---
type: api
title: Create a rule
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-post-alerting-rule-id
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-post-alerting-rule-id
products:
  - Kibana
---

# Create a rule

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/alerting/rule/{id}`
- `POST` `/s/{space_id}/api/alerting/rule/{id}`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#basicauth)

#### Path Parameters

- `id` (string)
  The identifier for the rule. If it is omitted, an ID is randomly generated.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Request Body

`application/json`

- `actions` ([] object · default: []) — optional
  - `alerts_filter` (object) — optional
    Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.
    - `query` (object) — optional
      - `dsl` (string) — optional
        A filter written in Elasticsearch Query Domain Specific Language (DSL).
      - `filters` ([] object) — required
        A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package.
        - `$state` (object) — optional
          - `store` (enum) — required
            A filter can be either specific to an application context or applied globally.
            Values: `appState`, `globalState`
        - `meta` (map string to object) — required
        - `query` (map string to object) — optional
      - `kql` (string) — required
        A filter written in Kibana Query Language (KQL).
    - `timeframe` (object) — optional
      Defines a period that limits whether the action runs.
      - `days` ([] enum) — required
        Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week.
        Values: `1`, `2`, `3`, `4`, `5`, `6`, `7`
      - `hours` (object) — required
        Defines the range of time in a day that the action can run. If the `start` value is `00:00` and the `end` value is `24:00`, actions be generated all day.
        - `end` (string) — required
          The end of the time frame in 24-hour notation (`hh:mm`).
        - `start` (string) — required
          The start of the time frame in 24-hour notation (`hh:mm`).
      - `timezone` (string) — required
        The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in daylight savings time support and are not recommended.
  - `frequency` (object) — optional
    - `notify_when` (enum) — required
      Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
      Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`
    - `summary` (boolean) — required
      Indicates whether the action is a summary.
    - `throttle` (string) — required — nullable
      The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if `notify_when` is set to `onThrottleInterval`. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
  - `group` (string) — optional
    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`.
  - `id` (string) — required
    The identifier for the connector saved object.
  - `params` (map string to object · default: {}) — optional
    The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context.
  - `use_alert_data_for_template` (boolean) — optional
    Indicates whether to use alert data as a template.
  - `uuid` (string) — optional
    A universally unique identifier (UUID) for the action.
- `alert_delay` (object) — optional
  Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
  - `active` (number) — required
    The number of consecutive runs that must meet the rule conditions.
- `artifacts` (object) — optional
  - `dashboards` ([] object · max: 10) — optional
    - `id` (string) — required
  - `investigation_guide` (object) — optional
    - `blob` (string · max: 10000) — required
- `consumer` (string) — required
  The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
- `enabled` (boolean · default: true) — optional
  Indicates whether you want to run the rule on an interval basis after it is created.
- `flapping` (object) — optional — nullable
  When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.
  - `look_back_window` (number · min: 2 · max: 20) — required
    The minimum number of runs in which the threshold must be met.
  - `status_change_threshold` (number · min: 2 · max: 20) — required
    The minimum number of times an alert must switch states in the look back window.
- `name` (string) — required
  The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
- `notify_when` (enum) — optional — nullable
  Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
  Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`
- `rule_type_id` (string) — required
  The rule type identifier.
- `schedule` (object) — required
  The check interval, which specifies how frequently the rule conditions are checked.
  - `interval` (string) — required
    The interval is specified in seconds, minutes, hours, or days.
- `tags` ([] string · default: []) — optional
  The tags for the rule.
- `throttle` (string) — optional — nullable
  Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
- `params` (union anyOf · default: {}) — optional
  The parameters for the rule.
  - **params_property_apm_anomaly**
    The parameters for the APM anomaly rule. These parameters are appropriate when `rule_type_id` is `apm.rules.anomaly`.
    - `serviceName` (string) — optional
      The service name from APM
    - `transactionType` (string) — optional
      The transaction type from APM
    - `windowSize` (number) — required
      The window size
    - `windowUnit` (enum) — required
      The window size unit
      Values: `m`, `h`, `d`
    - `environment` (string) — required
      The environment from APM
