Create a rule
https://{kibana_url}
- POST /api/alerting/rule/{id}
- POST /s/{space_id}/api/alerting/rule/{id}
Refer to Spaces for more information.
Path Parameters
-
idstringrequired -
The identifier for the rule. If it is omitted, an ID is randomly generated.
Request
-
actionsobject · default: [] -
alerts_filter -
Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.
-
timeframeobject -
Defines a period that limits whether the action runs.
-
days -
Defines the days of the week that the action can run, represented as an array of numbers. For example,
1represents Monday. An empty array is equivalent to specifying all the days of the week. -
Values:
1234567 -
hoursobjectrequired -
Defines the range of time in a day that the action can run. If the
startvalue is00:00and theendvalue is24:00, actions be generated all day. -
timezonestringrequired -
The ISO time zone for the
hoursvalues. Values such asUTCandUTC+1also work but lack built-in support for daylight savings time and are not recommended. -
frequency -
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleInterval -
summarybooleanrequired -
Indicates whether the action is a summary.
-
throttlestring · default: nullnullable -
The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when
notify_whenis set toonThrottleInterval. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values. -
groupstring -
The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to
default. -
idstringrequired -
The identifier for the connector saved object.
-
paramsmap string to object · default: {} -
The parameters for the action, which are sent to the connector. The
paramsare handled as Mustache templates and passed a default set of context. -
use_alert_data_for_templateboolean -
Indicates whether to use alert data as a template.
-
uuidstring -
A universally unique identifier (UUID) for the action.
-
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the CCR read exceptions rule. These parameters are appropriate when
rule_type_idismonitoring_ccr_read_exceptions. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_ccr_read_exceptions -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the cluster health rule. These parameters are appropriate when
rule_type_idismonitoring_alert_cluster_health. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_cluster_health -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the CPU usage rule. These parameters are appropriate when
rule_type_idismonitoring_alert_cpu_usage. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_cpu_usage -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the disk usage rule. These parameters are appropriate when
rule_type_idismonitoring_alert_disk_usage. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_disk_usage -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the ES version mismatch rule. These parameters are appropriate when
rule_type_idismonitoring_alert_elasticsearch_version_mismatch. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_elasticsearch_version_mismatch -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the Kibana version mismatch rule. These parameters are appropriate when
rule_type_idismonitoring_alert_kibana_version_mismatch. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_kibana_version_mismatch -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the license expiration rule. These parameters are appropriate when
rule_type_idismonitoring_alert_license_expiration. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_license_expiration -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the logstash version mismatch rule. These parameters are appropriate when
rule_type_idismonitoring_alert_logstash_version_mismatch. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_logstash_version_mismatch -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the memory usage rule. These parameters are appropriate when
rule_type_idismonitoring_alert_jvm_memory_usage. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_jvm_memory_usage -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the missing monitoring data rule. These parameters are appropriate when
rule_type_idismonitoring_alert_missing_monitoring_data. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_missing_monitoring_data -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the nodes changed rule. These parameters are appropriate when
rule_type_idismonitoring_alert_nodes_changed. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_nodes_changed -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the large shard size rule. These parameters are appropriate when
rule_type_idismonitoring_shard_size. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
indexPatternstringrequired -
limitstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_shard_size -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the thread pool search rejections rule. These parameters are appropriate when
rule_type_idismonitoring_alert_thread_pool_search_rejections. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_thread_pool_search_rejections -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the thread pool write rejections rule. These parameters are appropriate when
rule_type_idismonitoring_alert_thread_pool_write_rejections. -
durationstringrequired -
filterQuerystring -
filterQueryTextstring -
thresholdnumber -
rule_type_id -
Values:
monitoring_alert_thread_pool_write_rejections -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the anomaly detection rule. These parameters are appropriate when
rule_type_idisxpack.ml.anomaly_detection_alert". -
includeInterimboolean · default: true -
jobSelectionobjectrequired -
kqlQueryStringstring · default: nullnullable -
lookbackIntervalstring · default: nullnullable -
resultType -
Values:
recordbucketinfluencer -
severitynumber · min: 0 · max: 100required -
topNBucketsnumber · min: 1 · default: nullnullable -
rule_type_id -
Values:
xpack.ml.anomaly_detection_alert -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the anomaly detection jobs health rule. These parameters are appropriate when
rule_type_idisxpack.ml.anomaly_detection_jobs_health". -
excludeJobsobject · default: nullnullable -
includeJobsobjectrequired -
testsConfigobject · default: nullnullable -
behindRealtimeobject · default: nullnullable -
enabledboolean · default: true -
timeIntervalstring · default: nullnullable -
delayedDataobject · default: nullnullable -
docsCountnumber · min: 1 · default: nullnullable -
docsCountPercentagenumber · min: 0 · max: 100 · default: nullnullable -
enabledboolean · default: true -
thresholdType -
Values:
countpercentage -
timeIntervalstring · default: nullnullable -
errorMessagesobject · default: nullnullable -
enabledboolean · default: true -
rule_type_id -
Values:
xpack.ml.anomaly_detection_jobs_health -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the degraded docs rule. These parameters are appropriate when
rule_type_idisdatasetQuality.degradedDocs. -
comparatorstringrequired -
groupBystring -
searchConfigurationobjectrequired -
indexstringrequired -
thresholdnumberrequired -
timeSizenumberrequired -
timeUnitstringrequired -
rule_type_id -
Values:
datasetQuality.degradedDocs -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the ES query rule. These parameters are appropriate when
rule_type_idis.es-query. -
aggFieldstring · min: 1 -
The name of the numeric field that is used in the aggregation. This property is required when
aggTypeisavg,max,minorsum. -
aggTypestring · default: count -
The type of aggregation to perform.
