---
type: api
title: Create a rule
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-post-alerting-rule-id
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-post-alerting-rule-id
products:
  - Kibana
---

# Create a rule

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/alerting/rule/{id}`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth)

#### Path Parameters

- `id` (string)
  The identifier for the rule. If it is omitted, an ID is randomly generated.

## Request Body

`application/json`

Any of:
- **Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    - `alerts_filter` ({}) — optional
      Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.
      - `query` ({}) — optional
        - `dsl` (string) — optional
          A filter written in Elasticsearch Query Domain Specific Language (DSL).
        - `filters` ([] object) — required
          A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package.
          - `$state` (object) — optional
            - `store` (enum) — required
              A filter that can be applied to a specific application context or applied globally.
              Values: `appState`, `globalState`
          - `meta` (map string to object) — required
          - `query` (map string to object) — optional
        - `kql` (string) — required
          A filter written in Kibana Query Language (KQL).
      - `timeframe` (object) — optional
        Defines a period that limits whether the action runs.
        - `days` ([] enum) — required
          Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week.
          Values: `1`, `2`, `3`, `4`, `5`, `6`, `7`
        - `hours` (object) — required
          Defines the range of time in a day that the action can run. If the `start` value is `00:00` and the `end` value is `24:00`, actions be generated all day.
          - `end` (string) — required
            The end of the time frame, in 24-hour notation (`hh:mm`).
          - `start` (string) — required
            The start of the time frame, in 24-hour notation (`hh:mm`).
        - `timezone` (string) — required
          The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in support for daylight savings time and are not recommended.
    - `frequency` ({}) — optional
      - `notify_when` (enum) — required
        Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
        Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`
      - `summary` (boolean) — required
        Indicates whether the action is a summary.
      - `throttle` (string · default: null) — optional — nullable
        The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when `notify_when` is set to `onThrottleInterval`. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    - `group` (string) — optional
      The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`.
    - `id` (string) — required
      The identifier for the connector saved object.
    - `params` (map string to object · default: {}) — optional
      The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context.
    - `use_alert_data_for_template` (boolean) — optional
      Indicates whether to use alert data as a template.
    - `uuid` (string) — optional
      A universally unique identifier (UUID) for the action.
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the CCR read exceptions rule. These parameters are appropriate when `rule_type_id` is `monitoring_ccr_read_exceptions`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_ccr_read_exceptions`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-cluster-health-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the cluster health rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_cluster_health`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_cluster_health`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-cpu-usage-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the CPU usage rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_cpu_usage`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_cpu_usage`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-disk-usage-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the disk usage rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_disk_usage`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_disk_usage`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-elasticsearch-version-mismatch-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the ES version mismatch rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_elasticsearch_version_mismatch`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_elasticsearch_version_mismatch`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-kibana-version-mismatch-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the Kibana version mismatch rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_kibana_version_mismatch`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_kibana_version_mismatch`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-license-expiration-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the license expiration rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_license_expiration`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_license_expiration`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-logstash-version-mismatch-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the logstash version mismatch rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_logstash_version_mismatch`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_logstash_version_mismatch`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-jvm-memory-usage-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the memory usage rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_jvm_memory_usage`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_jvm_memory_usage`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-missing-monitoring-data-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the missing monitoring data rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_missing_monitoring_data`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_missing_monitoring_data`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-nodes-changed-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the nodes changed rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_nodes_changed`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_nodes_changed`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-shard-size-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the large shard size rule. These parameters are appropriate when `rule_type_id` is `monitoring_shard_size`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `indexPattern` (string) — required
    - `limit` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_shard_size`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-thread-pool-search-rejections-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the thread pool search rejections rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_thread_pool_search_rejections`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_thread_pool_search_rejections`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_monitoring-alert-thread-pool-write-rejections-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the thread pool write rejections rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_thread_pool_write_rejections`.
    - `duration` (string) — required
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `threshold` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `monitoring_alert_thread_pool_write_rejections`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_xpack-ml-anomaly-detection-alert-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the anomaly detection rule. These parameters are appropriate when `rule_type_id` is `xpack.ml.anomaly_detection_alert"`.
    - `includeInterim` (boolean · default: true) — optional
    - `jobSelection` (object) — required
      - `groupIds` ([] string · default: []) — optional
      - `jobIds` ([] string · default: []) — optional
    - `kqlQueryString` (string · default: null) — optional — nullable
    - `lookbackInterval` (string · default: null) — optional — nullable
