rule_request - Create CPU usage rule request Up

A rule that detects when the CPU load for a node is consistently high.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a CPU usage rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_cpu_usage
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_disk_usage_rule_request - Create disk usage rule request Up

A rule that detects when the disk usage for a node is consistently high.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a disk usage rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_disk_usage
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_elasticsearch_version_mismatch_rule_request - Create Elasticsearch version mismatch rule request Up

A rule that detects when the cluster has multipe versions of Elasticsearch.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a Elasticsearch version mismatch rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_elasticsearch_version_mismatch
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_jvm_memory_usage_rule_request - Create JVM memory usage rule request Up

A rule that detects when a node reports high memory usage.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a JVM memory usage rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_jvm_memory_usage
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_kibana_version_mismatch_rule_request - Create Kibana version mismatch rule request Up

A rule that detects when the cluster has multiple versions of Kibana.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a Kibana version mismatch rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_kibana_version_mismatch
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_license_expiration_rule_request - Create license expiration rule request Up

A rule that detects when the cluster license is about to expire.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a license expiration rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_license_expiration
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_logstash_version_mismatch_rule_request - Create Logstash version mismatch rule request Up

A rule that detects when the cluster has multiple versions of Logstash.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a Logstash version mismatch rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_logstash_version_mismatch
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_missing_data_rule_request - Create missing monitoring data rule request Up

A rule that detects when monitoring data is missing.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a missing monitoring data rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_missing_monitoring_data
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_nodes_changed_rule_request - Create nodes changed rule request Up

A rule that detects when nodes are added, removed, or restarted.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a nodes changed rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_nodes_changed
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_shard_size_rule_request - Create shard size rule request Up

A rule that detects when the average shard size is larger than a threshold.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a shard size rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_shard_size
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_thread_pool_search_rejections_rule_request - Create thread pool search rejections rule request Up

A rule that detects when the number of rejections in the thread pool exceeds a threshold.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a thread pool search rejections rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_thread_pool_search_rejections
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_monitoring_thread_pool_write_rejections_rule_request - Create thread pool write rejections rule request Up

A rule that detects when the number of rejections in the write thread pool exceeds a threshold.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a thread pool write rejections rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
monitoring_alert_thread_pool_write_rejections
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_rule_request - Create rule request body properties Up

The properties vary depending on the rule type.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_property_synthetics_monitor_status
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
xpack.uptime.alerts.monitorStatus
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_siem_eql_rule_request - Create event correlation rule request Up

A rule that uses Event Query Language (EQL) to match events, generate sequences, and stack data.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for an event correlation rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
siem.eqlRule
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_siem_indicator_rule_request - Create indicator match rule request Up

A rule that uses indicators from intelligence sources to detect matching events and alerts.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for an indicator match rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
siem.indicatorRule
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_siem_ml_rule_request - Create machine learning rule request Up

A rule that detects when a machine learning job discovers an anomaly above the defined threshold.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a machine learning rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
siem.mlRule
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_siem_new_terms_rule_request - Create new terms rule request Up

A rule that finds documents with values that appear for the first time.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a new terms rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
siem.newTermsRule
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_siem_notifications_rule_request - Create security solution notification (legacy) rule request Up

actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a notification rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
siem.notifications
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_siem_query_rule_request - Create custom query rule request Up

A rule that uses KQL or Lucene to detect issues across indices.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a custom query rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
siem.queryRule
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_siem_saved_query_rule_request - Create saved query rule request Up

A rule that searches the defined indices and creates an alert when a document matches the saved search.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a saved query rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
siem.savedQueryRule
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_siem_threshold_rule_request - Create threshold rule request Up

A rule that aggregates query results to detect when the number of matches exceeds a threshold.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a threshold rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
siem.thresholdRule
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_slo_burn_rate_rule_request - Create slo burn rate rule request Up

A rule that detects when the burn rate is above a defined threshold for two different lookback periods. The two periods are a long period and a short period that is 1/12th of the long period. For each lookback period, the burn rate is computed as the error rate divided by the error budget. When the burn rates for both periods surpass the threshold, an alert occurs.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_property_slo_burn_rate
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
slo.rules.burnRate
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_synthetics_monitor_status_rule_request - Create synthetics monitor status rule request Up

