stack kb alerting put-alerting-rule-id cli command

elastic stack kb alerting put-alerting-rule-id \
  --id <id> \
  --name <name> \
  --schedule <schedule> \
  [options]
		

Update a rule

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--id string required

The identifier for the rule.

--name string required

The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.

--schedule string required

--actions string[]

--alert-delay string

Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.

--artifacts string

--flapping string

When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.

--notify-when string

Indicates how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify notify_when at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

--params string

The parameters for the rule.

--tags string[]

--throttle string

Use the throttle property in the action frequency object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

--input-file string

path to a JSON file to use as command input

--[no-]dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--[no-]json

output as JSON