    - `resultType` (enum) — required
      Values: `record`, `bucket`, `influencer`
    - `severity` (number · min: 0 · max: 100) — required
    - `topNBuckets` (number · min: 1 · default: null) — optional — nullable
  - `rule_type_id` (enum) — required
    Values: `xpack.ml.anomaly_detection_alert`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_xpack-ml-anomaly-detection-jobs-health-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the anomaly detection jobs health rule. These parameters are appropriate when `rule_type_id` is `xpack.ml.anomaly_detection_jobs_health"`.
    - `excludeJobs` (object · default: null) — optional — nullable
      - `groupIds` ([] string · default: []) — optional
      - `jobIds` ([] string · default: []) — optional
    - `includeJobs` (object) — required
      - `groupIds` ([] string · default: []) — optional
      - `jobIds` ([] string · default: []) — optional
    - `testsConfig` (object · default: null) — optional — nullable
      - `behindRealtime` (object · default: null) — optional — nullable
        - `enabled` (boolean · default: true) — optional
        - `timeInterval` (string · default: null) — optional — nullable
      - `datafeed` (object · default: null) — optional — nullable
        - `enabled` (boolean · default: true) — optional
      - `delayedData` (object · default: null) — optional — nullable
        - `docsCount` (number · min: 1 · default: null) — optional — nullable
        - `docsCountPercentage` (number · min: 0 · max: 100 · default: null) — optional — nullable
        - `enabled` (boolean · default: true) — optional
        - `thresholdType` (enum) — optional
          Values: `count`, `percentage`
        - `timeInterval` (string · default: null) — optional — nullable
      - `errorMessages` (object · default: null) — optional — nullable
        - `enabled` (boolean · default: true) — optional
      - `mml` (object · default: null) — optional — nullable
        - `enabled` (boolean · default: true) — optional
  - `rule_type_id` (enum) — required
    Values: `xpack.ml.anomaly_detection_jobs_health`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_datasetquality-degradeddocs-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the degraded docs rule. These parameters are appropriate when `rule_type_id` is `datasetQuality.degradedDocs`.
    - `comparator` (string) — required
    - `groupBy` ([] string) — optional
    - `searchConfiguration` (object) — required
      - `index` (string) — required
    - `threshold` ([] number) — required
    - `timeSize` (number) — required
    - `timeUnit` (string) — required
  - `rule_type_id` (enum) — required
    Values: `datasetQuality.degradedDocs`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_es-query-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the ES query rule. These parameters are appropriate when `rule_type_id` is `.es-query`.
    - `aggField` (string · min: 1) — optional
      The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`.
    - `aggType` (string · default: count) — optional
      The type of aggregation to perform.
    - `esqlQuery` (union oneOf) — required
      The query definition in Elasticsearch Query Language.
      - **{ esql }**
        - `esql` (string · min: 1) — required
      - **object**
    - `esQuery` (union oneOf) — required
      One of: `string` or `object`
    - `excludeHitsFromPreviousRun` (boolean · default: true) — optional
      Indicates whether to exclude matches from previous runs. If `true`, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.
    - `groupBy` (string · default: all) — optional
      Indicates whether the aggregation is applied over all documents (`all`), grouped by row (`row`), or split into groups (`top`) using a grouping field (`termField`) where only the top groups (up to `termSize` number of groups) are checked. If grouping is used, an alert will be created for each group when it exceeds the threshold.
    - `index` (union oneOf) — required
      The indices to query.
      One of: `string[]` or `object`
    - `searchConfiguration` (union oneOf) — required
      The query definition, which uses KQL or Lucene to fetch the documents from Elasticsearch.
      One of: `object`
    - `searchType` (enum  · default: esQuery) — optional
      The type of query For example: `esQuery` for Elasticsearch Query DSL or `esqlQuery` for Elasticsearch Query Language (ES|QL).
      Values: `searchSource`, `esQuery`, `esqlQuery`
    - `size` (number · min: 0 · max: 10000) — required
      The number of documents to pass to the configured actions when the threshold condition is met.
    - `sourceFields` ([] object · max: 5) — optional
      The sourceFields param is ignored.
      - `label` (string) — required
      - `searchPath` (string) — required
    - `termField` (union string | [] string) — optional
      The names of up to four fields that are used for grouping the aggregation. This property is required when `groupBy` is `top`.
    - `termSize` (number · min: 1) — optional
      This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
    - `threshold` ([] number · min: 1 · max: 2) — required
    - `thresholdComparator` (enum) — required
      The comparison function for the threshold. For example: greater than, less than, greater than or equal to, between, or not between.
      Values: `>`, `<`, `>=`, `<=`, `between`, `notBetween`
    - `timeField` (union string) — required
      The field that is used to calculate the time window.
      One of: `string`
    - `timeWindowSize` (number · min: 1) — required
      The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
    - `timeWindowUnit` (string) — required
      The type of units for the time window. For example: seconds, minutes, hours, or days.
  - `rule_type_id` (enum) — required
    Values: `.es-query`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_index-threshold-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the index threshold rule. These parameters are appropriate when `rule_type_id` is `.index-threshold`.
    - `aggField` (string · min: 1) — optional
      The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`.
    - `aggType` (string · default: count) — optional
      The type of aggregation to perform.
    - `filterKuery` (string) — optional
      A Kibana Query Language (KQL) expression thats limits the scope of alerts.
    - `groupBy` (string · default: all) — optional
      Indicates whether the aggregation is applied over all documents (`all`) or split into groups (`top`) using a grouping field (`termField`). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to `termSize` number of groups) are checked.
    - `index` (union string | [] string) — required
      The indices to query.
    - `termField` (string · min: 1) — optional
      The names of up to four fields that are used for grouping the aggregation. This property is required when `groupBy` is `top`.
    - `termSize` (number · min: 1) — optional
      This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
    - `threshold` ([] number · min: 1 · max: 2) — required
    - `thresholdComparator` (enum) — required
      The comparison function for the threshold. For example: greater than, less than, greater than or equal to, between, or not between.
      Values: `>`, `<`, `>=`, `<=`, `between`, `notBetween`
    - `timeField` (string · min: 1) — required
      The field that is used to calculate the time window.
    - `timeWindowSize` (number · min: 1) — required
      The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
    - `timeWindowUnit` (string) — required
      The type of units for the time window. For example: seconds, minutes, hours, or days.
  - `rule_type_id` (enum) — required
    Values: `.index-threshold`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_geo-containment-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the geo containment rule. These parameters are appropriate when `rule_type_id` is `.geo-containment`.
    - `boundaryGeoField` (string · min: 1) — required
    - `boundaryIndexId` (string · min: 1) — required
    - `boundaryIndexQuery` (object) — required
    - `boundaryIndexTitle` (string · min: 1) — required
    - `boundaryNameField` (string · min: 1) — optional