A rule that detects when a monitor is down or an availability threshold is breached.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for the synthetics monitor status rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
xpack.synthetics.alerts.monitorStatus
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_synthetics_uptime_duration_anomaly_rule_request - Create synthetics uptime duration anomaly rule request Up

A rule that detects response durations for all of the geographic locations of each monitor. When a monitor runs for an unusual amount of time, at a particular time, an anomaly is recorded.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for the uptime duration anomaly rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
xpack.uptime.alerts.durationAnomaly
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_synthetics_uptime_tls_certificate_rule_request - Create TLS certificate rule request Up

A rule that detects when a monitor has a TLS certificate expiring or when it exceeds an age limit.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a TLS certificate rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
xpack.uptime.alerts.tlsCertificate
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_synthetics_uptime_tls_rule_request - Create synthetics uptime TLS rule request Up

actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_property_synthetics_uptime_tls
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
xpack.uptime.alerts.tls
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_transform_health_rule_request - Create transform health rule request Up

A rule that monitors transforms health and alerts if an operational issue occurred.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for a transform health rule.
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
transform_health
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

create_uptime_monitor_status_rule_request - Create uptime monitor status rule request Up

A rule that detects monitor errors and outages.
actions (optional)
array[actions_inner]
consumer
String The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled (optional)
Boolean Indicates whether you want to run the rule on an interval basis after it is created.
name
String The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when (optional)
notify_when
params
params_property_synthetics_monitor_status
rule_type_id
String The ID of the rule type that you want to call when the rule is scheduled to run.
Enum:
xpack.uptime.alerts.monitorStatus
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

custom_criterion - custom criterion Up

threshold (optional)
array[BigDecimal]
comparator (optional)
String
Enum:
<
<=
>
>=
between
outside
timeUnit (optional)
String
timeSize (optional)
BigDecimal
warningThreshold (optional)
array[BigDecimal]
warningComparator (optional)
String
Enum:
<
<=
>
>=
between
outside
aggType (optional)
String
Enum:
custom
customMetric (optional)
array[custom_criterion_customMetric_inner]
equation (optional)
String
label (optional)
String

custom_criterion_customMetric_inner - Up

name (optional)
String
aggType (optional)
String
Enum:
count
field (optional)
String
filter (optional)
String

custom_criterion_customMetric_inner_oneOf - Up

name (optional)
String
aggType (optional)
String
Enum:
avg
sum
max
min
cardinality
field (optional)
String

custom_criterion_customMetric_inner_oneOf_1 - Up

name (optional)
String
aggType (optional)
String
Enum:
count
filter (optional)
String

filter - Up

A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the kbn-es-query package.
meta (optional)
filter_meta
query (optional)
Object
Dollarstate (optional)
Object

filter_meta - Up

alias (optional)
String
controlledBy (optional)
String
disabled (optional)
Boolean
field (optional)
String
group (optional)
String
index (optional)
String
isMultiIndex (optional)
Boolean
key (optional)
String
negate (optional)
Boolean
params (optional)
Object
type (optional)
String
value (optional)
String

findRules_200_response - Up

data (optional)
array[rule_response_properties]
page (optional)
Integer
per_page (optional)
Integer
total (optional)
Integer

findRules_has_reference_parameter - Up

id (optional)
String
type (optional)
String

findRules_search_fields_parameter - Up

getAlertingHealth_200_response - Up

alerting_framework_health (optional)
getAlertingHealth_200_response_alerting_framework_health
has_permanent_encryption_key (optional)
Boolean If false, the encrypted saved object plugin does not have a permanent encryption key.
is_sufficiently_secure (optional)
Boolean If false, security is enabled but TLS is not.

getAlertingHealth_200_response_alerting_framework_health - Up

Three substates identify the health of the alerting framework: decryption_health, execution_health, and read_health.
decryption_health (optional)
getAlertingHealth_200_response_alerting_framework_health_decryption_health
execution_health (optional)
getAlertingHealth_200_response_alerting_framework_health_execution_health
read_health (optional)
getAlertingHealth_200_response_alerting_framework_health_read_health

getAlertingHealth_200_response_alerting_framework_health_decryption_health - Up

The timestamp and status of the rule decryption.
status (optional)
String
Enum:
error
ok
warn
timestamp (optional)
Date format: date-time

