---
title: stack kb alerting-v2 put-alerting-v2-rules-id cli command
description: Create or replace a rule Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4097/reference/elastic-cli/cli/stack/kb/alerting-v2/put-alerting-v2-rules-id
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb alerting-v2 put-alerting-v2-rules-id cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb alerting-v2 put-alerting-v2-rules-id \
  --id <id> \
  --kind <kind> \
  --metadata <metadata> \
  --query <query> \
  --schedule <schedule> \
  [options]
```

Create or replace a rule
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--id string required">
    The identifier for the rule.
  </definition>
  <definition term="--kind string required">
    The kind of the rule.
  </definition>
  <definition term="--metadata string required">
  </definition>
  <definition term="--query string required">
  </definition>
  <definition term="--schedule string required">
  </definition>
  <definition term="--artifacts string[]">
    Artifacts attached to the rule, each shaped as `{ id, type, data }`. `data` is a type-specific object (for example a `runbook` may carry `content`, a `dashboard` may carry `dashboardId`). Per-type shape is validated by the artifact-type registry when the type is registered; unregistered types pass through with envelope bounds only.
    **Repeatable:** pass `--artifacts` multiple times to supply more than one value
  </definition>
  <definition term="--grouping string">
  </definition>
  <definition term="--no-data-strategy string">
    How to handle no-data situations. "last_known_status" holds the last known status; "recover" forces recovery; "none" disables no-data detection. "emit" is not currently accepted by the create/update API. Standalone-format rules must provide a `no_data` query block when this is not "none"; composed-format rules use `base` as the data-presence query.
  </definition>
  <definition term="--recovery-strategy string">
    How recovery is detected. "no_breach" recovers groups that stop breaching; "query" uses a custom recovery query; "none" disables recovery.
  </definition>
  <definition term="--state-transition string">
    Episode state transition thresholds (alert-only).
  </definition>
  <definition term="--time-field string">
    Time field used for the lookback window range filter.
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>