PUT /s/{spaceId}/api/observability/slos/{sloId}
Api key auth

You must have the write privileges for the SLOs feature in the Observability section of the Kibana feature privileges.

Headers

  • kbn-xsrf string Required

    Cross-site request forgery protection

Path parameters

  • spaceId string Required

    An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used.

  • sloId string Required

    An identifier for the slo.

application/json

Body Required

  • artifacts object

    Links to related assets for the SLO

    Hide artifacts attribute Show artifacts attribute object
    • dashboards array[object]

      Array of dashboard references

      Hide dashboards attribute Show dashboards attribute object
      • id string Required

        Dashboard saved-object id

  • budgetingMethod string

    The budgeting method to use when computing the rollup data.

    Values are occurrences or timeslices.

  • description string

    A description for the SLO.

  • groupBy string | array[string]

    optional group by field or fields to use to generate an SLO per distinct value

    One of:
    string-1 string array-2 array[string]

  • indicator object

    One of:
    Custom Query object APM availability object APM latency object Custom metric object Histogram indicator object Timeslice metric object
  • name string

    A name for the SLO.

  • objective object

    Defines properties for the SLO objective

    Hide objective attributes Show objective attributes object
    • target number Required

      the target objective between 0 and 1 excluded

      Minimum value is 0, maximum value is 100.

    • timesliceTarget number

      the target objective for each slice when using a timeslices budgeting method

      Minimum value is 0, maximum value is 100.

    • timesliceWindow string

      the duration of each slice when using a timeslices budgeting method, as {duraton}{unit}

  • settings object

    Defines properties for SLO settings.

    Hide settings attributes Show settings attributes object
    • frequency string

      The interval between checks for changes in the source data. The minimum value is 1m and the maximum is 59m. The default value is 1 minute.

      Default value is 1m.

    • preventInitialBackfill boolean

      Start aggregating data from the time the SLO is created, instead of backfilling data from the beginning of the time window.

      Default value is false.

    • syncDelay string

      The time delay in minutes between the current time and the latest source data time. Increasing the value will delay any alerting. The default value is 1 minute. The minimum value is 1m and the maximum is 359m. It should always be greater then source index refresh interval.

      Default value is 1m.

    • syncField string

      The date field that is used to identify new documents in the source. It is strongly recommended to use a field that contains the ingest timestamp. If you use a different field, you might need to set the delay such that it accounts for data transmission delays. When unspecified, we use the indicator timestamp field.

  • tags array[string]

    List of tags

  • timeWindow object

    Defines properties for the SLO time window

    Hide timeWindow attributes Show timeWindow attributes object
    • duration string Required

      the duration formatted as {duration}{unit}. Accepted values for rolling: 7d, 30d, 90d. Accepted values for calendar aligned: 1w (weekly) or 1M (monthly)

    • type string Required

      Indicates weither the time window is a rolling or a calendar aligned time window.

      Values are rolling or calendarAligned.

Responses

  • 200 application/json

    Successful request

    Hide response attributes Show response attributes object
    • artifacts object

      Links to related assets for the SLO

      Hide artifacts attribute Show artifacts attribute object
      • dashboards array[object]

        Array of dashboard references

        Hide dashboards attribute Show dashboards attribute object
        • id string Required

          Dashboard saved-object id

    • budgetingMethod string Required

      The budgeting method to use when computing the rollup data.

      Values are occurrences or timeslices.

    • createdAt string Required

      The creation date

    • description string Required

      The description of the SLO.

    • enabled boolean Required

      Indicate if the SLO is enabled

    • groupBy string | array[string] Required

      optional group by field or fields to use to generate an SLO per distinct value

      One of:
      string-1 string array-2 array[string]
    • id string Required

      The identifier of the SLO.

    • indicator object Required

      One of:
      sli.kql.custom object sli.apm.transactionErrorRate object sli.apm.transactionDuration object sli.metric.custom object sli.histogram.custom object sli.metric.timeslice object
    • name string Required

      The name of the SLO.

    • objective object Required

      Defines properties for the SLO objective

      Hide objective attributes Show objective attributes object
      • target number Required

        the target objective between 0 and 1 excluded

        Minimum value is 0, maximum value is 100.