    - `anomalySeverityType` (enum) — required
      The anomaly threshold value
      Values: `critical`, `major`, `minor`, `warning`
  - **params_property_apm_error_count**
    The parameters for the APM error count rule. These parameters are appropriate when `rule_type_id` is `apm.error_rate`.
    - `serviceName` (string) — optional
      The service name from APM
    - `windowSize` (number) — required
      The window size
    - `windowUnit` (enum) — required
      The window size unit
      Values: `m`, `h`, `d`
    - `environment` (string) — required
      The environment from APM
    - `threshold` (number) — required
      The error count threshold value
    - `groupBy` ([] enum  · unique · default: [
  "service.name",
  "service.environment"
]) — optional
      Values: `service.name`, `service.environment`, `transaction.name`, `error.grouping_key`
    - `errorGroupingKey` (string) — optional
  - **params_property_apm_transaction_duration**
    The parameters for the APM transaction duration rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_duration`.
    - `serviceName` (string) — optional
      The service name from APM
    - `transactionType` (string) — optional
      The transaction type from APM
    - `transactionName` (string) — optional
      The transaction name from APM
    - `windowSize` (number) — required
      The window size
    - `windowUnit` (enum) — required
      ç
      Values: `m`, `h`, `d`
    - `environment` (string) — required
    - `threshold` (number) — required
      The latency threshold value
    - `groupBy` ([] enum  · unique · default: [
  "service.name",
  "service.environment",
  "transaction.type"
]) — optional
      Values: `service.name`, `service.environment`, `transaction.type`, `transaction.name`
    - `aggregationType` (enum) — required
      Values: `avg`, `95th`, `99th`
  - **params_property_apm_transaction_error_rate**
    The parameters for the APM transaction error rate rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_error_rate`.
    - `serviceName` (string) — optional
      The service name from APM
    - `transactionType` (string) — optional
      The transaction type from APM
    - `transactionName` (string) — optional
      The transaction name from APM
    - `windowSize` (number) — required
      The window size
    - `windowUnit` (enum) — required
      The window size unit
      Values: `m`, `h`, `d`
    - `environment` (string) — required
      The environment from APM
    - `threshold` (number) — required
      The error rate threshold value
    - `groupBy` ([] enum  · unique · default: [
  "service.name",
  "service.environment",
  "transaction.type"
]) — optional
      Values: `service.name`, `service.environment`, `transaction.type`, `transaction.name`
  - **params_es_query_dsl_rule**
    An Elasticsearch query rule can run a query defined in Elasticsearch Query DSL and compare the number of matches to a configured threshold. These parameters are appropriate when `rule_type_id` is `.es-query`.
    - `aggField` (string) — optional
      The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`.
    - `aggType` (enum aggtype · default: count) — optional
      The type of aggregation to perform.
      Values: `avg`, `count`, `max`, `min`, `sum`
    - `esQuery` (string) — required
      The query definition, which uses Elasticsearch Query DSL.
    - `excludeHitsFromPreviousRun` (boolean) — optional
      Indicates whether to exclude matches from previous runs. If `true`, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.
    - `groupBy` (enum groupby · default: all) — optional
      Indicates whether the aggregation is applied over all documents (`all`) or split into groups (`top`) using a grouping field (`termField`). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to `termSize` number of groups) are checked.
      Values: `all`, `top`
    - `index` (union [] string | string) — required
      The indices to query.
    - `searchType` (enum  · default: esQuery) — optional
      The type of query, in this case a query that uses Elasticsearch Query DSL.
      Values: `esQuery`
    - `size` (integer) — optional
      The number of documents to pass to the configured actions when the threshold condition is met.
    - `termField` (union termfield) — optional
      The names of up to four fields that are used for grouping the aggregation. This property is required when `groupBy` is `top`.
      One of: `string[]` or `string`
    - `termSize` (integer) — optional
      This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
    - `threshold` ([] threshold) — required
      The threshold value that is used with the `thresholdComparator`. If the `thresholdComparator` is `between` or `notBetween`, you must specify the boundary values.
    - `thresholdComparator` (enum thresholdcomparator) — required
      The comparison function for the threshold. For example, "is above", "is above or equals", "is below", "is below or equals", "is between", and "is not between".
      Values: `>`, `>=`, `<`, `<=`, `between`, `notBetween`
    - `timeField` (string) — required
      The field that is used to calculate the time window.
    - `timeWindowSize` (integer) — required
      The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
    - `timeWindowUnit` (enum timewindowunit) — required
      The type of units for the time window: seconds, minutes, hours, or days.
      Values: `s`, `m`, `h`, `d`
  - **params_es_query_esql_rule**