    - `boundaryType` (string · min: 1) — required
    - `dateField` (string · min: 1) — required
    - `entity` (string · min: 1) — required
    - `geoField` (string · min: 1) — required
    - `index` (string · min: 1) — required
    - `indexId` (string · min: 1) — required
    - `indexQuery` (object) — required
  - `rule_type_id` (enum) — required
    Values: `.geo-containment`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_transform-health-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the transform health rule. These parameters are appropriate when `rule_type_id` is `transform_health`.
    - `excludeTransforms` ([] string · default: null) — optional — nullable
    - `includeTransforms` ([] string) — required
    - `testsConfig` (object · default: null) — optional — nullable
      - `errorMessages` (object · default: null) — optional — nullable
        - `enabled` (boolean · default: false) — optional
      - `healthCheck` (object · default: null) — optional — nullable
        - `enabled` (boolean · default: true) — optional
      - `notStarted` (object · default: null) — optional — nullable
        - `enabled` (boolean · default: true) — optional
  - `rule_type_id` (enum) — required
    Values: `transform_health`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_apm-anomaly-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the APM anomaly rule. These parameters are appropriate when `rule_type_id` is `apm.anomaly"`.
    - `anomalyDetectorTypes` ([] enum  · min: 1) — optional
      The types of anomalies that are detected. For example, detect abnormal latency, throughput, failed transaction rates, or low transaction count.
      Values: `txLatency`, `txThroughput`, `txFailureRate`, `txLowCount`
    - `anomalySeverityType` (enum) — required
      The severity of anomalies that result in an alert: critical, major, minor, or warning.
      Values: `critical`, `major`, `minor`, `warning`
    - `environment` (string) — required
      The environment from APM.
    - `serviceName` (string) — optional
      The service name from APM.
    - `transactionType` (string) — optional
      The transaction type from APM.
    - `windowSize` (number) — required
      The size of the time window (in `windowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
    - `windowUnit` (string) — required
      The type of units for the time window: minutes, hours, or days.
  - `rule_type_id` (enum) — required
    Values: `apm.anomaly`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_apm-error-rate-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the error count rule. These parameters are appropriate when `rule_type_id` is `apm.error_rate`.
    - `environment` (string) — required
      Filter the errors coming from your application to apply the rule to a specific environment.
    - `errorGroupingKey` (string) — optional
      Filter the errors coming from your application to apply the rule to a specific error grouping key, which is a hash of the stack trace and other properties.
    - `groupBy` ([] string) — optional
    - `searchConfiguration` (object) — optional
      - `query` (object) — required
        - `language` (string) — required
        - `query` (union anyOf) — required
          Any of: `string` or `string to object`
    - `serviceName` (string) — optional
      Filter the errors coming from your application to apply the rule to a specific service.
    - `threshold` (number) — required
      The number of errors, which is the threshold for alerts.
    - `useKqlFilter` (boolean) — optional
      A filter in Kibana Query Language (KQL) that limits the scope of the rule.
    - `windowSize` (number) — required
      The time frame in which the errors must occur (in `windowUnit` units). Generally it should be a value higher than the rule check interval to avoid gaps in detection.
    - `windowUnit` (string) — required
      The type of units for the time window: minutes, hours, or days.
  - `rule_type_id` (enum) — required
    Values: `apm.error_rate`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_apm-transaction-error-rate-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the transaction error rate rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_error_rate`.
    - `environment` (string) — required
    - `groupBy` ([] string) — optional
    - `searchConfiguration` (object) — optional
      - `query` (object) — required
        - `language` (string) — required
        - `query` (union anyOf) — required
          Any of: `string` or `string to object`
    - `serviceName` (string) — optional
    - `threshold` (number) — required
    - `transactionName` (string) — optional
    - `transactionType` (string) — optional
    - `useKqlFilter` (boolean) — optional
    - `windowSize` (number) — required
    - `windowUnit` (string) — required
  - `rule_type_id` (enum) — required
    Values: `apm.transaction_error_rate`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_apm-transaction-duration-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the transaction duration rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_duration`.
    - `aggregationType` (enum) — required
      The type of aggregation to perform.
      Values: `avg`, `95th`, `99th`
    - `environment` (string) — required
      Filter the rule to apply to a specific environment.
    - `groupBy` ([] string) — optional
    - `searchConfiguration` (object) — optional
      - `query` (object) — required
        - `language` (string) — required
        - `query` (union anyOf) — required
          Any of: `string` or `string to object`
    - `serviceName` (string) — optional
      Filter the rule to apply to a specific service.
    - `threshold` (number) — required
      The latency threshold value.
    - `transactionName` (string) — optional
      Filter the rule to apply to a specific transaction name.
    - `transactionType` (string) — optional
      Filter the rule to apply to a specific transaction type.
    - `useKqlFilter` (boolean) — optional
      A Kibana Query Language (KQL) expression thats limits the scope of alerts.
    - `windowSize` (number) — required
      The size of the time window (in `windowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
    - `windowUnit` (string) — required
      The type of units for the time window. For example: minutes, hours, or days.
  - `rule_type_id` (enum) — required
    Values: `apm.transaction_duration`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_xpack-synthetics-alerts-monitorstatus-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the synthetics monitor status rule. These parameters are appropriate when `rule_type_id` is `xpack.synthetics.alerts.monitorStatus`.
    - `condition` (object) — optional
      - `alertOnNoData` (boolean) — optional
      - `downThreshold` (number) — optional
      - `groupBy` (string) — optional
      - `includeRetests` (boolean) — optional
      - `locationsThreshold` (number) — optional
      - `pendingThreshold` (number · min: 1 · max: 100) — optional
      - `recoveryStrategy` (enum) — optional
        Values: `firstUp`, `conditionNotMet`
      - `window` (union anyOf) — required
        - **{ time }**
          - `time` (object) — required
            - `size` (number · default: 5) — optional
            - `unit` (enum  · default: m) — optional
              Values: `s`, `m`, `h`, `d`
        - **{ numberOfChecks }**
          - `numberOfChecks` (number · min: 1 · max: 100 · default: 5) — optional
    - `kqlQuery` (string) — optional
    - `locations` ([] string) — optional
    - `monitorIds` ([] string) — optional
    - `monitorTypes` ([] string) — optional
    - `projects` ([] string) — optional
    - `tags` ([] string) — optional
  - `rule_type_id` (enum) — required
    Values: `xpack.synthetics.alerts.monitorStatus`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_xpack-synthetics-alerts-tls-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the synthetics tls rule. These parameters are appropriate when `rule_type_id` is `xpack.synthetics.alerts.tls`.
    - `browserResourceTypes` ([] string · max: 100) — optional
    - `certAgeThreshold` (number) — optional
    - `certExpirationThreshold` (number) — optional
    - `certOrigin` ([] string · max: 100) — optional
