Create an alert
https://{kibana_url}
- POST /api/alerts/alert/{alertId}
- POST /s/{space_id}/api/alerts/alert/{alertId}
Refer to Spaces for more information.
Deprecated in 7.13.0. Use the create rule API instead.
Path Parameters
-
alertIdstringrequired -
An UUID v1 or v4 identifier for the alert. If this parameter is omitted, the identifier is randomly generated.
Request
-
actionsobject -
actionTypeIdstringrequired -
The identifier for the action type.
-
groupstringrequired -
Grouping actions is recommended for escalations for different types of alert instances. If you don't need this functionality, set it to
default. -
idstringrequired -
The ID of the action saved object.
-
paramsobjectrequired -
The map to the
paramsthat the action type will receive.paramsare handled as Mustache templates and passed a default set of context. -
alertTypeIdstringrequired -
The ID of the alert type that you want to call when the alert is scheduled to run.
-
consumerstringrequired -
The name of the application that owns the alert. This name has to match the Kibana feature name, as that dictates the required role-based access control privileges.
-
enabledboolean -
Indicates if you want to run the alert on an interval basis after it is created.
-
namestringrequired -
A name to reference and search.
-
notifyWhenrequired -
The condition for throttling the notification.
-
Values:
onActionGroupChangeonActiveAlertonThrottleInterval -
paramsobjectrequired -
The parameters to pass to the alert type executor
paramsvalue. This will also validate against the alert type params validator, if defined. -
scheduleobjectrequired -
The schedule specifying when this alert should be run. A schedule is structured such that the key specifies the format you wish to use and its value specifies the schedule.
-
intervalstring -
The interval format specifies the interval in seconds, minutes, hours or days at which the alert should run.
-
A list of keywords to reference and search.
-
throttlestring -
How often this alert should fire the same actions. This will prevent the alert from sending out the same notification over and over. For example, if an alert with a schedule of 1 minute stays in a triggered state for 90 minutes, setting a throttle of
10mor1hwill prevent it from sending 90 notifications during this period.
Responses
Indicates a successful call.
-
actionsobject -
alertTypeIdstring -
apiKeyOwnerstringnullable -
createdAtstring -
The date and time that the alert was created.
-
createdBystring -
The identifier for the user that created the alert.
-
enabledboolean -
Indicates whether the alert is currently enabled.
-
executionStatusobject -
lastExecutionDatestring -
statusstring -
idstring -
The identifier for the alert.
-
muteAllboolean -
mutedInstanceIdsstringnullable -
namestring -
The name of the alert.
-
notifyWhenstring -
paramsobject -
scheduledTaskIdstring -
throttlestringnullable -
updatedAtstring -
updatedBystringnullable -
The identifier for the user that updated this alert most recently.
Authorization information is missing or invalid.
-
error -
Values:
Unauthorized -
messagestring -
statusCode -
Values:
401