    An Elasticsearch query rule can run an ES|QL query and compare the number of matches to a configured threshold. These parameters are appropriate when `rule_type_id` is `.es-query`.
    - `aggField` (string) — optional
      The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`.
    - `aggType` (enum aggtype · default: count) — optional
      The type of aggregation to perform.
      Values: `avg`, `count`, `max`, `min`, `sum`
    - `esqlQuery` (object) — required
      - `esql` (string) — required
        The query definition, which uses Elasticsearch Query Language.
    - `excludeHitsFromPreviousRun` (boolean) — optional
      Indicates whether to exclude matches from previous runs. If `true`, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.
    - `groupBy` (enum groupby · default: all) — optional
      Indicates whether the aggregation is applied over all documents (`all`) or split into groups (`top`) using a grouping field (`termField`). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to `termSize` number of groups) are checked.
      Values: `all`, `top`
    - `searchType` (enum) — required
      The type of query, in this case a query that uses Elasticsearch Query Language (ES|QL).
      Values: `esqlQuery`
    - `size` (integer) — required
      When `searchType` is `esqlQuery`, this property is required but it does not affect the rule behavior.
    - `termSize` (integer) — optional
      This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
    - `threshold` ([] integer) — required
      The threshold value that is used with the `thresholdComparator`. When `searchType` is `esqlQuery`, this property is required and must be set to zero.
    - `thresholdComparator` (enum) — required
      The comparison function for the threshold. When `searchType` is `esqlQuery`, this property is required and must be set to ">". Since the `threshold` value must be `0`, the result is that an alert occurs whenever the query returns results.
      Values: `>`
    - `timeField` (string) — optional
      The field that is used to calculate the time window.
    - `timeWindowSize` (integer) — required
      The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
    - `timeWindowUnit` (enum timewindowunit) — required
      The type of units for the time window: seconds, minutes, hours, or days.
      Values: `s`, `m`, `h`, `d`
  - **params_es_query_kql_rule**
    An Elasticsearch query rule can run a query defined in KQL or Lucene and compare the number of matches to a configured threshold. These parameters are appropriate when `rule_type_id` is `.es-query`.
    - `aggField` (string) — optional
      The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`.
    - `aggType` (enum aggtype · default: count) — optional
      The type of aggregation to perform.
      Values: `avg`, `count`, `max`, `min`, `sum`
    - `excludeHitsFromPreviousRun` (boolean) — optional
      Indicates whether to exclude matches from previous runs. If `true`, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.
    - `groupBy` (enum groupby · default: all) — optional
      Indicates whether the aggregation is applied over all documents (`all`) or split into groups (`top`) using a grouping field (`termField`). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to `termSize` number of groups) are checked.
      Values: `all`, `top`
    - `searchConfiguration` (object) — optional
      The query definition, which uses KQL or Lucene to fetch the documents from Elasticsearch.
      - `filter` ([] filter) — optional
        - `meta` (object) — optional
          - `alias` (string) — optional — nullable
          - `controlledBy` (string) — optional
          - `disabled` (boolean) — optional
          - `field` (string) — optional
          - `group` (string) — optional
          - `index` (string) — optional
          - `isMultiIndex` (boolean) — optional
          - `key` (string) — optional
          - `negate` (boolean) — optional
          - `params` (object) — optional
          - `type` (string) — optional
          - `value` (string) — optional
        - `query` (object) — optional
        - `$state` (object) — optional
      - `index` (union string | [] string) — optional
        The indices to query.
      - `query` (object) — optional
        - `language` (string) — optional
        - `query` (string) — optional
    - `searchType` (enum) — required
      The type of query, in this case a text-based query that uses KQL or Lucene.
      Values: `searchSource`
    - `size` (integer) — required
      The number of documents to pass to the configured actions when the threshold condition is met.
    - `termField` (union termfield) — optional
      The names of up to four fields that are used for grouping the aggregation. This property is required when `groupBy` is `top`.
      One of: `string[]` or `string`
    - `termSize` (integer) — optional
      This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
    - `threshold` ([] threshold) — required
      The threshold value that is used with the `thresholdComparator`. If the `thresholdComparator` is `between` or `notBetween`, you must specify the boundary values.
    - `thresholdComparator` (enum thresholdcomparator) — required
      The comparison function for the threshold. For example, "is above", "is above or equals", "is below", "is below or equals", "is between", and "is not between".
      Values: `>`, `>=`, `<`, `<=`, `between`, `notBetween`
    - `timeField` (string) — optional
      The field that is used to calculate the time window.
    - `timeWindowSize` (integer) — required
      The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
