Get rule APIedit

Retrieve a rule by ID.


GET <kibana host>:<port>/api/alerting/rule/<id>

GET <kibana host>:<port>/s/<space_id>/api/alerting/rule/<id>


You must have read privileges for the appropriate Kibana features, depending on the consumer and rule_type_id of the rules you’re seeking. For example, the Management > Stack Rules feature, Analytics > Discover and Machine Learning features, Observability, and Security features. To get rules associated with the Stack Monitoring feature, use the monitoring_user built-in role.

For more details, refer to Feature privileges.

Path parametersedit

(Required, string) The identifier of the rule to retrieve.
(Optional, string) An identifier for the space. If space_id is not provided in the URL, the default space is used.

Response codesedit

Indicates a successful call.


Retrieve the rule object with the ID 41893910-6bca-11eb-9e0d-85d233e3ee35:

GET api/alerting/rule/41893910-6bca-11eb-9e0d-85d233e3ee35

The API returns the following:

  "id": "0a037d60-6b62-11eb-9e0d-85d233e3ee35",
  "notify_when": "onActionGroupChange",
  "params": {
    "aggType": "avg",
  "consumer": "alerts",
  "rule_type_id": "test.rule.type",
  "schedule": {
    "interval": "1m"
  "actions": [],
  "tags": [],
  "name": "test rule",
  "enabled": true,
  "throttle": null,
  "api_key_owner": "elastic",
  "created_by": "elastic",
  "updated_by": "elastic",
  "mute_all": false,
  "muted_alert_ids": [],
  "updated_at": "2021-02-10T05:37:19.086Z",
  "created_at": "2021-02-10T05:37:19.086Z",
  "scheduled_task_id": "0b092d90-6b62-11eb-9e0d-85d233e3ee35",
  "execution_status": {
    "last_execution_date": "2021-02-10T17:55:14.262Z",
    "status": "ok",
    "last_duration": 359