GET /api/alerting/rule/{id}/query_inspector
Api key auth Basic auth

Spaces method and path for this operation:

get /s/{space_id}/api/alerting/rule/{id}/query_inspector

Refer to Spaces for more information.

Returns the Elasticsearch query that a rule executes, and optionally its response.

Path parameters

  • id string Required

    The identifier for the rule.

Query parameters

  • mode string

    The inspection mode. Use "build" to return only the query, or "execute" to run the query and include the response.

    Values are build or execute. Default value is build.

  • alert_id string

    The alert document ID. When provided, the query inspector uses the evaluation time range from the alert instead of the current time.

Responses

  • 200 application/json

    Indicates a successful call.

    Hide response attribute Show response attribute object
    • queries array[object] Required

      Not more than 1000 elements.

      Hide queries attributes Show queries attributes object
      • index string Required
      • label string
      • request object Required
      • response object
  • 400

    Indicates the rule type is not supported or the request parameters are invalid.

  • 404

    Indicates a rule with the specified rule ID does not exist.

GET /api/alerting/rule/{id}/query_inspector 
curl \
 --request GET 'https://localhost:5601/api/alerting/rule/{id}/query_inspector' \
 --header "Authorization: $API_KEY"
Response examples (200) 
{
  "queries": [
    {
      "index": "metrics-*",
      "request": {
        "aggs": {
          "groupings": {
            "composite": {
              "size": 500,
              "sources": []
            }
          }
        },
        "query": {
          "bool": {
            "filter": [
              {
                "range": {
                  "@timestamp": {
                    "gte": "2026-01-01T00:00:00.000Z",
                    "lte": "2026-01-01T00:05:00.000Z"
                  }
                }
              }
            ]
          }
        },
        "size": 0
      }
    }
  ]
}