    - `timeWindowUnit` (enum timewindowunit) — required
      The type of units for the time window: seconds, minutes, hours, or days.
      Values: `s`, `m`, `h`, `d`
  - **params_index_threshold_rule**
    An index threshold rule runs an Elasticsearch query, aggregates field values from documents, compares them to threshold values, and schedules actions to run when the thresholds are met. These parameters are appropriate when `rule_type_id` is `.index-threshold`.
    - `aggField` (string) — optional
      The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`.
    - `aggType` (enum aggtype · default: count) — optional
      The type of aggregation to perform.
      Values: `avg`, `count`, `max`, `min`, `sum`
    - `filterKuery` (string) — optional
      A KQL expression thats limits the scope of alerts.
    - `groupBy` (enum groupby · default: all) — optional
      Indicates whether the aggregation is applied over all documents (`all`) or split into groups (`top`) using a grouping field (`termField`). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to `termSize` number of groups) are checked.
      Values: `all`, `top`
    - `index` ([] string) — required
      The indices to query.
    - `termField` (union termfield) — optional
      The names of up to four fields that are used for grouping the aggregation. This property is required when `groupBy` is `top`.
      One of: `string[]` or `string`
    - `termSize` (integer) — optional
      This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
    - `threshold` ([] threshold) — required
      The threshold value that is used with the `thresholdComparator`. If the `thresholdComparator` is `between` or `notBetween`, you must specify the boundary values.
    - `thresholdComparator` (enum thresholdcomparator) — required
      The comparison function for the threshold. For example, "is above", "is above or equals", "is below", "is below or equals", "is between", and "is not between".
      Values: `>`, `>=`, `<`, `<=`, `between`, `notBetween`
    - `timeField` (string) — required
      The field that is used to calculate the time window.
    - `timeWindowSize` (integer) — required
      The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
    - `timeWindowUnit` (enum timewindowunit) — required
      The type of units for the time window: seconds, minutes, hours, or days.
      Values: `s`, `m`, `h`, `d`
  - **params_property_infra_inventory**
    The parameters for the infrastructure inventory rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.inventory.threshold`.
    - `criteria` ([] object) — optional
      - `metric` (enum) — optional
        Values: `count`, `cpu`, `diskLatency`, `load`, `memory`, `memoryTotal`, `tx`, `rx`, `logRate`, `diskIOReadBytes`, `diskIOWriteBytes`, `s3TotalRequests`, `s3NumberOfObjects`, `s3BucketSize`, `s3DownloadBytes`, `s3UploadBytes`, `rdsConnections`, `rdsQueriesExecuted`, `rdsActiveTransactions`, `rdsLatency`, `sqsMessagesVisible`, `sqsMessagesDelayed`, `sqsMessagesSent`, `sqsMessagesEmpty`, `sqsOldestMessage`, `custom`
      - `timeSize` (number) — optional
      - `timeUnit` (enum) — optional
        Values: `s`, `m`, `h`, `d`
      - `sourceId` (string) — optional
      - `threshold` ([] number) — optional
      - `comparator` (enum) — optional
        Values: `<`, `<=`, `>`, `>=`, `between`, `outside`
      - `customMetric` (object) — optional
        - `type` (enum) — optional
          Values: `custom`
        - `field` (string) — optional
        - `aggregation` (enum) — optional
          Values: `avg`, `max`, `min`, `rate`
        - `id` (string) — optional
        - `label` (string) — optional
      - `warningThreshold` ([] number) — optional
      - `warningComparator` (enum) — optional
        Values: `<`, `<=`, `>`, `>=`, `between`, `outside`
    - `filterQuery` (string) — optional
    - `filterQueryText` (string) — optional
    - `nodeType` (enum) — optional
      Values: `host`, `pod`, `container`, `awsEC2`, `awsS3`, `awsSQS`, `awsRDS`
    - `sourceId` (string) — optional
    - `alertOnNoData` (boolean) — optional
  - **params_property_log_threshold**
  - **params_property_infra_metric_threshold**
    The parameters for the metric threshold rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.threshold`.
    - `criteria` ([] union oneOf) — optional
      - **non count criterion**
        - `threshold` ([] number) — optional
          The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values.
        - `comparator` (enum) — optional
          The comparison function for the threshold. For example, "is above", "is above or equals", "is below", "is below or equals", "is between", and "outside".
          Values: `<`, `<=`, `>`, `>=`, `between`, `outside`
        - `timeUnit` (enum) — optional
          The type of units for the time window: seconds, minutes, hours, or days.
          Values: `s`, `m`, `h`, `d`
        - `timeSize` (number) — optional
          The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
        - `warningThreshold` ([] number) — optional
          The threshold value that is used with the `warningComparator`. If the `warningComparator` is `between`, you must specify the boundary values.
        - `warningComparator` (enum) — optional
          Values: `<`, `<=`, `>`, `>=`, `between`, `outside`
        - `metric` (string) — optional
        - `aggType` (enum) — optional
          Values: `avg`, `max`, `min`, `cardinality`, `rate`, `count`, `sum`, `p95`, `p99`, `custom`
      - **count criterion**