getAlertingHealth_200_response_alerting_framework_health_execution_health - Up

The timestamp and status of the rule run.
status (optional)
String
Enum:
error
ok
warn
timestamp (optional)
Date format: date-time

getAlertingHealth_200_response_alerting_framework_health_read_health - Up

The timestamp and status of the rule reading events.
status (optional)
String
Enum:
error
ok
warn
timestamp (optional)
Date format: date-time

getRuleTypes_200_response_inner - Up

action_groups (optional)
array[getRuleTypes_200_response_inner_action_groups_inner] An explicit list of groups for which the rule type can schedule actions, each with the action group's unique ID and human readable name. Rule actions validation uses this configuration to ensure that groups are valid.
action_variables (optional)
getRuleTypes_200_response_inner_action_variables
authorized_consumers (optional)
getRuleTypes_200_response_inner_authorized_consumers
default_action_group_id (optional)
String The default identifier for the rule type group.
does_set_recovery_context (optional)
Boolean Indicates whether the rule passes context variables to its recovery action.
enabled_in_license (optional)
Boolean Indicates whether the rule type is enabled or disabled based on the subscription.
id (optional)
String The unique identifier for the rule type.
is_exportable (optional)
Boolean Indicates whether the rule type is exportable in Stack Management > Saved Objects.
minimum_license_required (optional)
String The subscriptions required to use the rule type.
name (optional)
String The descriptive name of the rule type.
producer (optional)
String An identifier for the application that produces this rule type.
recovery_action_group (optional)
getRuleTypes_200_response_inner_recovery_action_group
rule_task_timeout (optional)
String

getRuleTypes_200_response_inner_action_groups_inner - Up

id (optional)
String
name (optional)
String

getRuleTypes_200_response_inner_action_variables - Up

A list of action variables that the rule type makes available via context and state in action parameter templates, and a short human readable description. When you create a rule in Kibana, it uses this information to prompt you for these variables in action parameter editors.
context (optional)
array[getRuleTypes_200_response_inner_action_variables_context_inner]
params (optional)
array[getRuleTypes_200_response_inner_action_variables_params_inner]
state (optional)
array[getRuleTypes_200_response_inner_action_variables_params_inner]

getRuleTypes_200_response_inner_action_variables_context_inner - Up

name (optional)
String
description (optional)
String
useWithTripleBracesInTemplates (optional)
Boolean

getRuleTypes_200_response_inner_action_variables_params_inner - Up

description (optional)
String
name (optional)
String

getRuleTypes_200_response_inner_authorized_consumers - Up

The list of the plugins IDs that have access to the rule type.
alerts (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
apm (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
discover (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
infrastructure (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
logs (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
ml (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
monitoring (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
siem (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
stackAlerts (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts
uptime (optional)
getRuleTypes_200_response_inner_authorized_consumers_alerts

getRuleTypes_200_response_inner_authorized_consumers_alerts - Up

all (optional)
Boolean
read (optional)
Boolean

getRuleTypes_200_response_inner_recovery_action_group - Up

An action group to use when an alert goes from an active state to an inactive one.
id (optional)
String
name (optional)
String

groupby - Up

Indicates whether the aggregation is applied over all documents (all) or split into groups (top) using a grouping field (termField). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to termSize number of groups) are checked.

legacyFindAlerts_200_response - Up

data (optional)
array[alert_response_properties]
page (optional)
Integer
perPage (optional)
Integer
total (optional)
Integer

legacyGetAlertTypes_200_response_inner - Up

actionGroups (optional)
array[getRuleTypes_200_response_inner_action_groups_inner] An explicit list of groups for which the alert type can schedule actions, each with the action group's unique ID and human readable name. Alert actions validation uses this configuration to ensure that groups are valid.
actionVariables (optional)
legacyGetAlertTypes_200_response_inner_actionVariables
authorizedConsumers (optional)
Object The list of the plugins IDs that have access to the alert type.
defaultActionGroupId (optional)
String The default identifier for the alert type group.
enabledInLicense (optional)
Boolean Indicates whether the rule type is enabled based on the subscription.
id (optional)
String The unique identifier for the alert type.
isExportable (optional)
Boolean Indicates whether the alert type is exportable in Saved Objects Management UI.
minimumLicenseRequired (optional)
String The subscriptions required to use the alert type.
name (optional)
String The descriptive name of the alert type.
producer (optional)
String An identifier for the application that produces this alert type.
recoveryActionGroup (optional)
legacyGetAlertTypes_200_response_inner_recoveryActionGroup

