---
type: api
title: Delete rules matching a query (dry-run by default)
description: [Required authorization] Route required privileges: manage_alerting-v2-rules.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-post-alerting-v2-rules-delete-by-query
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-post-alerting-v2-rules-delete-by-query
products:
  - Kibana
---

# Delete rules matching a query (dry-run by default)

Availability: 9.5+

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/alerting/v2/rules/_delete_by_query`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth)

## Description

[Required authorization] Route required privileges: manage_alerting-v2-rules.

## Request Body

`application/json`

- `filter` (string · min: 1 · max: 4096) — optional
  KQL filter string to match target resources. At most 10000 matching resources are processed per request. Cannot be empty; to target every resource use `match_all: true`.
- `force` (boolean · default: false) — optional
  When true, executes the operation. When false (default), returns a dry-run preview with `match_count` and a `sample` of matching resource IDs so the client can verify before committing.
- `match_all` (enum) — optional
  When true, targets every resource. Requires an explicit opt-in. Omitted by default.
  Values: `true`
- `search` (string · min: 1 · max: 256) — optional
  Free-text search string matched against the resource-defined searchable fields. Cannot be empty; to target every resource use `match_all: true`.

## Responses

#### `200`

Returns a dry-run preview by default, or the executed operation when `force` is true.

`application/json`

Any of:
- **Kibana_HTTP_APIs_alerting_bulk_dry_run_response**
  Dry-run preview returned by a by-query bulk endpoint when `force` is false.
  - `match_count` (integer · min: 0 · max: 9007199254740991)
    Total number of resources matching the query. A dry run never fails on size, but if this exceeds 10000, re-sending the same query with `force: true` is rejected with `BULK_QUERY_MATCH_LIMIT_EXCEEDED`; narrow the query before executing.
  - `sample` ([] string · max: 100)
    Sample of matching resource IDs (up to 100) for spot-checking before executing.
- **Kibana_HTTP_APIs_alerting_bulk_operation_response**
  Result of an executed bulk operation.
  - `affected_count` (integer · min: 0 · max: 9007199254740991)
    Number of resources the operation successfully touched.
  - `errors` ([] object)
    Errors encountered during the operation.
    - `error` (object)
      - `code` (string)
        Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
      - `details` (map string to object)
        Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
      - `message` (string)
        A readable explanation of the error. The wording can change without notice. Do not parse this field.
    - `id` (string)
      The identifier of the resource that failed.
#### `400`

Indicates an invalid schema or parameters.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `401`

Indicates the request was not authenticated.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `403`

Indicates the user does not have the required privileges to perform the request.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `500`

Indicates an unexpected server-side error.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `503`

Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
## Code Examples

#### Console

```console
POST /api/alerting/v2/rules/_delete_by_query
{
  "filter": "tags: production"
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/alerting/v2/rules/_delete_by_query" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "filter": "tags: production"
}'
```

## Response Examples

#### Dry-run preview of matching rules; set `force: true` on the request to execute

```json
{
  "match_count": 2,
  "sample": [
    "rule-1",
    "rule-2"
  ]
}
```

#### By-query body omits filter, search, and match_all

```json
{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "": [
        "At least one of filter, search, or match_all must be provided."
      ]
    }
  },
  "error": "Bad Request",
  "message": "At least one of filter, search, or match_all must be provided."
}
```

#### Request was not authenticated

```json
{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}
```

#### Caller lacks required privileges

```json
{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}
```

#### Unexpected server-side error

```json
{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}
```

#### Alerting V2 is disabled

```json
{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}
```