-
esqlQueryoneOfrequired -
The query definition in Elasticsearch Query Language.
-
esqlstring · min: 1required -
esQueryoneOfrequired -
excludeHitsFromPreviousRunboolean · default: true -
Indicates whether to exclude matches from previous runs. If
true, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified. -
groupBystring · default: all -
Indicates whether the aggregation is applied over all documents (
all), grouped by row (row), or split into groups (top) using a grouping field (termField) where only the top groups (up totermSizenumber of groups) are checked. If grouping is used, an alert will be created for each group when it exceeds the threshold. -
indexoneOfrequired -
The indices to query.
-
searchConfigurationoneOfrequired -
The query definition, which uses KQL or Lucene to fetch the documents from Elasticsearch.
-
searchType· default: esQuery -
The type of query For example:
esQueryfor Elasticsearch Query DSL oresqlQueryfor Elasticsearch Query Language (ES|QL). -
Values:
searchSourceesQueryesqlQuery -
sizenumber · min: 0 · max: 10000required -
The number of documents to pass to the configured actions when the threshold condition is met.
-
sourceFieldsobject · max: 5 -
The sourceFields param is ignored.
-
labelstringrequired -
searchPathstringrequired -
termFieldstring | string -
The names of up to four fields that are used for grouping the aggregation. This property is required when
groupByistop. -
termSizenumber · min: 1 -
This property is required when
groupByistop. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields. -
thresholdnumber · min: 1 · max: 2required -
thresholdComparator -
The comparison function for the threshold. For example: greater than, less than, greater than or equal to, between, or not between.
-
Values:
><>=<=betweennotBetween -
timeFieldstringrequired -
The field that is used to calculate the time window.
-
timeWindowSizenumber · min: 1required -
The size of the time window (in
timeWindowUnitunits), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. -
timeWindowUnitstringrequired -
The type of units for the time window. For example: seconds, minutes, hours, or days.
-
rule_type_id -
Values:
.es-query -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the index threshold rule. These parameters are appropriate when
rule_type_idis.index-threshold. -
aggFieldstring · min: 1 -
The name of the numeric field that is used in the aggregation. This property is required when
aggTypeisavg,max,minorsum. -
aggTypestring · default: count -
The type of aggregation to perform.
-
filterKuerystring -
A Kibana Query Language (KQL) expression thats limits the scope of alerts.
-
groupBystring · default: all -
Indicates whether the aggregation is applied over all documents (
all) or split into groups (top) using a grouping field (termField). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up totermSizenumber of groups) are checked. -
indexstring | stringrequired -
The indices to query.
-
termFieldstring · min: 1 -
The names of up to four fields that are used for grouping the aggregation. This property is required when
groupByistop. -
termSizenumber · min: 1 -
This property is required when
groupByistop. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields. -
thresholdnumber · min: 1 · max: 2required -
thresholdComparator -
The comparison function for the threshold. For example: greater than, less than, greater than or equal to, between, or not between.
-
Values:
><>=<=betweennotBetween -
timeFieldstring · min: 1required -
The field that is used to calculate the time window.
-
timeWindowSizenumber · min: 1required -
The size of the time window (in
timeWindowUnitunits), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. -
timeWindowUnitstringrequired -
The type of units for the time window. For example: seconds, minutes, hours, or days.