legacyGetAlertTypes_200_response_inner_actionVariables - Up

A list of action variables that the alert type makes available via context and state in action parameter templates, and a short human readable description. The Alert UI will use this information to prompt users for these variables in action parameter editors.
context (optional)
array[legacyGetAlertTypes_200_response_inner_actionVariables_context_inner]
params (optional)
array[getRuleTypes_200_response_inner_action_variables_params_inner]
state (optional)
array[getRuleTypes_200_response_inner_action_variables_params_inner]

legacyGetAlertTypes_200_response_inner_actionVariables_context_inner - Up

name (optional)
String
description (optional)
String

legacyGetAlertTypes_200_response_inner_recoveryActionGroup - Up

An action group to use when an alert instance goes from an active state to an inactive one. If it is not specified, the default recovered action group is used.
id (optional)
String
name (optional)
String

legacyGetAlertingHealth_200_response - Up

alertingFrameworkHealth (optional)
legacyGetAlertingHealth_200_response_alertingFrameworkHealth
hasPermanentEncryptionKey (optional)
Boolean If false, the encrypted saved object plugin does not have a permanent encryption key.
isSufficientlySecure (optional)
Boolean If false, security is enabled but TLS is not.

legacyGetAlertingHealth_200_response_alertingFrameworkHealth - Up

Three substates identify the health of the alerting framework: decryptionHealth, executionHealth, and readHealth.
decryptionHealth (optional)
legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth
executionHealth (optional)
legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth
readHealth (optional)
legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth

legacyGetAlertingHealth_200_response_alertingFrameworkHealth_decryptionHealth - Up

The timestamp and status of the alert decryption.
status (optional)
String
Enum:
error
ok
warn
timestamp (optional)
Date format: date-time

legacyGetAlertingHealth_200_response_alertingFrameworkHealth_executionHealth - Up

The timestamp and status of the alert execution.
status (optional)
String
Enum:
error
ok
warn
timestamp (optional)
Date format: date-time

legacyGetAlertingHealth_200_response_alertingFrameworkHealth_readHealth - Up

The timestamp and status of the alert reading events.
status (optional)
String
Enum:
error
ok
warn
timestamp (optional)
Date format: date-time

non_count_criterion - non count criterion Up

threshold (optional)
array[BigDecimal]
comparator (optional)
String
Enum:
<
<=
>
>=
between
outside
timeUnit (optional)
String
timeSize (optional)
BigDecimal
warningThreshold (optional)
array[BigDecimal]
warningComparator (optional)
String
Enum:
<
<=
>
>=
between
outside
metric (optional)
String
aggType (optional)
String
Enum:
avg
max
min
cardinality
rate
count
sum
p95
p99
custom

notify_when - Up

Indicates how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify notify_when at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

params_es_query_rule - Up

aggField (optional)
String The name of the numeric field that is used in the aggregation. This property is required when aggType is avg, max, min or sum.
aggType (optional)
aggtype
excludeHitsFromPreviousRun (optional)
Boolean Indicates whether to exclude matches from previous runs. If true, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.
groupBy (optional)
groupby
searchConfiguration (optional)
params_es_query_rule_oneOf_searchConfiguration
searchType
String The type of query, in this case a query that uses Elasticsearch Query DSL.
Enum:
esQuery
size
Integer The number of documents to pass to the configured actions when the threshold condition is met.
termField (optional)
String This property is required when groupBy is top. The name of the field that is used for grouping the aggregation.
termSize (optional)
Integer This property is required when groupBy is top. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
threshold
array[Integer] The threshold value that is used with the thresholdComparator. If the thresholdComparator is between or notBetween, you must specify the boundary values.
thresholdComparator
thresholdcomparator
timeField
String The field that is used to calculate the time window.
timeWindowSize
Integer The size of the time window (in timeWindowUnit units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
timeWindowUnit
timewindowunit
esQuery
String The query definition, which uses Elasticsearch Query DSL.
index
oneOf The indices to query.

