Create an SLO

Base URL
https://{kibana_url}
  • POST /api/observability/slos
  • POST /s/{space_id}/api/observability/slos
Auth

You must have all privileges for the SLOs feature in the Observability section of the Kibana feature privileges.

Required privileges

Privileges slo_write

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

artifacts object

Links to related assets for the SLO

dashboards object[]

Array of dashboard references

id string required

Dashboard saved-object id

budgetingMethod union anyOf required

The budgeting method to use when computing the rollup data.

Values: occurrences timeslices
description string required

A description for the SLO.

groupBy union anyOf

optional group by field or fields to use to generate an SLO per distinct value

Values: *
id string · min length: 8 · max length: 48 · pattern: ^[a-z0-9-_]+$

The identifier of the SLO.

indicator union oneOf required

The indicator to use to compute the SLI

One of: (determined by type)
type: sli.apm.transactionDuration

Defines properties for the APM latency indicator type

type enum required

The type of indicator.

Values: sli.apm.transactionDuration
params object required

An object containing the indicator parameters.

dataViewId string

The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.

environment union enum | string required

The APM service environment or "*"

Values: *
filter union anyOf

KQL query used for filtering the data

Any of:

the KQL query to filter the documents with.

index string required

The index used by APM metrics

service union enum | string required

The APM service name

Values: *
threshold number required

The latency threshold in milliseconds

transactionName union enum | string required

The APM transaction name or "*"

Values: *
transactionType union enum | string required

The APM transaction type or "*"

Values: *
name string required

A name for the SLO.

objective object required

Defines properties for the SLO objective

target number required

the target objective between 0 and 1 excluded

timesliceTarget number

the target objective for each slice when using a timeslices budgeting method

timesliceWindow string · max length: 16

the duration of each slice when using a timeslices budgeting method, as {duraton}{unit}

revision number
settings object

Defines properties for SLO settings.

frequency string · max length: 16

The interval between checks for changes in the source data. The minimum value is 1m and the maximum is 59m. The default value is 1 minute.

preventCrossProjectSearch boolean

Pin the L1 rollup transform to the local/origin project only, preventing flat-world (cross-linked-project) reads. Only applies on serverless. Default is false, meaning rollup transforms target all linked projects.

preventInitialBackfill boolean

Start aggregating data from the time the SLO is created, instead of backfilling data from the beginning of the time window.

projectRoutings string · max length: 8192 nullable

ES ProjectRouting expression controlling which linked projects the L1 rollup reads. When set (including null), overrides preventCrossProjectSearch. null and _alias:_origin mean origin only; _alias:* means all linked projects. Subset example _id:p1 AND _id:p2.

syncDelay string · max length: 16

The time delay in minutes between the current time and the latest source data time. Increasing the value will delay any alerting. The default value is 1 minute. The minimum value is 1m and the maximum is 359m. It should always be greater then source index refresh interval.

syncField string nullable

The date field that is used to identify new documents in the source. It is strongly recommended to use a field that contains the ingest timestamp. If you use a different field, you might need to set the delay such that it accounts for data transmission delays. When unspecified, we use the indicator timestamp field.

tags string[]

List of tags

timeWindow union oneOf required

Defines properties for the SLO time window

One of: (determined by type)
type: rolling
type enum required

Indicates weither the time window is a rolling or a calendar aligned time window.

Values: rolling
duration string · max length: 16 required

the duration formatted as {duration}{unit}. Accepted values for rolling: 7d, 30d, 90d

Responses

Successful request

application/json
id string required

Bad request

application/json
error string required
message string required
statusCode number required

Unauthorized response

application/json
error string required
message string required
statusCode number required

Forbidden response

application/json
error string required
message string required
statusCode number required

Conflict - The SLO id already exists

application/json
error string required
message string required
statusCode number required
Base URL
https://{kibana_url}