Disable rules matching a query (dry-run by default)
https://{kibana_url}
- POST /api/alerting/v2/rules/_disable_by_query
[Required authorization] Route required privileges: manage_alerting-v2-rules.
Request
-
filterstring · min: 1 · max: 4096 -
KQL filter string to match target resources. At most 10000 matching resources are processed per request. Cannot be empty; to target every resource use
match_all: true. -
forceboolean · default: false -
When true, executes the operation. When false (default), returns a dry-run preview with
match_countand asampleof matching resource IDs so the client can verify before committing. -
match_all -
When true, targets every resource. Requires an explicit opt-in. Omitted by default.
-
Values:
true -
searchstring · min: 1 · max: 256 -
Free-text search string matched against the resource-defined searchable fields. Cannot be empty; to target every resource use
match_all: true.
Responses
Returns a dry-run preview by default, or the executed operation when force is true.
Dry-run preview returned by a by-query bulk endpoint when force is false.
-
match_countinteger · min: 0 · max: 9007199254740991required -
Total number of resources matching the query. A dry run never fails on size, but if this exceeds 10000, re-sending the same query with
force: trueis rejected withBULK_QUERY_MATCH_LIMIT_EXCEEDED; narrow the query before executing. -
samplestring · max: 100required -
Sample of matching resource IDs (up to 100) for spot-checking before executing.
Result of an executed bulk operation.
-
affected_countinteger · min: 0 · max: 9007199254740991required -
Number of resources the operation successfully touched.
-
errorsobjectrequired -
Errors encountered during the operation.
-
errorobjectrequired -
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
-
idstringrequired -
The identifier of the resource that failed.
Indicates an invalid schema or parameters.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the request was not authenticated.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the user does not have the required privileges to perform the request.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates an unexpected server-side error.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.