params_es_query_rule_oneOf - Up

The parameters for an Elasticsearch query rule that uses KQL or Lucene to define the query.
aggField (optional)
String The name of the numeric field that is used in the aggregation. This property is required when aggType is avg, max, min or sum.
aggType (optional)
aggtype
excludeHitsFromPreviousRun (optional)
Boolean Indicates whether to exclude matches from previous runs. If true, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.
groupBy (optional)
groupby
searchConfiguration (optional)
params_es_query_rule_oneOf_searchConfiguration
searchType
String The type of query, in this case a text-based query that uses KQL or Lucene.
Enum:
searchSource
size
Integer The number of documents to pass to the configured actions when the threshold condition is met.
termField (optional)
String This property is required when groupBy is top. The name of the field that is used for grouping the aggregation.
termSize (optional)
Integer This property is required when groupBy is top. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
threshold
array[Integer] The threshold value that is used with the thresholdComparator. If the thresholdComparator is between or notBetween, you must specify the boundary values.
thresholdComparator
thresholdcomparator
timeField (optional)
String The field that is used to calculate the time window.
timeWindowSize
Integer The size of the time window (in timeWindowUnit units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
timeWindowUnit
timewindowunit

params_es_query_rule_oneOf_1 - Up

The parameters for an Elasticsearch query rule that uses Elasticsearch Query DSL to define the query.
aggField (optional)
String The name of the numeric field that is used in the aggregation. This property is required when aggType is avg, max, min or sum.
aggType (optional)
aggtype
esQuery
String The query definition, which uses Elasticsearch Query DSL.
excludeHitsFromPreviousRun (optional)
Boolean Indicates whether to exclude matches from previous runs. If true, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.
groupBy (optional)
groupby
index
oneOf The indices to query.
searchType (optional)
String The type of query, in this case a query that uses Elasticsearch Query DSL.
Enum:
esQuery
size (optional)
Integer The number of documents to pass to the configured actions when the threshold condition is met.
termField (optional)
String This property is required when groupBy is top. The name of the field that is used for grouping the aggregation.
termSize (optional)
Integer This property is required when groupBy is top. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
threshold
array[Integer] The threshold value that is used with the thresholdComparator. If the thresholdComparator is between or notBetween, you must specify the boundary values.
thresholdComparator
thresholdcomparator
timeField
String The field that is used to calculate the time window.
timeWindowSize
Integer The size of the time window (in timeWindowUnit units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
timeWindowUnit
timewindowunit

params_es_query_rule_oneOf_searchConfiguration - Up

The query definition, which uses KQL or Lucene to fetch the documents from Elasticsearch.
filter (optional)
array[filter]
index (optional)
oneOf The indices to query.
query (optional)
params_es_query_rule_oneOf_searchConfiguration_query

params_es_query_rule_oneOf_searchConfiguration_query - Up

language (optional)
String
query (optional)
String

params_index_threshold_rule - Up

The parameters for an index threshold rule.
aggField (optional)
String The name of the numeric field that is used in the aggregation. This property is required when aggType is avg, max, min or sum.
aggType (optional)
aggtype
filterKuery (optional)
String A KQL expression thats limits the scope of alerts.
groupBy (optional)
groupby
index
array[String] The indices to query.
termField (optional)
String This property is required when groupBy is top. The name of the field that is used for grouping the aggregation.
termSize (optional)
Integer This property is required when groupBy is top. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
threshold
array[Integer] The threshold value that is used with the thresholdComparator. If the thresholdComparator is between or notBetween, you must specify the boundary values.
thresholdComparator
thresholdcomparator
timeField
String The field that is used to calculate the time window.
timeWindowSize
Integer The size of the time window (in timeWindowUnit units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
timeWindowUnit
timewindowunit

params_property_apm_anomaly - Up

serviceName (optional)
String The service name from APM
transactionType (optional)
String The transaction type from APM
windowSize
BigDecimal The window size
windowUnit
String The window size unit
Enum:
m
h
d
environment
String The environment from APM
anomalySeverityType
String The anomaly threshold value
Enum:
critical
major
minor
warning

params_property_apm_error_count - Up

serviceName (optional)
String The service name from APM
windowSize
BigDecimal The window size
windowUnit
String The window size unit
Enum:
m
h
d
environment
String The environment from APM
threshold
BigDecimal The error count threshold value
groupBy (optional)
set[String]
Enum:
errorGroupingKey (optional)
String

