Spaces method and path for this operation:
Refer to Spaces for more information.
Indicates a successful call.
Defines a period that limits whether the action runs.
Additional properties are NOT allowed.
Additional properties are NOT allowed.
A filter written in Elasticsearch Query Domain Specific Language (DSL).
A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the kbn-es-query package.
Additional properties are NOT allowed.
Additional properties are allowed.
Additional properties are allowed.
A filter written in Kibana Query Language (KQL).
Additional properties are NOT allowed.
Defines the days of the week that the action can run, represented as an array of numbers. For example, 1 represents Monday. An empty array is equivalent to specifying all the days of the week.
Values are 1, 2, 3, 4, 5, 6, or 7.
Additional properties are NOT allowed.
The ISO time zone for the hours values. Values such as UTC and UTC+1 also work but lack built-in daylight savings time support and are not recommended.
The type of connector. This property appears in responses but cannot be set in requests.
Additional properties are NOT allowed.
Indicates how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify notify_when at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
Values are onActionGroupChange, onActiveAlert, or onThrottleInterval.
Indicates whether the action is a summary.
The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if 'notify_when' is set to 'onThrottleInterval'. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to default.
The identifier for the connector saved object.
The parameters for the action, which are sent to the connector. The params are handled as Mustache templates and passed a default set of context.
Additional properties are allowed.
Indicates whether to use alert data as a template.
A universally unique identifier (UUID) for the action.
List of active snoozes for the rule.
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
Additional properties are NOT allowed.
Indicates whether the API key that is associated with the rule was created by the user.
The owner of the API key that is associated with the rule and used to run background tasks.
Additional properties are NOT allowed.
Additional properties are NOT allowed.
The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
The date and time that the rule was created.
The identifier for the user that created the rule.
Indicates whether you want to run the rule on an interval basis after it is created.
Additional properties are NOT allowed.
Additional properties are NOT allowed.
Duration of last execution of the rule.
The date and time when rule was executed last.
Status of rule execution.
Values are ok, active, error, warning, pending, or unknown.
Additional properties are NOT allowed.
When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.
Additional properties are NOT allowed.
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
The minimum number of runs in which the threshold must be met.
Minimum value is 2, maximum value is 20.
The minimum number of times an alert must switch states in the look back window.
Minimum value is 2, maximum value is 20.
The identifier for the rule.
The date when the rule will no longer be snoozed.
Additional properties are NOT allowed.
Additional properties are NOT allowed.
Outcome of last run of the rule. Value could be succeeded, warning or failed.
Values are succeeded, warning, or failed.
Outcome message generated during last rule run.
Order of the outcome.
Warning of last rule execution.
Values are read, decrypt, execute, unknown, license, timeout, disabled, validate, maxExecutableActions, maxAlerts, maxQueuedActions, or ruleExecution.
Additional properties are allowed.
Monitoring details of the rule.
Additional properties are NOT allowed.
Rule run details.
Additional properties are NOT allowed.
Calculation of different percentiles and success ratio.
Additional properties are NOT allowed.
History of the rule run.
Additional properties are NOT allowed.
Additional properties are NOT allowed.
Duration of most recent rule run.
Duration in seconds of rule run gap.
Additional properties are NOT allowed.
Total number of alerts created during last rule run.
Total number of alerts detected during last rule run.
Total time spent indexing documents during last rule run in milliseconds.
Total time spent performing Elasticsearch searches as measured by Kibana; includes network latency and time spent serializing or deserializing the request and response.
Time of the most recent rule run.
Indicates whether all alerts are muted.
List of identifiers of muted alerts.
The name of the rule.
Date and time of the next run of the rule.
Indicates how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify notify_when at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
Values are onActionGroupChange, onActiveAlert, or onThrottleInterval.
The parameters for the rule.
Additional properties are allowed.
The rule revision number.
The rule type identifier.
Indicates whether the rule is running.
Additional properties are NOT allowed.
Identifier of the scheduled task.
Duration of the rule snooze schedule.
Identifier of the rule snooze schedule.
Additional properties are NOT allowed.
Indicates hours of the day to recur.
Indicates minutes of the hour to recur.
Indicates months of the year that this rule should recur.
Indicates the days of the month to recur.
Indicates seconds of the day to recur.
A positive or negative integer affecting the nth day of the month. For example, -2 combined with byweekday of FR is 2nd to last Friday of the month. It is recommended to not set this manually and just use byweekday.
Indicates the days of the week to recur or else nth-day-of-month strings. For example, "+2TU" second Tuesday of month, "-1FR" last Friday of the month, which are internally converted to a byweekday/bysetpos combination.
Indicates number of the week hours to recur.
Indicates the days of the year that this rule should recur.
Number of times the rule should recur until it stops.
Rule start date in Coordinated Universal Time (UTC).
Indicates frequency of the rule. Options are YEARLY, MONTHLY, WEEKLY, DAILY.
Values are 0, 1, 2, 3, 4, 5, or 6.
Indicates the interval of frequency. For example, 1 and YEARLY is every 1 year, 2 and WEEKLY is every 2 weeks.
Indicates timezone abbreviation.
Recur the rule until this date.
Indicates the start of week, defaults to Monday.
Values are MO, TU, WE, TH, FR, SA, or SU.
Skips recurrence of rule on this date.
The tags for the rule.
Deprecated in 8.13.0. Use the throttle property in the action frequency object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
The date and time that the rule was updated most recently.
The identifier for the user that updated this rule most recently.
Relative URL to view rule in the app.
Indicates an invalid schema or parameters.
Indicates that this call is forbidden.
Indicates a rule with the given ID does not exist.
curl \
--request GET 'https://<KIBANA_URL>/api/alerting/rule/{id}' \
--header "Authorization: $API_KEY"