        - `threshold` ([] number) — optional
        - `comparator` (enum) — optional
          Values: `<`, `<=`, `>`, `>=`, `between`, `outside`
        - `timeUnit` (enum) — optional
          The type of units for the time window: seconds, minutes, hours, or days.
          Values: `s`, `m`, `h`, `d`
        - `timeSize` (number) — optional
          The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
        - `warningThreshold` ([] number) — optional
        - `warningComparator` (enum) — optional
          Values: `<`, `<=`, `>`, `>=`, `between`, `outside`
        - `aggType` (enum) — optional
          Values: `count`
      - **custom criterion**
        - `threshold` ([] number) — optional
        - `comparator` (enum) — optional
          Values: `<`, `<=`, `>`, `>=`, `between`, `outside`
        - `timeUnit` (enum) — optional
          The type of units for the time window: seconds, minutes, hours, or days.
          Values: `s`, `m`, `h`, `d`
        - `timeSize` (number) — optional
          The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.
        - `warningThreshold` ([] number) — optional
        - `warningComparator` (enum) — optional
          Values: `<`, `<=`, `>`, `>=`, `between`, `outside`
        - `aggType` (enum) — optional
          Values: `custom`
        - `customMetric` ([] union oneOf) — optional
          - **{ field }**
            - `name` (string) — optional
            - `aggType` (enum) — optional
              An aggregation to gather data for the rule. For example, find the average, highest or lowest value of a numeric field. Or use a cardinality aggregation to find the approximate number of unique values in a field.
              Values: `avg`, `sum`, `max`, `min`, `cardinality`
            - `field` (string) — optional
          - **aggType: count**
            - `name` (string) — optional
            - `aggType` (enum) — optional
              Values: `count`
            - `filter` (string) — optional
        - `equation` (string) — optional
        - `label` (string) — optional
    - `groupBy` (union string | [] string) — optional
      Create an alert for every unique value of the specified fields. For example, you can create a rule per host or every mount point of each host.
IMPORTANT: If you include the same field in both the `filterQuery` and `groupBy`, you might receive fewer results than you expect. For example, if you filter by `cloud.region: us-east`, grouping by `cloud.region` will have no effect because the filter query can match only one region.
    - `filterQuery` (string) — optional
      A query that limits the scope of the rule. The rule evaluates only metric data that matches the query.
    - `sourceId` (string) — optional
    - `alertOnNoData` (boolean) — optional
      If true, an alert occurs if the metrics do not report any data over the expected period or if the query fails.
    - `alertOnGroupDisappear` (boolean) — optional
      If true, an alert occurs if a group that previously reported metrics does not report them again over the expected time period. This check is not recommended for dynamically scaling infrastructures that might rapidly start and stop nodes automatically.
  - **params_property_slo_burn_rate**
    The parameters for the SLO burn rate rule. These parameters are appropriate when `rule_type_id` is `slo.rules.burnRate`.
    - `sloId` (string) — optional
      The SLO identifier used by the rule
    - `burnRateThreshold` (number) — optional
      The burn rate threshold used to trigger the alert
    - `maxBurnRateThreshold` (number) — optional
      The maximum burn rate threshold value defined by the SLO error budget
    - `longWindow` (object) — optional
      The duration of the long window used to compute the burn rate
      - `value` (number) — optional
        The duration value
      - `unit` (string) — optional
        The duration unit
    - `shortWindow` (object) — optional
      The duration of the short window used to compute the burn rate
      - `value` (number) — optional
        The duration value
      - `unit` (string) — optional
        The duration unit
  - **params_property_synthetics_uptime_tls**
    The parameters for the synthetics TLS certificate rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.tls`.
    - `search` (string) — optional
    - `certExpirationThreshold` (number) — optional
    - `certAgeThreshold` (number) — optional
  - **params_property_synthetics_monitor_status**
    The parameters for the Synthetics monitor status rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.monitorStatus`.
    - `availability` (object) — optional
      - `range` (number) — optional
      - `rangeUnit` (string) — optional
      - `threshold` (string) — optional
    - `filters` (union oneOf) — optional
      - **string**
      - **{ monitor.type, observer.geo.name, tags, … }**
        - `monitor.type` ([] string) — optional
        - `observer.geo.name` ([] string) — optional
        - `tags` ([] string) — optional
        - `url.port` ([] string) — optional
    - `locations` ([] string) — optional — deprecated
    - `numTimes` (number) — required
    - `search` (string) — optional
    - `shouldCheckStatus` (boolean) — required
    - `shouldCheckAvailability` (boolean) — required
    - `timerangeCount` (number) — optional
    - `timerangeUnit` (string) — optional
    - `timerange` (object) — optional — deprecated
      - `from` (string) — optional
      - `to` (string) — optional
    - `version` (number) — optional
    - `isAutoGenerated` (boolean) — optional

