---
title: stack kb alerting-v2 post-alerting-v2-rules cli command
description: Create a rule Behaviour flags: --dry-run — validate all inputs and exit without performing any action 
url: https://www.elastic.co/elastic/docs-builder/docs/4302/reference/elastic-cli/cli/stack/kb/alerting-v2/post-alerting-v2-rules
applies_to:
  - Elastic Cloud Serverless: Preview
  - Elastic Stack: Preview
---

# stack kb alerting-v2 post-alerting-v2-rules cli command
<cli-modifiers>
</cli-modifiers>

```bash
elastic stack kb alerting-v2 post-alerting-v2-rules \
  --kind <kind> \
  --metadata <metadata> \
  --query <query> \
  --schedule <schedule> \
  [options]
```

Create a rule
**Behaviour flags:**
`--dry-run` — validate all inputs and exit without performing any action

## Options

<definitions>
  <definition term="--kind string required">
    Whether the rule creates alerts (`alert`) or only stores matching events (`signal`).
  </definition>
  <definition term="--metadata string required">
  </definition>
  <definition term="--query string required">
  </definition>
  <definition term="--schedule string required">
  </definition>
  <definition term="--artifacts string[]">
    Optional objects attached to the rule, such as a runbook or a dashboard. Each item has `id`, `type`, and `data`. The shape of `data` depends on `type`. For example, a `runbook` uses `content` and a `dashboard` uses `dashboard_id`. Known types are validated against that shape. Unknown types are stored when `id`, `type`, and `data` are present.
    **Repeatable:** pass `--artifacts` multiple times to supply more than one value
  </definition>
  <definition term="--grouping string">
  </definition>
  <definition term="--no-data string">
  </definition>
  <definition term="--recovery string">
  </definition>
  <definition term="--state-transition string">
  </definition>
  <definition term="--time-field string">
    Document field Kibana uses with `schedule.lookback` to time-filter `query.base`.
  </definition>
  <definition term="--input-file string">
    path to a JSON file to use as command input
  </definition>
  <definition term="--dry-run">
    validate all inputs and exit without performing any action (preview changes without applying them)
  </definition>
  <definition term="--no-validate">
    skip input validation and send the request as-is
  </definition>
</definitions>


## Global Options

<definitions>
  <definition term="--output-fields string">
    comma-separated list of fields to include in output (dot-notation supported)
  </definition>
  <definition term="--output-template string">
    Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")
  </definition>
  <definition term="--json">
    output as JSON
  </definition>
</definitions>