-
rule_type_id -
Values:
.index-threshold -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the geo containment rule. These parameters are appropriate when
rule_type_idis.geo-containment. -
boundaryGeoFieldstring · min: 1required -
boundaryIndexIdstring · min: 1required -
boundaryIndexQueryobjectrequired -
boundaryIndexTitlestring · min: 1required -
boundaryNameFieldstring · min: 1 -
boundaryTypestring · min: 1required -
dateFieldstring · min: 1required -
entitystring · min: 1required -
geoFieldstring · min: 1required -
indexstring · min: 1required -
indexIdstring · min: 1required -
indexQueryobjectrequired -
rule_type_id -
Values:
.geo-containment -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the transform health rule. These parameters are appropriate when
rule_type_idistransform_health. -
excludeTransformsstring · default: nullnullable -
includeTransformsstringrequired -
testsConfigobject · default: nullnullable -
errorMessagesobject · default: nullnullable -
enabledboolean · default: false -
healthCheckobject · default: nullnullable -
enabledboolean · default: true -
notStartedobject · default: nullnullable -
enabledboolean · default: true -
rule_type_id -
Values:
transform_health -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the APM anomaly rule. These parameters are appropriate when
rule_type_idisapm.anomaly". -
anomalyDetectorTypes· min: 1 -
The types of anomalies that are detected. For example, detect abnormal latency, throughput, failed transaction rates, or low transaction count.
-
Values:
txLatencytxThroughputtxFailureRatetxLowCount -
anomalySeverityType -
The severity of anomalies that result in an alert: critical, major, minor, or warning.
-
Values:
criticalmajorminorwarning -
environmentstringrequired -
The environment from APM.
-
serviceNamestring -
The service name from APM.
-
transactionTypestring -
The transaction type from APM.
-
windowSizenumberrequired -
The size of the time window (in
windowUnitunits), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. -
windowUnitstringrequired -
The type of units for the time window: minutes, hours, or days.
-
rule_type_id -
Values:
apm.anomaly -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the error count rule. These parameters are appropriate when
rule_type_idisapm.error_rate. -
environmentstringrequired -
Filter the errors coming from your application to apply the rule to a specific environment.
-
errorGroupingKeystring -
Filter the errors coming from your application to apply the rule to a specific error grouping key, which is a hash of the stack trace and other properties.
-
groupBystring -
searchConfigurationobject -
serviceNamestring -
Filter the errors coming from your application to apply the rule to a specific service.
-
thresholdnumberrequired -
The number of errors, which is the threshold for alerts.
-
useKqlFilterboolean -
A filter in Kibana Query Language (KQL) that limits the scope of the rule.
-
windowSizenumberrequired -
The time frame in which the errors must occur (in
windowUnitunits). Generally it should be a value higher than the rule check interval to avoid gaps in detection. -
windowUnitstringrequired -
The type of units for the time window: minutes, hours, or days.
-
rule_type_id -
Values:
apm.error_rate -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the transaction error rate rule. These parameters are appropriate when
rule_type_idisapm.transaction_error_rate. -
environmentstringrequired -
groupBystring -
searchConfigurationobject -
serviceNamestring -
thresholdnumberrequired -
transactionNamestring -
transactionTypestring -
useKqlFilterboolean -
windowSizenumberrequired -
windowUnitstringrequired -
rule_type_id -
Values:
apm.transaction_error_rate -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the transaction duration rule. These parameters are appropriate when
rule_type_idisapm.transaction_duration. -
environmentstringrequired -
Filter the rule to apply to a specific environment.
-
groupBystring -
searchConfigurationobject -
serviceNamestring -
Filter the rule to apply to a specific service.
-
thresholdnumberrequired -
The latency threshold value.
-
transactionNamestring -
Filter the rule to apply to a specific transaction name.
-
transactionTypestring -
Filter the rule to apply to a specific transaction type.
-
useKqlFilterboolean -
A Kibana Query Language (KQL) expression thats limits the scope of alerts.
-
windowSizenumberrequired -
The size of the time window (in
windowUnitunits), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. -
windowUnitstringrequired -
The type of units for the time window. For example: minutes, hours, or days.