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `actions` ([] object)
  - `alerts_filter` (object)
    Defines a period that limits whether the action runs.
    - `query` (object)
      - `dsl` (string)
        A filter written in Elasticsearch Query Domain Specific Language (DSL).
      - `filters` ([] object)
        A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package.
        - `$state` (object)
          - `store` (enum)
            A filter can be either specific to an application context or applied globally.
            Values: `appState`, `globalState`
        - `meta` (map string to object)
        - `query` (map string to object)
      - `kql` (string)
        A filter written in Kibana Query Language (KQL).
    - `timeframe` (object)
      - `days` ([] enum)
        Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week.
        Values: `1`, `2`, `3`, `4`, `5`, `6`, `7`
      - `hours` (object)
        - `end` (string)
          The end of the time frame in 24-hour notation (`hh:mm`).
        - `start` (string)
          The start of the time frame in 24-hour notation (`hh:mm`).
      - `timezone` (string)
        The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in daylight savings time support and are not recommended.
  - `connector_type_id` (string)
    The type of connector. This property appears in responses but cannot be set in requests.
  - `frequency` (object)
    - `notify_when` (enum)
      Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
      Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`
    - `summary` (boolean)
      Indicates whether the action is a summary.
    - `throttle` (string) — nullable
      The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if 'notify_when' is set to 'onThrottleInterval'. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
  - `group` (string)
    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`.
  - `id` (string)
    The identifier for the connector saved object.
  - `params` (map string to object)
    The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context.
  - `use_alert_data_for_template` (boolean)
    Indicates whether to use alert data as a template.
  - `uuid` (string)
    A universally unique identifier (UUID) for the action.
- `active_snoozes` ([] string)
- `alert_delay` (object)
  Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
  - `active` (number)
    The number of consecutive runs that must meet the rule conditions.
- `api_key_created_by_user` (boolean) — nullable
  Indicates whether the API key that is associated with the rule was created by the user.
- `api_key_owner` (string) — nullable
  The owner of the API key that is associated with the rule and used to run background tasks.
- `artifacts` (object)
  - `dashboards` ([] object)
    - `id` (string)
  - `investigation_guide` (object)
    - `blob` (string)
      User-created content that describes alert causes and remdiation.
- `consumer` (string)
  The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
- `created_at` (string)
  The date and time that the rule was created.
- `created_by` (string) — nullable
  The identifier for the user that created the rule.
- `enabled` (boolean)
  Indicates whether you want to run the rule on an interval basis after it is created.
- `execution_status` (object)
  - `error` (object)
    - `message` (string)
      Error message.
    - `reason` (enum)
      Reason for error.
      Values: `read`, `decrypt`, `execute`, `unknown`, `license`, `timeout`, `disabled`, `validate`
  - `last_duration` (number)
    Duration of last execution of the rule.
  - `last_execution_date` (string)
    The date and time when rule was executed last.
  - `status` (enum)
    Status of rule execution.
    Values: `ok`, `active`, `error`, `warning`, `pending`, `unknown`
  - `warning` (object)
    - `message` (string)
      Warning message.
    - `reason` (enum)
      Reason for warning.
      Values: `maxExecutableActions`, `maxAlerts`, `maxQueuedActions`, `ruleExecution`
- `flapping` (object) — nullable
  When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.
  - `look_back_window` (number · min: 2 · max: 20)
    The minimum number of runs in which the threshold must be met.
  - `status_change_threshold` (number · min: 2 · max: 20)
    The minimum number of times an alert must switch states in the look back window.
- `id` (string)
  The identifier for the rule.
- `is_snoozed_until` (string) — nullable
  The date when the rule will no longer be snoozed.
- `last_run` (object) — nullable
  - `alerts_count` (object)
    - `active` (number) — nullable
      Number of active alerts during last run.
    - `ignored` (number) — nullable
      Number of ignored alerts during last run.
    - `new` (number) — nullable
      Number of new alerts during last run.
    - `recovered` (number) — nullable
      Number of recovered alerts during last run.
  - `outcome` (enum)
    Outcome of last run of the rule. Value could be succeeded, warning or failed.
    Values: `succeeded`, `warning`, `failed`
  - `outcome_msg` ([] string) — nullable
  - `outcome_order` (number)
    Order of the outcome.
  - `warning` (enum) — nullable
    Warning of last rule execution.
    Values: `read`, `decrypt`, `execute`, `unknown`, `license`, `timeout`, `disabled`, `validate`, `maxExecutableActions`, `maxAlerts`, `maxQueuedActions`, `ruleExecution`
- `mapped_params` (map string to object)
- `monitoring` (object)
  Monitoring details of the rule.
  - `run` (object)
    Rule run details.
    - `calculated_metrics` (object)
      Calculation of different percentiles and success ratio.
      - `p50` (number)
      - `p95` (number)
      - `p99` (number)
      - `success_ratio` (number)
    - `history` ([] object)
      History of the rule run.
      - `duration` (number)
        Duration of the rule run.
      - `outcome` (enum)
        Outcome of last run of the rule. Value could be succeeded, warning or failed.
        Values: `succeeded`, `warning`, `failed`
      - `success` (boolean)
        Indicates whether the rule run was successful.
      - `timestamp` (number)
        Time of rule run.
    - `last_run` (object)
      - `metrics` (object)
        - `duration` (number)
          Duration of most recent rule run.
        - `gap_duration_s` (number) — nullable
          Duration in seconds of rule run gap.
        - `gap_range` (object) — nullable
          - `gte` (string)
            End of the gap range.
          - `lte` (string)
            Start of the gap range.
        - `total_alerts_created` (number) — nullable
          Total number of alerts created during last rule run.
        - `total_alerts_detected` (number) — nullable
          Total number of alerts detected during last rule run.
        - `total_indexing_duration_ms` (number) — nullable
          Total time spent indexing documents during last rule run in milliseconds.
        - `total_search_duration_ms` (number) — nullable
          Total time spent performing Elasticsearch searches as measured by Kibana; includes network latency and time spent serializing or deserializing the request and response.
      - `timestamp` (string)
        Time of the most recent rule run.
- `mute_all` (boolean)
  Indicates whether all alerts are muted.
- `muted_alert_ids` ([] string)
- `name` (string)
   The name of the rule.
- `next_run` (string) — nullable
  Date and time of the next run of the rule.
- `notify_when` (enum) — nullable
  Indicates how often alerts generate actions. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify `notify_when` at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
  Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`
- `params` (map string to object)
  The parameters for the rule.
- `revision` (number)
  The rule revision number.
- `rule_type_id` (string)
  The rule type identifier.
- `running` (boolean) — nullable
  Indicates whether the rule is running.
- `schedule` (object)
  - `interval` (string)
    The interval is specified in seconds, minutes, hours, or days.
- `scheduled_task_id` (string)
  Identifier of the scheduled task.
- `snooze_schedule` ([] object)
  - `duration` (number)
    Duration of the rule snooze schedule.
  - `id` (string)
    Identifier of the rule snooze schedule.
  - `rRule` (object)
    - `byhour` ([] number) — nullable
    - `byminute` ([] number) — nullable
    - `bymonth` ([] number) — nullable
    - `bymonthday` ([] number) — nullable
    - `bysecond` ([] number) — nullable
    - `bysetpos` ([] number) — nullable
    - `byweekday` ([] number | string) — nullable
    - `byweekno` ([] number) — nullable
    - `byyearday` ([] number) — nullable
    - `count` (number)
      Number of times the rule should recur until it stops.
    - `dtstart` (string)
      Rule start date in Coordinated Universal Time (UTC).
    - `freq` (enum)
      Indicates frequency of the rule. Options are YEARLY, MONTHLY, WEEKLY, DAILY.
      Values: `0`, `1`, `2`, `3`, `4`, `5`, `6`
    - `interval` (number)
      Indicates the interval of frequency. For example, 1 and YEARLY is every 1 year, 2 and WEEKLY is every 2 weeks.
    - `tzid` (string)
      Indicates timezone abbreviation.
    - `until` (string)
      Recur the rule until this date.
    - `wkst` (enum)
      Indicates the start of week, defaults to Monday.
      Values: `MO`, `TU`, `WE`, `TH`, `FR`, `SA`, `SU`
  - `skipRecurrences` ([] string)
- `tags` ([] string)
- `throttle` (string) — nullable — deprecated
  Deprecated in 8.13.0. Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
- `updated_at` (string)
  The date and time that the rule was updated most recently.
- `updated_by` (string) — nullable
  The identifier for the user that updated this rule most recently.
- `view_in_app_relative_url` (string) — nullable
  Relative URL to view rule in the app.
#### `400`