params_property_apm_transaction_duration - Up

serviceName (optional)
String The service name from APM
transactionType (optional)
String The transaction type from APM
transactionName (optional)
String The transaction name from APM
windowSize
BigDecimal The window size
windowUnit
String ç
Enum:
m
h
d
environment
String
threshold
BigDecimal The latency threshold value
groupBy (optional)
set[String]
Enum:
aggregationType
String
Enum:
avg
95th
99th

params_property_apm_transaction_error_rate - Up

serviceName (optional)
String The service name from APM
transactionType (optional)
String The transaction type from APM
transactionName (optional)
String The transaction name from APM
windowSize
BigDecimal The window size
windowUnit
String The window size unit
Enum:
m
h
d
environment
String The environment from APM
threshold
BigDecimal The error rate threshold value
groupBy (optional)
set[String]
Enum:

params_property_infra_inventory - Up

criteria (optional)
array[params_property_infra_inventory_criteria_inner]
filterQuery (optional)
String
filterQueryText (optional)
String
nodeType (optional)
String
Enum:
host
pod
container
awsEC2
awsS3
awsSQS
awsRDS
sourceId (optional)
String
alertOnNoData (optional)
Boolean

params_property_infra_inventory_criteria_inner - Up

metric (optional)
String
Enum:
count
cpu
diskLatency
load
memory
memoryTotal
tx
rx
logRate
diskIOReadBytes
diskIOWriteBytes
s3TotalRequests
s3NumberOfObjects
s3BucketSize
s3DownloadBytes
s3UploadBytes
rdsConnections
rdsQueriesExecuted
rdsActiveTransactions
rdsLatency
sqsMessagesVisible
sqsMessagesDelayed
sqsMessagesSent
sqsMessagesEmpty
sqsOldestMessage
custom
timeSize (optional)
BigDecimal
timeUnit (optional)
String
Enum:
s
m
h
d
sourceId (optional)
String
threshold (optional)
array[BigDecimal]
comparator (optional)
String
Enum:
<
<=
>
>=
between
outside
customMetric (optional)
params_property_infra_inventory_criteria_inner_customMetric
warningThreshold (optional)
array[BigDecimal]
warningComparator (optional)
String
Enum:
<
<=
>
>=
between
outside

params_property_infra_inventory_criteria_inner_customMetric - Up

type (optional)
String
Enum:
custom
field (optional)
String
aggregation (optional)
String
Enum:
avg
max
min
rate
id (optional)
String
label (optional)
String

params_property_infra_metric_threshold - Up

criteria (optional)
array[params_property_infra_metric_threshold_criteria_inner]
groupBy (optional)
findRules_search_fields_parameter
filterQuery (optional)
String
sourceId (optional)
String
alertOnNoData (optional)
Boolean
alertOnGroupDisappear (optional)
Boolean

params_property_infra_metric_threshold_criteria_inner - Up

threshold (optional)
array[BigDecimal]
comparator (optional)
String
Enum:
<
<=
>
>=
between
outside
timeUnit (optional)
String
timeSize (optional)
BigDecimal
warningThreshold (optional)
array[BigDecimal]
warningComparator (optional)
String
Enum:
<
<=
>
>=
between
outside
metric (optional)
String
aggType (optional)
String
Enum:
custom
customMetric (optional)
array[custom_criterion_customMetric_inner]
equation (optional)
String
label (optional)
String

params_property_log_threshold - Up

criteria (optional)
array[array[Object]]
count
Count_count
timeSize
BigDecimal
timeUnit
String
Enum:
s
m
h
d
logView
Count_logView
groupBy (optional)
array[String]

params_property_slo_burn_rate - Up

sloId (optional)
String The SLO identifier used by the rule
burnRateThreshold (optional)
BigDecimal The burn rate threshold used to trigger the alert
maxBurnRateThreshold (optional)
BigDecimal The maximum burn rate threshold value defined by the SLO error budget
longWindow (optional)
params_property_slo_burn_rate_longWindow
shortWindow (optional)
params_property_slo_burn_rate_shortWindow

params_property_slo_burn_rate_longWindow - Up

The duration of the long window used to compute the burn rate
value (optional)
BigDecimal The duration value
unit (optional)
String The duration unit

params_property_slo_burn_rate_shortWindow - Up

The duration of the short window used to compute the burn rate
value (optional)
BigDecimal The duration value
unit (optional)
String The duration unit