-
rule_type_id -
Values:
apm.transaction_duration -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the synthetics monitor status rule. These parameters are appropriate when
rule_type_idisxpack.synthetics.alerts.monitorStatus. -
conditionobject -
alertOnNoDataboolean -
downThresholdnumber -
groupBystring -
includeRetestsboolean -
locationsThresholdnumber -
pendingThresholdnumber · min: 1 · max: 100 -
recoveryStrategy -
Values:
firstUpconditionNotMet -
windowanyOfrequired -
numberOfChecksnumber · min: 1 · max: 100 · default: 5 -
kqlQuerystring -
locationsstring -
monitorIdsstring -
monitorTypesstring -
projectsstring -
rule_type_id -
Values:
xpack.synthetics.alerts.monitorStatus -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the synthetics tls rule. These parameters are appropriate when
rule_type_idisxpack.synthetics.alerts.tls. -
browserResourceTypesstring · max: 100 -
certAgeThresholdnumber -
certExpirationThresholdnumber -
certOriginstring · max: 100 -
includeBrowserCertsboolean -
issuersstring · max: 1000 -
kqlQuerystring -
locationsstring -
monitorIdsstring -
monitorTypesstring -
projectsstring -
searchstring -
rule_type_id -
Values:
xpack.synthetics.alerts.tls -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the uptime monitor status rule. These parameters are appropriate when
rule_type_idisxpack.uptime.alerts.monitorStatus. -
availabilityobject -
filtersanyOf -
monitor.typestring -
observer.geo.namestring -
url.portstring -
isAutoGeneratedboolean -
locationsstring -
numTimesnumberrequired -
searchstring -
shouldCheckAvailabilitybooleanrequired -
shouldCheckStatusbooleanrequired -
stackVersionstring -
timerangeCountnumber -
timerangeUnitstring -
versionnumber -
rule_type_id -
Values:
xpack.uptime.alerts.monitorStatus -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
string
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the uptime tls rule. These parameters are appropriate when
rule_type_idisxpack.uptime.alerts.tlsCertificate. -
certAgeThresholdnumber -
certExpirationThresholdnumber -
searchstring -
stackVersionstring -
rule_type_id -
Values:
xpack.uptime.alerts.tlsCertificate -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the uptime duration anomaly rule. These parameters are appropriate when
rule_type_idisxpack.uptime.alerts.durationAnomaly. -
monitorIdstringrequired -
severitynumberrequired -
stackVersionstring -
rule_type_id -
Values:
xpack.uptime.alerts.durationAnomaly -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the metric inventory threshold rule. These parameters are appropriate when
rule_type_idismetrics.alert.inventory.threshold. -
alertOnNoDataboolean -
criteriaobjectrequired -
comparatorstringrequired -
customMetricobject -
aggregationstringrequired -
fieldstringrequired -
idstringrequired -
labelstring -
type -
Values:
custom -
metricstringrequired -
thresholdnumberrequired -
timeSizenumberrequired -
timeUnitstringrequired -
warningComparatorstring -
warningThresholdnumber -
filterQuerystring -
nodeTypestringrequired -
schemastring -
sourceIdstringrequired -
rule_type_id -
Values:
metrics.alert.inventory.threshold -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the metric threshold rule. These parameters are appropriate when
rule_type_idismetrics.alert.threshold. -
alertOnGroupDisappearboolean -
If true, an alert occurs if a group that previously reported metrics does not report them again over the expected time period. This check is not recommended for dynamically scaling infrastructures that might rapidly start and stop nodes automatically.
-
alertOnNoDataboolean -
If true, an alert occurs if the metrics do not report any data over the expected period or if the query fails.
-
criteriaanyOfrequired -
aggType -
Values:
count -
comparatorstringrequired -
thresholdnumberrequired -
The threshold value that is used with the
comparator. If thecomparatorisbetween, you must specify the boundary values. -
timeSizenumberrequired -
The size of the time window (in
timeUnitunits), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. -
timeUnitstringrequired -
The type of units for the time window: seconds, minutes, hours, or days.
-
warningComparatorstring -
warningThresholdnumber -
aggTypestringrequired -
comparatorstringrequired -
metricstringrequired -
thresholdnumberrequired -
The threshold value that is used with the
comparator. If thecomparatorisbetween, you must specify the boundary values. -
timeSizenumberrequired -
The size of the time window (in
timeUnitunits), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. -
timeUnitstringrequired -
The type of units for the time window: seconds, minutes, hours, or days.
-
warningComparatorstring -
warningThresholdnumber -
aggType -
Values:
custom -
comparatorstringrequired -
customMetricsanyOfrequired -
equationstring -
labelstring -
thresholdnumberrequired -
The threshold value that is used with the
comparator. If thecomparatorisbetween, you must specify the boundary values. -
timeSizenumberrequired -
The size of the time window (in
timeUnitunits), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection. -
timeUnitstringrequired -
The type of units for the time window: seconds, minutes, hours, or days.