    - `includeBrowserCerts` (boolean) — optional
    - `issuers` ([] string · max: 1000) — optional
    - `kqlQuery` (string) — optional
    - `locations` ([] string) — optional
    - `monitorIds` ([] string) — optional
    - `monitorTypes` ([] string) — optional
    - `projects` ([] string) — optional
    - `search` (string) — optional
    - `tags` ([] string) — optional
  - `rule_type_id` (enum) — required
    Values: `xpack.synthetics.alerts.tls`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_xpack-uptime-alerts-monitorstatus-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the uptime monitor status rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.monitorStatus`.
    - `availability` (object) — optional
      - `range` (number) — required
      - `rangeUnit` (string) — required
      - `threshold` (string) — required
    - `filters` (union anyOf) — optional
      - **{ monitor.type, observer.geo.name, tags, … }**
        - `monitor.type` ([] string) — optional
        - `observer.geo.name` ([] string) — optional
        - `tags` ([] string) — optional
        - `url.port` ([] string) — optional
      - **string**
    - `isAutoGenerated` (boolean) — optional
    - `locations` ([] string) — optional
    - `numTimes` (number) — required
    - `search` (string) — optional
    - `shouldCheckAvailability` (boolean) — required
    - `shouldCheckStatus` (boolean) — required
    - `stackVersion` (string) — optional
    - `timerange` (object) — optional
      - `from` (string) — required
      - `to` (string) — required
    - `timerangeCount` (number) — optional
    - `timerangeUnit` (string) — optional
    - `version` (number) — optional
  - `rule_type_id` (enum) — required
    Values: `xpack.uptime.alerts.monitorStatus`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_xpack-uptime-alerts-tlscertificate-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the uptime tls rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.tlsCertificate`.
    - `certAgeThreshold` (number) — optional
    - `certExpirationThreshold` (number) — optional
    - `search` (string) — optional
    - `stackVersion` (string) — optional
  - `rule_type_id` (enum) — required
    Values: `xpack.uptime.alerts.tlsCertificate`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_xpack-uptime-alerts-durationanomaly-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the uptime duration anomaly rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.durationAnomaly`.
    - `monitorId` (string) — required
    - `severity` (number) — required
    - `stackVersion` (string) — optional
  - `rule_type_id` (enum) — required
    Values: `xpack.uptime.alerts.durationAnomaly`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_metrics-alert-inventory-threshold-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the metric inventory threshold rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.inventory.threshold`.
    - `alertOnNoData` (boolean) — optional
    - `criteria` ([] object) — required
      - `comparator` (string) — required
      - `customMetric` (object) — optional
        - `aggregation` (string) — required
        - `field` (string) — required
        - `id` (string) — required
        - `label` (string) — optional
        - `type` (enum) — required
          Values: `custom`
      - `metric` (string) — required
      - `threshold` ([] number) — required
      - `timeSize` (number) — required
      - `timeUnit` (string) — required
      - `warningComparator` (string) — optional
      - `warningThreshold` ([] number) — optional
    - `filterQuery` (string) — optional
    - `nodeType` (string) — required
    - `schema` (string) — optional
    - `sourceId` (string) — required
  - `rule_type_id` (enum) — required
    Values: `metrics.alert.inventory.threshold`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_metrics-alert-threshold-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the metric threshold rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.threshold`.
    - `alertOnGroupDisappear` (boolean) — optional
      If true, an alert occurs if a group that previously reported metrics does not report them again over the expected time period. This check is not recommended for dynamically scaling infrastructures that might rapidly start and stop nodes automatically.
    - `alertOnNoData` (boolean) — optional
      If true, an alert occurs if the metrics do not report any data over the expected period or if the query fails.
    - `criteria` ([] union anyOf) — required
      - **aggType: count**
        - `aggType` (enum) — required
          Values: `count`
        - `comparator` (string) — required
        - `threshold` ([] number) — required
          The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values.
        - `timeSize` (number) — required
          The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
        - `timeUnit` (string) — required
          The type of units for the time window: seconds, minutes, hours, or days.
        - `warningComparator` (string) — optional
        - `warningThreshold` ([] number) — optional
      - **{ metric }**
        - `aggType` (string) — required
        - `comparator` (string) — required
        - `metric` (string) — required
        - `threshold` ([] number) — required
          The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values.
        - `timeSize` (number) — required
          The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
        - `timeUnit` (string) — required
          The type of units for the time window: seconds, minutes, hours, or days.
        - `warningComparator` (string) — optional
        - `warningThreshold` ([] number) — optional
      - **aggType: custom**
        - `aggType` (enum) — required
          Values: `custom`
        - `comparator` (string) — required
        - `customMetrics` ([] union anyOf) — required
          - **{ field }**
            - `aggType` (string) — required
            - `field` (string) — required
            - `name` (string) — required
          - **aggType: count**
            - `aggType` (enum) — required
              Values: `count`
            - `filter` (string) — optional
            - `name` (string) — required
        - `equation` (string) — optional
        - `label` (string) — optional
        - `threshold` ([] number) — required
          The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values.
        - `timeSize` (number) — required
          The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
        - `timeUnit` (string) — required
          The type of units for the time window: seconds, minutes, hours, or days.
        - `warningComparator` (string) — optional
        - `warningThreshold` ([] number) — optional
    - `filterQuery` (string) — optional
      A query that limits the scope of the rule. The rule evaluates only metric data that matches the query.
    - `groupBy` (union string | [] string) — optional
      Create an alert for every unique value of the specified fields. For example, you can create a rule per host or every mount point of each host. IMPORTANT: If you include the same field in both the `filterQuery` and `groupBy`, you might receive fewer results than you expect. For example, if you filter by `cloud.region: us-east`, grouping by `cloud.region` will have no effect because the filter query can match only one region.
    - `sourceId` (string) — required
  - `rule_type_id` (enum) — required
    Values: `metrics.alert.threshold`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_observability-rules-custom-threshold-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the custom threshold rule. These parameters are appropriate when `rule_type_id` is `observability.rules.custom_threshold`.
    - `alertOnGroupDisappear` (boolean) — optional
    - `alertOnNoData` (boolean) — optional
    - `criteria` ([] object) — required
      - `aggType` (enum) — optional
        Values: `custom`
      - `comparator` (string) — required
      - `equation` (string) — optional
      - `label` (string) — optional
      - `metrics` ([] union anyOf) — required
        - **{ field }**
          - `aggType` (string) — required
          - `field` (string) — required