Indicates an invalid schema or parameters.

#### `403`

Indicates that this call is forbidden.

#### `409`

Indicates that the rule id is already in use.

## Code Examples

#### Console

```console
POST /api/alerting/rule/{id}
{
  "name": "my Elasticsearch query ESQL rule",
  "params": {
    "searchType": "esqlQuery",
    "esqlQuery": {
      "esql": "FROM kibana_sample_data_logs | KEEP bytes, clientip, host, geo.dest | where geo.dest != \u0022GB\u0022 | STATS sumbytes = sum(bytes) by clientip, host | WHERE sumbytes \u003E 5000 | SORT sumbytes desc | LIMIT 10"
    },
    "timeField": "@timestamp",
    "timeWindowSize": 1,
    "timeWindowUnit": "d",
    "size": 0,
    "thresholdComparator": "\u003E",
    "threshold": [
      0
    ]
  },
  "consumer": "stackAlerts",
  "rule_type_id": ".es-query",
  "schedule": {
    "interval": "1d"
  },
  "actions": [
    {
      "group": "query matched",
      "id": "d0db1fe0-78d6-11ee-9177-f7d404c8c945",
      "params": {
        "level": "info",
        "message": "Elasticsearch query rule \u0027{{rule.name}}\u0027 is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
      },
      "frequency": {
        "summary": false,
        "notify_when": "onActiveAlert"
      }
    }
  ]
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/alerting/rule/{id}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "my Elasticsearch query ESQL rule",
  "params": {
    "searchType": "esqlQuery",
    "esqlQuery": {
      "esql": "FROM kibana_sample_data_logs | KEEP bytes, clientip, host, geo.dest | where geo.dest != \u0022GB\u0022 | STATS sumbytes = sum(bytes) by clientip, host | WHERE sumbytes \u003E 5000 | SORT sumbytes desc | LIMIT 10"
    },
    "timeField": "@timestamp",
    "timeWindowSize": 1,
    "timeWindowUnit": "d",
    "size": 0,
    "thresholdComparator": "\u003E",
    "threshold": [
      0
    ]
  },
  "consumer": "stackAlerts",
  "rule_type_id": ".es-query",
  "schedule": {
    "interval": "1d"
  },
  "actions": [
    {
      "group": "query matched",
      "id": "d0db1fe0-78d6-11ee-9177-f7d404c8c945",
      "params": {
        "level": "info",
        "message": "Elasticsearch query rule \u0027{{rule.name}}\u0027 is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
      },
      "frequency": {
        "summary": false,
        "notify_when": "onActiveAlert"
      }
    }
  ]
}'
```

