stack kb alerting post-alerting-rule-rule-id-alert-alert-id-snooze cli command

elastic stack kb alerting post-alerting-rule-rule-id-alert-alert-id-snooze \
  --rule-id <rule-id> \
  --alert-id <alert-id> \
  [options]
		

Snooze an alert

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--rule-id string required

The identifier for the rule.

--alert-id string required

The identifier for the alert.

--validate-alerts-existence

Set to true to validate that the specified alert exists. If a 400 error is returned, the specified alert does not exist. Defaults to true.

--condition-operator enum

Logical operator applied to the conditions array. "any" expires the snooze when at least one condition is met; "all" requires every condition to be met. When conditions are provided but this field is omitted, defaults to "any".

Values: any, all

--conditions string[]

One or more conditions that, when met, automatically expire the snooze. Supported types: field_change, severity_change, severity_equals.

Repeatable: pass --conditions multiple times to supply more than one value

--expires-at string

The datetime at which the snooze expires, in ISO 8601 format (YYYY-MM-DDTHH:mm:ss.sssZ). When omitted, the snooze persists indefinitely unless manually removed or a defined condition is met.

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--json

output as JSON