          - `filter` (string) — optional
          - `name` (string) — required
        - **aggType: count**
          - `aggType` (enum) — required
            Values: `count`
          - `filter` (string) — optional
          - `name` (string) — required
      - `threshold` ([] number) — required
      - `timeSize` (number) — required
      - `timeUnit` (string) — required
      - `warningComparator` (string) — optional
      - `warningThreshold` ([] number · max: 2) — optional
    - `groupBy` (union string | [] string) — optional
    - `noDataBehavior` (enum) — optional
      Values: `recover`, `remainActive`, `alertOnNoData`
    - `searchConfiguration` (object) — required
      - `filter` ([] object) — optional
        - `meta` (map string to object) — required
        - `query` (map string to object) — optional
      - `index` (union anyOf) — required
        - **string**
        - **{ title, allowHidden, allowNoIndex, … }**
          - `allowHidden` (boolean) — optional
          - `allowNoIndex` (boolean) — optional
          - `fieldAttrs` (map string to object) — optional
            Map values (object)
            - `count` (number) — optional
            - `customDescription` (string · max: 300) — optional
            - `customLabel` (string) — optional
          - `fieldFormats` (map string to object) — optional
            Map values (object)
            - `id` (string) — optional
            - `params` (object) — required
          - `fields` (map string to object) — optional
            Map values (object)
            - `aggregatable` (boolean) — optional
            - `count` (number · min: 0) — optional
            - `customDescription` (string · max: 300) — optional
            - `customLabel` (string) — optional
            - `esTypes` ([] string) — optional
            - `format` (object) — optional
              - `id` (string) — optional
              - `params` (object) — required
            - `name` (string · max: 1000) — required
            - `readFromDocValues` (boolean) — optional
            - `runtimeField` (union anyOf) — optional
              - **{ customDescription, customLabel, format, … }**
                - `customDescription` (string · max: 300) — optional
                - `customLabel` (string) — optional
                - `format` (object) — optional
                  - `id` (string) — optional
                  - `params` (object) — required
                - `popularity` (number · min: 0) — optional
                - `script` (object) — optional
                  - `source` (string) — required
                - `type` (enum) — required
                  Values: `keyword`, `long`, `double`, `date`, `ip`, `boolean`, `geo_point`
              - **type: composite**
                - `fields` (map string to object) — optional
                  Map values (object)
                  - `customDescription` (string · max: 300) — optional
                  - `customLabel` (string) — optional
                  - `format` (object) — optional
                    - `id` (string) — optional
                    - `params` (object) — required
                  - `popularity` (number · min: 0) — optional
                  - `type` (enum) — required
                    Values: `keyword`, `long`, `double`, `date`, `ip`, `boolean`, `geo_point`
                - `script` (object) — optional
                  - `source` (string) — required
                - `type` (enum) — required
                  Values: `composite`
            - `script` (string · max: 1000000) — optional
            - `scripted` (boolean) — optional
            - `searchable` (boolean) — optional
            - `shortDotsEnable` (boolean) — optional
            - `subType` (object) — optional
              - `multi` (object) — optional
                - `parent` (string) — required
              - `nested` (object) — optional
                - `path` (string) — required
            - `type` (string · max: 1000 · default: string) — optional
          - `id` (string) — optional
          - `managed` (boolean) — optional
          - `name` (string) — optional
          - `namespaces` ([] string) — optional
          - `runtimeFieldMap` (map string to anyOf) — optional
          - `sourceFilters` ([] object) — optional
            - `clientId` (number | string) — optional
            - `value` (string) — required
          - `timeFieldName` (string) — optional
          - `title` (string) — required
          - `type` (string) — optional
          - `typeMeta` (object) — optional
          - `version` (string) — optional
      - `query` (object) — required
        - `language` (string) — required
        - `query` (string) — required
  - `rule_type_id` (enum) — required
    Values: `observability.rules.custom_threshold`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_logs-alert-document-count-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (union anyOf) — required
    The parameters for the log threshold rule. These parameters are appropriate when `rule_type_id` is `logs.alert.document.count`.
    - **object**
      - `count` (object) — required
        - `comparator` (enum) — required
          Values: `more than`, `more than or equals`, `less than`, `less than or equals`, `equals`, `does not equal`, `matches`, `does not match`, `matches phrase`, `does not match phrase`
        - `value` (number) — required
      - `criteria` ([] object) — required
        - `comparator` (enum) — required
          Values: `more than`, `more than or equals`, `less than`, `less than or equals`, `equals`, `does not equal`, `matches`, `does not match`, `matches phrase`, `does not match phrase`
        - `field` (string) — required
        - `value` (number | string) — required
      - `groupBy` ([] string) — optional
      - `logView` (object) — required
        - `logViewId` (string) — required
        - `type` (enum) — required
          Values: `log-view-reference`
      - `timeSize` (number) — required
      - `timeUnit` (enum) — required
        Values: `s`, `m`, `h`, `d`
    - **object**
      - `count` (object) — required
        - `comparator` (enum) — required
          Values: `more than`, `more than or equals`, `less than`, `less than or equals`, `equals`, `does not equal`, `matches`, `does not match`, `matches phrase`, `does not match phrase`
        - `value` (number) — required
      - `criteria` ([] object · min: 2 · max: 2) — required
      - `groupBy` ([] string) — optional
      - `logView` (object) — required
        - `logViewId` (string) — required
        - `type` (enum) — required
          Values: `log-view-reference`
      - `timeSize` (number) — required
      - `timeUnit` (enum) — required
        Values: `s`, `m`, `h`, `d`
  - `rule_type_id` (enum) — required
    Values: `logs.alert.document.count`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_slo-rules-burnrate-create-rule-body-alerting**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (object) — required
    The parameters for the slo burn rate rule. These parameters are appropriate when `rule_type_id` is `slo.rules.burnRate`.
    - `dependencies` ([] object) — optional
      - `actionGroupsToSuppressOn` ([] string) — required
      - `ruleId` (string) — required
    - `sloId` (string) — required
    - `windows` ([] object) — required
      - `actionGroup` (string) — required
      - `burnRateThreshold` (number) — required
      - `id` (string) — required
      - `longWindow` (object) — required
        - `unit` (string) — required
        - `value` (number) — required
      - `maxBurnRateThreshold` (number · default: null) — optional — nullable
      - `shortWindow` (object) — required
        - `unit` (string) — required
        - `value` (number) — required
  - `rule_type_id` (enum) — required
    Values: `slo.rules.burnRate`
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- **Kibana_HTTP_APIs_new_rule**
  - `actions` ([] object · default: []) — optional
    Same fields as `actions` in `Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting`
  - `alert_delay` (object) — optional
    Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
    - `active` (number) — required
      The number of consecutive runs that must meet the rule conditions.
  - `artifacts` (object) — optional