-
warningComparatorstring -
warningThresholdnumber -
filterQuerystring -
A query that limits the scope of the rule. The rule evaluates only metric data that matches the query.
-
groupBystring | string -
Create an alert for every unique value of the specified fields. For example, you can create a rule per host or every mount point of each host. IMPORTANT: If you include the same field in both the
filterQueryandgroupBy, you might receive fewer results than you expect. For example, if you filter bycloud.region: us-east, grouping bycloud.regionwill have no effect because the filter query can match only one region. -
sourceIdstringrequired -
rule_type_id -
Values:
metrics.alert.threshold -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the custom threshold rule. These parameters are appropriate when
rule_type_idisobservability.rules.custom_threshold. -
alertOnGroupDisappearboolean -
alertOnNoDataboolean -
criteriaobjectrequired -
aggType -
Values:
custom -
comparatorstringrequired -
equationstring -
labelstring -
metricsanyOfrequired -
thresholdnumberrequired -
timeSizenumberrequired -
timeUnitstringrequired -
warningComparatorstring -
warningThresholdnumber · max: 2 -
groupBystring | string -
noDataBehavior -
Values:
recoverremainActivealertOnNoData -
searchConfigurationobjectrequired -
indexanyOfrequired -
allowHiddenboolean -
allowNoIndexboolean -
fieldAttrsmap string to object -
<string>object -
countnumber -
customDescriptionstring · max: 300 -
customLabelstring -
fieldFormatsmap string to object -
fieldsmap string to object -
<string>object -
aggregatableboolean -
countnumber · min: 0 -
customDescriptionstring · max: 300 -
customLabelstring -
esTypesstring -
namestring · max: 1000required -
readFromDocValuesboolean -
runtimeFieldanyOf -
customDescriptionstring · max: 300 -
customLabelstring -
popularitynumber · min: 0 -
type -
Values:
keywordlongdoubledateipbooleangeo_point -
fieldsmap string to object -
<string>object -
customDescriptionstring · max: 300 -
customLabelstring -
popularitynumber · min: 0 -
type -
Values:
keywordlongdoubledateipbooleangeo_point -
type -
Values:
composite -
scriptstring · max: 1000000 -
scriptedboolean -
searchableboolean -
shortDotsEnableboolean -
typestring · max: 1000 · default: string -
idstring -
managedboolean -
namestring -
namespacesstring -
runtimeFieldMapmap string to anyOf -
sourceFiltersobject -
timeFieldNamestring -
titlestringrequired -
typestring -
typeMetaobject -
versionstring -
rule_type_id -
Values:
observability.rules.custom_threshold -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
string
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsanyOfrequired -
The parameters for the log threshold rule. These parameters are appropriate when
rule_type_idislogs.alert.document.count. -
countobjectrequired -
comparator -
Values:
more thanmore than or equalsless thanless than or equalsequalsdoes not equalmatchesdoes not matchmatches phrasedoes not match phrase -
valuenumberrequired -
criteriaobjectrequired -
comparator -
Values:
more thanmore than or equalsless thanless than or equalsequalsdoes not equalmatchesdoes not matchmatches phrasedoes not match phrase -
fieldstringrequired -
valuenumber | stringrequired -
groupBystring -
timeSizenumberrequired -
timeUnit -
Values:
smhd -
countobjectrequired -
comparator -
Values:
more thanmore than or equalsless thanless than or equalsequalsdoes not equalmatchesdoes not matchmatches phrasedoes not match phrase -
valuenumberrequired -
criteriaobject · min: 2 · max: 2required -
groupBystring -
timeSizenumberrequired -
timeUnit -
Values:
smhd -
rule_type_id -
Values:
logs.alert.document.count -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsobjectrequired -
The parameters for the slo burn rate rule. These parameters are appropriate when
rule_type_idisslo.rules.burnRate. -
dependenciesobject -
actionGroupsToSuppressOnstringrequired -
ruleIdstringrequired -
sloIdstringrequired -
windowsobjectrequired -
actionGroupstringrequired -
burnRateThresholdnumberrequired -
idstringrequired -
longWindowobjectrequired -
maxBurnRateThresholdnumber · default: nullnullable -
shortWindowobjectrequired -
rule_type_id -
Values:
slo.rules.burnRate -
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
actionsobject · default: [] -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
artifactsobject -
dashboardsobject · max: 10 -
idstringrequired -
investigation_guideobject -
blobstring · max: 10000required -
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledboolean · default: true -
Indicates whether you want the rule to run on an interval basis after it is created.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsmap string to object · default: {} -
The parameters for the rule.
