---
title: stack kb alerting post-alerting-rule-id cli command
description: Create a rule Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4089/reference/elastic-cli/cli/stack/kb/alerting/post-alerting-rule-id
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb alerting post-alerting-rule-id cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb alerting post-alerting-rule-id \
  --id <id> \
  --consumer <consumer> \
  --name <name> \
  --rule-type-id <rule-type-id> \
  --schedule <schedule> \
  [options]
```

Create a rule
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--id string required">
    The identifier for the rule. If it is omitted, an ID is randomly generated.
  </definition>
  <definition term="--consumer string required">
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  </definition>
  <definition term="--name string required">
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  </definition>
  <definition term="--rule-type-id string required">
    The rule type identifier.
  </definition>
  <definition term="--schedule string required">
    The check interval, which specifies how frequently the rule conditions are checked.
  </definition>
  <definition term="--actions string[]">
    **Repeatable:** pass `--actions` multiple times to supply more than one value
  </definition>
  <definition term="--alert-delay string">
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
  </definition>
  <definition term="--artifacts string">
  </definition>
  <definition term="--enabled">
    Indicates whether you want the rule to run on an interval basis after it is created.
  </definition>
  <definition term="--flapping string">
  </definition>
  <definition term="--notify-when enum">
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    **Values:** onActionGroupChange, onActiveAlert, onThrottleInterval
  </definition>
  <definition term="--params string">
    The parameters for the rule.
  </definition>
  <definition term="--tags string[]">
    The tags for the rule.
    **Repeatable:** pass `--tags` multiple times to supply more than one value
  </definition>
  <definition term="--template-id string">
    The identifier for the rule template this rule was created from, when known.
  </definition>
  <definition term="--throttle string">
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>