    - `dashboards` ([] object · max: 10) — optional
      - `id` (string) — required
    - `investigation_guide` (object) — optional
      - `blob` (string · max: 10000) — required
  - `consumer` (string) — required
    The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
  - `enabled` (boolean · default: true) — optional
    Indicates whether you want the rule to run on an interval basis after it is created.
  - `flapping` ({}) — optional
    - `enabled` (boolean) — optional
      Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
    - `look_back_window` (number · min: 2 · max: 20) — required
      The minimum number of runs in which the threshold must be met.
    - `status_change_threshold` (number · min: 2 · max: 20) — required
      The minimum number of times an alert must switch states within the defined look back window time.
  - `name` (string) — required
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
  - `notify_when` (enum) — optional — nullable
    Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
    Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
  - `params` (map string to object · default: {}) — optional
    The parameters for the rule.
  - `rule_type_id` (string) — required
    The rule type identifier.
  - `schedule` (object) — required
    The check interval, which specifies how frequently the rule conditions are checked.
    - `interval` (string) — required
      The interval is specified in seconds, minutes, hours, or days.
  - `tags` ([] string · default: []) — optional
    The tags for the rule.
  - `template_id` (string · max: 1024) — optional
    The identifier for the rule template this rule was created from, when known.
  - `throttle` (string) — optional — nullable
    Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `actions` ([] object)
  - `alerts_filter` (object)
    Defines a period that limits whether the action runs.
    - `query` ({})
      - `dsl` (string)
        A filter written in Elasticsearch Query Domain Specific Language (DSL).
      - `filters` ([] object)
        A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package.
        - `$state` (object)
          - `store` (enum)
            A filter that can be applied to a specific application context or applied globally.
            Values: `appState`, `globalState`
        - `meta` (map string to object)
        - `query` (map string to object)
      - `kql` (string)
        A filter written in Kibana Query Language (KQL).
    - `timeframe` (object)
      - `days` ([] enum)
        Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week.
        Values: `1`, `2`, `3`, `4`, `5`, `6`, `7`
      - `hours` (object)
        - `end` (string)
          The end of the time frame, in 24-hour notation (`hh:mm`).
        - `start` (string)
          The start of the time frame, in 24-hour notation (`hh:mm`).
      - `timezone` (string)
        The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in support for daylight savings time and are not recommended.
  - `connector_type_id` (string)
    The type of connector. This property appears in responses but cannot be set in requests.
  - `frequency` (object)
    - `notify_when` (enum)
      Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
      Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`
    - `summary` (boolean)
      Indicates whether the action is a summary.
    - `throttle` (string · default: null) — nullable
      The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when 'notify_when' is set to 'onThrottleInterval'. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
  - `group` (string)
    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`.
  - `id` (string)
    The identifier for the connector saved object.
  - `params` (map string to object)
    The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context.
  - `use_alert_data_for_template` (boolean)
    Indicates whether to use alert data as a template.
  - `uuid` (string)
    A universally unique identifier (UUID) for the action.
- `alert_delay` (object)
  Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
  - `active` (number)
    The number of consecutive runs that must meet the rule conditions.
- `api_key_created_by_user` (boolean) — nullable
  Indicates whether the API key that is associated with the rule was created by the user.
- `api_key_owner` (string · default: null) — nullable
  The owner of the API key that is associated with the rule and used to run background tasks.
- `artifacts` (object)
  - `dashboards` ([] object)
    - `id` (string)
  - `investigation_guide` (object)
    - `blob` (string)
      User-created content that describes alert causes and remediation.
- `consumer` (string)
  The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
- `created_at` (string)
  The date and time that the rule was created.
- `created_by` (string · default: null) — nullable
  The identifier for the user that created the rule.
- `enabled` (boolean)
  Indicates whether you want the rule to run on an interval basis after it is created.
- `execution_status` (object)
  - `error` (object)
    - `message` (string)
      Error message.
    - `reason` (enum)
      Reason for error.
      Values: `read`, `decrypt`, `execute`, `unknown`, `license`, `timeout`, `disabled`, `validate`
  - `last_duration` (number)
    Duration of last rule execution.
  - `last_execution_date` (string)
    The date and time of the last rule execution.
  - `status` (enum)
    Status of rule execution.
    Values: `ok`, `active`, `error`, `warning`, `pending`, `unknown`
  - `warning` (object)
    - `message` (string)
      Warning message.
    - `reason` (enum)
      Reason for warning.
      Values: `maxExecutableActions`, `maxAlerts`, `maxQueuedActions`, `ruleExecution`
- `flapping` ({})
  - `enabled` (boolean)
    Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
  - `look_back_window` (number · min: 2 · max: 20)
    The minimum number of runs in which the threshold must be met.
  - `status_change_threshold` (number · min: 2 · max: 20)
    The minimum number of times an alert must switch states within the defined look back window time.
- `id` (string)
  The identifier for the rule.
- `last_run` (object) — nullable
  - `alerts_count` (object)
    - `active` (number) — nullable
      Number of active alerts during last run.
    - `ignored` (number) — nullable
      Number of ignored alerts during last run.
    - `new` (number) — nullable
      Number of new alerts during last run.
    - `recovered` (number) — nullable
      Number of recovered alerts during last run.
  - `outcome` (enum)
    Outcome of the last rule run. Value can be succeeded, warning, or failed.
    Values: `succeeded`, `warning`, `failed`
  - `outcome_msg` ([] string) — nullable
  - `outcome_order` (number)
    Order of the outcome.
  - `warning` (enum) — nullable
    Warning of last rule execution.
    Values: `read`, `decrypt`, `execute`, `unknown`, `license`, `timeout`, `disabled`, `validate`, `maxExecutableActions`, `maxAlerts`, `maxQueuedActions`, `ruleExecution`, `null`
- `mapped_params` (map string to object)
- `mute_all` (boolean)
  Indicates whether all alerts are muted.
- `muted_alert_ids` ([] string)
- `name` (string)
   The name of the rule.
- `next_run` (string) — nullable
  Date and time of the next rule run.
- `notify_when` (enum) — nullable
  Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
  Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
- `params` (map string to object)
  The parameters for the rule.
- `revision` (number)
  The rule revision number.
- `rule_type_id` (string)
  The rule type identifier.
- `running` (boolean) — nullable
  Indicates whether the rule is running.
- `schedule` (object)
  - `interval` (string)
    The interval is specified in seconds, minutes, hours, or days.
- `scheduled_task_id` (string)
  Identifier of the scheduled task.
- `tags` ([] string)
- `throttle` (string) — nullable — deprecated
  Deprecated in 8.13.0. Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- `updated_at` (string)
  The date and time of the latest updates to the rule.
- `updated_by` (string · default: null) — nullable
  The identifier for the user who was the last to update the rule.
#### `400`