params_property_synthetics_monitor_status - Up

availability (optional)
params_property_synthetics_monitor_status_availability
filters (optional)
params_property_synthetics_monitor_status_filters
locations (optional)
array[String]
numTimes
BigDecimal
search (optional)
String
shouldCheckStatus
Boolean
shouldCheckAvailability
Boolean
timerangeCount (optional)
BigDecimal
timerangeUnit (optional)
String
timerange (optional)
params_property_synthetics_monitor_status_timerange
version (optional)
BigDecimal
isAutoGenerated (optional)
Boolean

params_property_synthetics_monitor_status_availability - Up

range (optional)
BigDecimal
rangeUnit (optional)
String
threshold (optional)
String

params_property_synthetics_monitor_status_filters - Up

monitorPeriodtype (optional)
array[String]
observerPeriodgeoPeriodname (optional)
array[String]
tags (optional)
array[String]
urlPeriodport (optional)
array[String]

params_property_synthetics_monitor_status_filters_oneOf - Up

monitorPeriodtype (optional)
array[String]
observerPeriodgeoPeriodname (optional)
array[String]
tags (optional)
array[String]
urlPeriodport (optional)
array[String]

params_property_synthetics_monitor_status_timerange - Up

from (optional)
String
to (optional)
String

params_property_synthetics_uptime_tls - Up

search (optional)
String
certExpirationThreshold (optional)
BigDecimal
certAgeThreshold (optional)
BigDecimal

rule_response_properties - Rule response properties Up

actions
array[actions_inner]
api_key_created_by_user (optional)
Boolean Indicates whether the API key that is associated with the rule was created by the user.
api_key_owner
String The owner of the API key that is associated with the rule and used to run background tasks.
consumer
String The application or feature that owns the rule. For example, alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
created_at
Date The date and time that the rule was created. format: date-time
created_by
String The identifier for the user that created the rule.
enabled
Boolean Indicates whether the rule is currently enabled.
execution_status
rule_response_properties_execution_status
id
String The identifier for the rule.
last_run (optional)
rule_response_properties_last_run
muted_alert_ids
array[String]
mute_all
Boolean
name
String The name of the rule.
next_run (optional)
Date format: date-time
notify_when (optional)
String Indicates how often alerts generate actions.
params
map[String, oas_any_type_not_mapped] The parameters for the rule.
revision (optional)
Integer The rule revision number.
rule_type_id
String The identifier for the type of rule. For example, .es-query, .index-threshold, logs.alert.document.count, monitoring_alert_cluster_health, siem.thresholdRule, or xpack.ml.anomaly_detection_alert.
running (optional)
Boolean Indicates whether the rule is running.
schedule
schedule
scheduled_task_id (optional)
String
tags
array[String] The tags for the rule.
throttle
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
updated_at
String The date and time that the rule was updated most recently.
updated_by
String The identifier for the user that updated this rule most recently.

rule_response_properties_execution_status - Up

last_duration (optional)
Integer
last_execution_date (optional)
Date format: date-time
status (optional)
String

rule_response_properties_last_run - Up

alerts_count (optional)
rule_response_properties_last_run_alerts_count
outcome (optional)
String
outcome_msg (optional)
array[String]
outcome_order (optional)
Integer
warning (optional)
String

rule_response_properties_last_run_alerts_count - Up

active (optional)
Integer
ignored (optional)
Integer
new (optional)
Integer
recovered (optional)
Integer

schedule - Up

The check interval, which specifies how frequently the rule conditions are checked. The interval is specified in seconds, minutes, hours, or days.
interval (optional)
String

thresholdcomparator - Up

The comparison function for the threshold. For example, "is above", "is above or equals", "is below", "is below or equals", "is between", and "is not between".

timewindowunit - Up

The type of units for the time window: seconds, minutes, hours, or days.

update_rule_request - Update rule request Up

The update rule API request body varies depending on the type of rule and actions.
actions (optional)
array[actions_inner]
name
String The name of the rule.
notify_when (optional)
notify_when
params
map[String, oas_any_type_not_mapped] The parameters for the rule.
schedule
schedule
tags (optional)
array[String] The tags for the rule.
throttle (optional)
String The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
« Machine learning APIs Deleted pages »