stack kb alerting-v2 put-alerting-v2-rules-id cli command

elastic stack kb alerting-v2 put-alerting-v2-rules-id \
  --id <id> \
  --kind <kind> \
  --metadata <metadata> \
  --query <query> \
  --schedule <schedule> \
  [options]
		

Create or replace a rule

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--id string required

The identifier for the rule.

--kind string required

The kind of the rule.

--metadata string required

--query string required

--schedule string required

--artifacts string[]

Artifacts attached to the rule, each shaped as { id, type, data }. data is a type-specific object (for example a runbook may carry content, a dashboard may carry dashboardId). Per-type shape is validated by the artifact-type registry when the type is registered; unregistered types pass through with envelope bounds only.

--grouping string

--no-data-strategy string

How to handle no-data situations. "last_known_status" holds the last known status; "recover" forces recovery; "none" disables no-data detection. "emit" is not currently accepted by the create/update API. Standalone-format rules must provide a no_data query block when this is not "none"; composed-format rules use base as the data-presence query.

--recovery-strategy string

How recovery is detected. "no_breach" recovers groups that stop breaching; "query" uses a custom recovery query; "none" disables recovery.

--state-transition string

Episode state transition thresholds (alert-only).

--time-field string

Time field used for the lookback window range filter.

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--json

output as JSON