Indicates an invalid schema or parameters.

#### `403`

Indicates that this call is forbidden.

#### `409`

Indicates that the rule id is already in use.

## Code Examples

#### Console

```console
POST /api/alerting/rule/{id}
{
  "actions": [
    {
      "frequency": {
        "notify_when": "onActiveAlert",
        "summary": false
      },
      "group": "query matched",
      "id": "d0db1fe0-78d6-11ee-9177-f7d404c8c945",
      "params": {
        "level": "info",
        "message": "Elasticsearch query rule \u0027{{rule.name}}\u0027 is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
      }
    }
  ],
  "consumer": "stackAlerts",
  "name": "my Elasticsearch query ESQL rule",
  "params": {
    "esqlQuery": {
      "esql": "FROM kibana_sample_data_logs | KEEP bytes, clientip, host, geo.dest | where geo.dest != \u0022GB\u0022 | STATS sumbytes = sum(bytes) by clientip, host | WHERE sumbytes \u003E 5000 | SORT sumbytes desc | LIMIT 10"
    },
    "searchType": "esqlQuery",
    "size": 0,
    "threshold": [
      0
    ],
    "thresholdComparator": "\u003E",
    "timeField": "@timestamp",
    "timeWindowSize": 1,
    "timeWindowUnit": "d"
  },
  "rule_type_id": ".es-query",
  "schedule": {
    "interval": "1d"
  }
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/alerting/rule/{id}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "actions": [
    {
      "frequency": {
        "notify_when": "onActiveAlert",
        "summary": false
      },
      "group": "query matched",
      "id": "d0db1fe0-78d6-11ee-9177-f7d404c8c945",
      "params": {
        "level": "info",
        "message": "Elasticsearch query rule \u0027{{rule.name}}\u0027 is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
      }
    }
  ],
  "consumer": "stackAlerts",
  "name": "my Elasticsearch query ESQL rule",
  "params": {
    "esqlQuery": {
      "esql": "FROM kibana_sample_data_logs | KEEP bytes, clientip, host, geo.dest | where geo.dest != \u0022GB\u0022 | STATS sumbytes = sum(bytes) by clientip, host | WHERE sumbytes \u003E 5000 | SORT sumbytes desc | LIMIT 10"
    },
    "searchType": "esqlQuery",
    "size": 0,
    "threshold": [
      0
    ],
    "thresholdComparator": "\u003E",
    "timeField": "@timestamp",
    "timeWindowSize": 1,
    "timeWindowUnit": "d"
  },
  "rule_type_id": ".es-query",
  "schedule": {
    "interval": "1d"
  }
}'
```

## Response Examples

#### Elasticsearch query rule (ES|QL)

The response for successfully creating an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL).

```json
{
  "actions": [
    {
      "connector_type_id": ".server-log",
      "frequency": {
        "notify_when": "onActiveAlert",
        "summary": false,
        "throttle": "null"
      },
      "group": "query matched",
      "id": "d0db1fe0-78d6-11ee-9177-f7d404c8c945",
      "params": {
        "level": "info",
        "message": "Elasticsearch query rule \u0027{{rule.name}}\u0027 is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
      },
      "uuid": "bfe370a3-531b-4855-bbe6-ad739f578844"
    }
  ],
  "api_key_created_by_user": false,
  "api_key_owner": "elastic",
  "consumer": "stackAlerts",
  "created_at": "2023-11-01T19:00:10.453Z",
  "created_by": "elastic",
  "enabled": true,
  "execution_status": {
    "last_execution_date": "2023-11-01T19:00:10.453Z",
    "status": "pending"
  },
  "id": "e0d62360-78e8-11ee-9177-f7d404c8c945",
  "mute_all": false,
  "muted_alert_ids": [],
  "name": "my Elasticsearch query ESQL rule",
  "notify_when": "null",
  "params": {
    "aggType": "count",
    "esqlQuery": {
      "esql": "FROM kibana_sample_data_logs | keep bytes, clientip, host, geo.dest | WHERE geo.dest != \u0022GB\u0022 | stats sumbytes = sum(bytes) by clientip, host | WHERE sumbytes \u003E 5000 | sort sumbytes desc | limit 10"
    },
    "excludeHitsFromPreviousRun\u0022": "true,",
    "groupBy": "all",
    "searchType": "esqlQuery",
    "size": 0,
    "threshold": [
      0
    ],
    "thresholdComparator": "\u003E",
    "timeField": "@timestamp",
    "timeWindowSize": 1,
    "timeWindowUnit": "d"
  },
  "revision": 0,
  "rule_type_id": ".es-query",
  "running": false,
  "schedule": {
    "interval": "1d"
  },
  "scheduled_task_id": "e0d62360-78e8-11ee-9177-f7d404c8c945",
  "tags": [],
  "throttle": "null",
  "updated_at": "2023-11-01T19:00:10.453Z",
  "updated_by": "elastic\u0022,"
}
```

#### Elasticsearch query rule (KQL)

The response for successfully creating an Elasticsearch query rule that uses Kibana query language (KQL).

```json
{
  "actions": [],
  "api_key_created_by_user": false,
  "api_key_owner": "elastic",
  "consumer": "alerts",
  "created_at": "2023-07-14T20:24:50.729Z",
  "created_by": "elastic",
  "enabled": true,
  "execution_status": {
    "last_execution_date": "2023-07-14T20:24:50.729Z",
    "status": "pending"
  },
  "id": "7bd506d0-2284-11ee-8fad-6101956ced88",
  "mute_all": false,
  "muted_alert_ids": [],
  "name": "my Elasticsearch query KQL rule\u0022",
  "notify_when": "null",
  "params": {
    "aggType": "count",
    "excludeHitsFromPreviousRun": true,
    "groupBy": "all",
    "searchConfiguration": {
      "index": "90943e30-9a47-11e8-b64d-95841ca0b247",
      "query": {
        "language": "kuery",
        "query": "\u0022\u0022geo.src : \u0022US\u0022 \u0022\u0022"
      }
    },
    "searchType": "searchSource",
    "size": 100,
    "threshold": [
      1000
    ],
    "thresholdComparator": "\u003E",
    "timeWindowSize": 5,
    "timeWindowUnit": "m"
  },
  "revision": 0,
  "rule_type_id": ".es-query",
  "running": false,
  "schedule": {
    "interval": "1m"
  },
  "scheduled_task_id": "7bd506d0-2284-11ee-8fad-6101956ced88",
  "tags": [],
  "throttle": "null",
  "updated_at": "2023-07-14T20:24:50.729Z",
  "updated_by": "elastic"
}
```