-
rule_type_idstringrequired -
The rule type identifier.
-
scheduleobjectrequired -
The check interval, which specifies how frequently the rule conditions are checked.
-
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
The tags for the rule.
-
template_idstring · max: 1024 -
The identifier for the rule template this rule was created from, when known.
-
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
Responses
Indicates a successful call.
-
actionsobjectrequired -
alerts_filterobject -
Defines a period that limits whether the action runs.
-
timeframeobject -
days -
Defines the days of the week that the action can run, represented as an array of numbers. For example,
1represents Monday. An empty array is equivalent to specifying all the days of the week. -
Values:
1234567 -
hoursobjectrequired -
timezonestringrequired -
The ISO time zone for the
hoursvalues. Values such asUTCandUTC+1also work but lack built-in support for daylight savings time and are not recommended. -
connector_type_idstringrequired -
The type of connector. This property appears in responses but cannot be set in requests.
-
frequencyobject -
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleInterval -
summarybooleanrequired -
Indicates whether the action is a summary.
-
throttlestring · default: nullnullable -
The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when 'notify_when' is set to 'onThrottleInterval'. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
groupstring -
The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to
default. -
idstringrequired -
The identifier for the connector saved object.
-
paramsmap string to objectrequired -
The parameters for the action, which are sent to the connector. The
paramsare handled as Mustache templates and passed a default set of context. -
use_alert_data_for_templateboolean -
Indicates whether to use alert data as a template.
-
uuidstring -
A universally unique identifier (UUID) for the action.
-
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
activenumberrequired -
The number of consecutive runs that must meet the rule conditions.
-
api_key_created_by_userbooleannullable -
Indicates whether the API key that is associated with the rule was created by the user.
-
api_key_ownerstring · default: nullnullable -
The owner of the API key that is associated with the rule and used to run background tasks.
-
artifactsobject -
dashboardsobject -
idstringrequired -
investigation_guideobject -
blobstringrequired -
User-created content that describes alert causes and remediation.
-
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
created_atstringrequired -
The date and time that the rule was created.
-
created_bystring · default: nullnullable -
The identifier for the user that created the rule.
-
enabledbooleanrequired -
Indicates whether you want the rule to run on an interval basis after it is created.
-
execution_statusobjectrequired -
errorobject -
last_durationnumber -
Duration of last rule execution.
-
last_execution_datestringrequired -
The date and time of the last rule execution.
-
flapping -
enabledboolean -
Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
-
look_back_windownumber · min: 2 · max: 20required -
The minimum number of runs in which the threshold must be met.
-
status_change_thresholdnumber · min: 2 · max: 20required -
The minimum number of times an alert must switch states within the defined look back window time.
-
idstringrequired -
The identifier for the rule.
-
last_runobjectnullable -
alerts_countobjectrequired -
outcome -
Outcome of the last rule run. Value can be succeeded, warning, or failed.
-
Values:
succeededwarningfailed -
outcome_msgstringnullable -
outcome_ordernumber -
Order of the outcome.
-
warning -
Warning of last rule execution.
-
Values:
readdecryptexecuteunknownlicensetimeoutdisabledvalidatemaxExecutableActionsmaxAlertsmaxQueuedActionsruleExecutionnull -
mapped_paramsmap string to object -
mute_allbooleanrequired -
Indicates whether all alerts are muted.
-
muted_alert_idsstringrequired -
namestringrequired -
The name of the rule.
-
next_runstringnullable -
Date and time of the next rule run.
-
notify_when -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
paramsmap string to objectrequired -
The parameters for the rule.
-
revisionnumberrequired -
The rule revision number.
-
rule_type_idstringrequired -
The rule type identifier.
-
runningbooleannullable -
Indicates whether the rule is running.
-
scheduleobjectrequired -
intervalstringrequired -
The interval is specified in seconds, minutes, hours, or days.
-
scheduled_task_idstring -
Identifier of the scheduled task.
-
throttlestringnullable deprecated -
Deprecated in 8.13.0. Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values. -
updated_atstringrequired -
The date and time of the latest updates to the rule.
-
updated_bystring · default: nullnullable -
The identifier for the user who was the last to update the rule.
Indicates an invalid schema or parameters.
Indicates that this call is forbidden.
Indicates that the rule id is already in use.