      • timesliceTarget number

        the target objective for each slice when using a timeslices budgeting method

        Minimum value is 0, maximum value is 100.

      • timesliceWindow string

        the duration of each slice when using a timeslices budgeting method, as {duraton}{unit}

    • revision number Required

      The SLO revision

    • settings object Required

      Defines properties for SLO settings.

      Hide settings attributes Show settings attributes object
      • frequency string

        The interval between checks for changes in the source data. The minimum value is 1m and the maximum is 59m. The default value is 1 minute.

        Default value is 1m.

      • preventInitialBackfill boolean

        Start aggregating data from the time the SLO is created, instead of backfilling data from the beginning of the time window.

        Default value is false.

      • syncDelay string

        The time delay in minutes between the current time and the latest source data time. Increasing the value will delay any alerting. The default value is 1 minute. The minimum value is 1m and the maximum is 359m. It should always be greater then source index refresh interval.

        Default value is 1m.

      • syncField string

        The date field that is used to identify new documents in the source. It is strongly recommended to use a field that contains the ingest timestamp. If you use a different field, you might need to set the delay such that it accounts for data transmission delays. When unspecified, we use the indicator timestamp field.

    • tags array[string] Required

      List of tags

    • timeWindow object Required

      Defines properties for the SLO time window

      Hide timeWindow attributes Show timeWindow attributes object
      • duration string Required

        the duration formatted as {duration}{unit}. Accepted values for rolling: 7d, 30d, 90d. Accepted values for calendar aligned: 1w (weekly) or 1M (monthly)

      • type string Required

        Indicates weither the time window is a rolling or a calendar aligned time window.

        Values are rolling or calendarAligned.

    • updatedAt string Required

      The last update date

    • version number Required

      The internal SLO version
  • 400 application/json

    Bad request

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode number Required
  • 401 application/json

    Unauthorized response

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode number Required
  • 403 application/json

    Forbidden response

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode number Required
  • 404 application/json

    Not found response

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode number Required
PUT /s/{spaceId}/api/observability/slos/{sloId} 
curl \
 --request PUT 'https://<KIBANA_URL>/s/default/api/observability/slos/9c235211-6834-11ea-a78c-6feb38a34414' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: string" \
 --data '{"name":"Updated Service Availability","tags":["production","updated"]}'
Request examples 
{
  "name": "Updated Service Availability",
  "tags": [
    "production",
    "updated"
  ]
}
{
  "objective": {
    "target": 0.995
  }
}
Response examples (200) 
{
  "id": "8853df00-ae2e-11ed-90af-09bb6422b258",
  "name": "Updated Service Availability",
  "tags": [
    "production",
    "updated"
  ],
  "enabled": true,
  "groupBy": "*",
  "version": 2,
  "revision": 2,
  "settings": {
    "frequency": "5m",
    "syncDelay": "5m"
  },
  "createdAt": "2025-01-12T10:03:19.000Z",
  "indicator": {
    "type": "sli.kql.custom",
    "params": {
      "good": "request.status_code : \"2xx\"",
      "index": "logs-*",
      "total": "request.status_code : *",
      "filter": "field.environment : \"production\" and service.name : \"my-service\"",
      "timestampField": "@timestamp"
    }
  },
  "objective": {
    "target": 0.99
  },
  "updatedAt": "2025-03-26T14:30:00.000Z",
  "timeWindow": {
    "type": "rolling",
    "duration": "30d"
  },
  "description": "Availability of my web service",
  "budgetingMethod": "occurrences"
}
Response examples (400) 
{
  "error": "Bad Request",
  "message": "Invalid value 'foo' supplied to: indicator/type",
  "statusCode": 400
}
Response examples (401) 
{
  "error": "Unauthorized",
  "message": "security_exception: unable to authenticate user for REST request [/api/observability/slos]",
  "statusCode": 401
}
Response examples (403) 
{
  "error": "Forbidden",
  "message": "security_exception: action [slo_write] is unauthorized for user",
  "statusCode": 403
}
Response examples (404) 
{
  "error": "Not Found",
  "message": "SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found",
  "statusCode": 404
}