#### Elasticsearch query rule (DSL)

The response for successfully creating an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL).

```json
{
  "actions": [
    {
      "connector_type_id": ".server-log",
      "frequency": {
        "notify_when": "onThrottleInterval",
        "summary": true,
        "throttle": "1d"
      },
      "group": "query matched",
      "id": "fdbece50-406c-11ee-850e-c71febc4ca7f",
      "params": {
        "level": "info",
        "message": "The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts."
      },
      "uuid": "53f3c2a3-e5d0-4cfa-af3b-6f0881385e78"
    },
    {
      "connector_type_id": ".server-log",
      "frequency": {
        "notify_when": "onActionGroupChange",
        "summary": false,
        "throttle": "null"
      },
      "group": "recovered",
      "id": "fdbece50-406c-11ee-850e-c71febc4ca7f",
      "params": {
        "level": "info",
        "message": "Recovered"
      },
      "uuid": "2324e45b-c0df-45c7-9d70-4993e30be758"
    }
  ],
  "api_key_created_by_user": false,
  "api_key_owner": "elastic",
  "consumer": "alerts",
  "created_at": "2023-08-22T00:03:38.263Z",
  "created_by": "elastic",
  "enabled": true,
  "execution_status": {
    "last_execution_date": "2023-08-22T00:03:38.263Z",
    "status": "pending"
  },
  "id": "58148c70-407f-11ee-850e-c71febc4ca7f",
  "mute_all": false,
  "muted_alert_ids": [],
  "name": "my Elasticsearch query rule",
  "notify_when": "null",
  "params": {
    "aggType": "count",
    "esQuery": "\u0022\u0022\u0022{\u0022query\u0022:{\u0022match_all\u0022 : {}}}\u0022\u0022\u0022",
    "excludeHitsFromPreviousRun": true,
    "groupBy": "all",
    "index": [
      "kibana_sample_data_logs"
    ],
    "searchType": "esQuery",
    "size": 100,
    "threshold": [
      100
    ],
    "thresholdComparator": "\u003E",
    "timeField": "@timestamp",
    "timeWindowSize": 1,
    "timeWindowUnit": "d"
  },
  "revision": 0,
  "rule_type_id": ".es-query",
  "running": false,
  "schedule": {
    "interval": "1d"
  },
  "scheduled_task_id": "58148c70-407f-11ee-850e-c71febc4ca7f",
  "tags": [],
  "throttle": "null",
  "updated_at": "2023-08-22T00:03:38.263Z",
  "updated_by": "elastic"
}
```

#### Index threshold rule

The response for successfully creating an index threshold rule.

```json
{
  "actions": [
    {
      "connector_type_id": ".server-log",
      "frequency": {
        "notify_when": "onActionGroupChange",
        "summary": false,
        "throttle": "null"
      },
      "group": "threshold met",
      "id": "dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2",
      "params": {
        "level": "info",
        "message": "Rule {{rule.name}} is active for group {{context.group} :\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
      },
      "uuid": "07aef2a0-9eed-4ef9-94ec-39ba58eb609d"
    }
  ],
  "alert_delay": {
    "active": 3
  },
  "api_key_created_by_user": false,
  "api_key_owner": "elastic",
  "consumer": "alerts",
  "created_at": "2022-06-08T17:20:31.632Z",
  "created_by": "elastic",
  "enabled": true,
  "execution_status": {
    "last_execution_date": "2022-06-08T17:20:31.632Z",
    "status": "pending"
  },
  "id": "41893910-6bca-11eb-9e0d-85d233e3ee35",
  "mute_all": false,
  "muted_alert_ids": [],
  "name": "my rule",
  "notify_when": "null",
  "params": {
    "aggField": "sheet.version",
    "aggType": "avg",
    "groupBy": "top",
    "index": [
      ".test-index"
    ],
    "termField": "name.keyword",
    "termSize": 6,
    "threshold": [
      1000
    ],
    "thresholdComparator": "\u003E",
    "timeField": "@timestamp",
    "timeWindowSize": 5,
    "timeWindowUnit": "m"
  },
  "revision": 0,
  "rule_type_id": ".index-threshold",
  "running": false,
  "schedule": {
    "interval": "1m"
  },
  "scheduled_task_id": "425b0800-6bca-11eb-9e0d-85d233e3ee35",
  "tags": [
    "cpu"
  ],
  "throttle": "null",
  "updated_at": "2022-06-08T17:20:31.632Z",
  "updated_by": "elastic"
}
```

#### Tracking containment rule

The response for successfully creating a tracking containment rule.

```json
{
  "actions": [],
  "api_key_created_by_user": false,
  "api_key_owner": "elastic",
  "consumer": "alerts",
  "created_at": "2024-02-14T19:52:55.920Z",
  "created_by": "elastic",
  "enabled": true,
  "execution_status": {
    "last_duration": 74,
    "last_execution_date": "2024-02-15T03:25:38.125Z",
    "status": "ok"
  },
  "id": "b6883f9d-5f70-4758-a66e-369d7c26012f",
  "last_run": {
    "alerts_count": {
      "active": 0,
      "ignored": 0,
      "new": 0,
      "recovered": 0
    },
    "outcome": "succeeded",
    "outcome_msg": "null",
    "outcome_order": 0,
    "warning": "null"
  },
  "mute_all": false,
  "muted_alert_ids": [],
  "name": "my tracking rule",
  "next_run": "2024-02-15T03:26:38.033Z",
  "notify_when": "null",
  "params": {
    "boundaryGeoField": "location",
    "boundaryIndexId": "0cd90abf-abe7-44c7-909a-f621bbbcfefc",
    "boundaryIndexTitle": "boundary*",
    "boundaryNameField": "name",
    "boundaryType": "entireIndex",
    "dateField": "@timestamp",
    "entity": "agent.keyword",
    "geoField": "geo.coordinates",
    "index": "kibana_sample_data_logs",
    "indexId": "90943e30-9a47-11e8-b64d-95841ca0b247"
  },
  "revision": 1,
  "rule_type_id": ".geo-containment",
  "running": false,
  "schedule": {
    "interval": "1h"
  },
  "scheduled_task_id": "b6883f9d-5f70-4758-a66e-369d7c26012f",
  "tags": [],
  "throttle": "null",
  "updated_at": "2024-02-15T03:24:32.574Z",
  "updated_by": "elastic"
}
```