## Response Examples

#### Elasticsearch query rule (ES|QL)

The response for successfully creating an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL).

```json
{
  "id": "e0d62360-78e8-11ee-9177-f7d404c8c945",
  "enabled": true,
  "name": "my Elasticsearch query ESQL rule",
  "tags": [],
  "rule_type_id": ".es-query",
  "consumer": "stackAlerts",
  "schedule": {
    "interval": "1d"
  },
  "actions": [
    {
      "group": "query matched",
      "id": "d0db1fe0-78d6-11ee-9177-f7d404c8c945",
      "params": {
        "level": "info",
        "message": "Elasticsearch query rule \u0027{{rule.name}}\u0027 is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
      },
      "connector_type_id": ".server-log",
      "frequency": {
        "summary": false,
        "notify_when": "onActiveAlert",
        "throttle": "null"
      },
      "uuid": "bfe370a3-531b-4855-bbe6-ad739f578844"
    }
  ],
  "params": {
    "searchType": "esqlQuery",
    "esqlQuery": {
      "esql": "FROM kibana_sample_data_logs | keep bytes, clientip, host, geo.dest | WHERE geo.dest != \u0022GB\u0022 | stats sumbytes = sum(bytes) by clientip, host | WHERE sumbytes \u003E 5000 | sort sumbytes desc | limit 10"
    },
    "timeField": "@timestamp",
    "timeWindowSize": 1,
    "timeWindowUnit": "d",
    "size": 0,
    "thresholdComparator": "\u003E",
    "threshold": [
      0
    ],
    "excludeHitsFromPreviousRun\u0022": "true,",
    "aggType": "count",
    "groupBy": "all"
  },
  "scheduled_task_id": "e0d62360-78e8-11ee-9177-f7d404c8c945",
  "created_by": "elastic",
  "updated_by": "elastic\u0022,",
  "created_at": "2023-11-01T19:00:10.453Z",
  "updated_at": "2023-11-01T19:00:10.453Z",
  "api_key_owner": "elastic",
  "api_key_created_by_user": false,
  "throttle": "null",
  "mute_all": false,
  "notify_when": "null",
  "muted_alert_ids": [],
  "execution_status": {
    "status": "pending",
    "last_execution_date": "2023-11-01T19:00:10.453Z"
  },
  "revision": 0,
  "running": false
}
```

#### Elasticsearch query rule (DSL)

The response for successfully creating an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL).

```json
{
  "id": "58148c70-407f-11ee-850e-c71febc4ca7f",
  "enabled": true,
  "name": "my Elasticsearch query rule",
  "tags": [],
  "rule_type_id": ".es-query",
  "consumer": "alerts",
  "schedule": {
    "interval": "1d"
  },
  "actions": [
    {
      "group": "query matched",
      "id": "fdbece50-406c-11ee-850e-c71febc4ca7f",
      "params": {
        "level": "info",
        "message": "The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts."
      },
      "connector_type_id": ".server-log",
      "frequency": {
        "summary": true,
        "notify_when": "onThrottleInterval",
        "throttle": "1d"
      },
      "uuid": "53f3c2a3-e5d0-4cfa-af3b-6f0881385e78"
    },
    {
      "group": "recovered",
      "id": "fdbece50-406c-11ee-850e-c71febc4ca7f",
      "params": {
        "level": "info",
        "message": "Recovered"
      },
      "connector_type_id": ".server-log",
      "frequency": {
        "summary": false,
        "notify_when": "onActionGroupChange",
        "throttle": "null"
      },
      "uuid": "2324e45b-c0df-45c7-9d70-4993e30be758"
    }
  ],
  "params": {
    "thresholdComparator": "\u003E",
    "timeWindowSize": 1,
    "timeWindowUnit": "d",
    "threshold": [
      100
    ],
    "size": 100,
    "timeField": "@timestamp",
    "index": [
      "kibana_sample_data_logs"
    ],
    "esQuery": "\u0022\u0022\u0022{\u0022query\u0022:{\u0022match_all\u0022 : {}}}\u0022\u0022\u0022",
    "excludeHitsFromPreviousRun": true,
    "aggType": "count",
    "groupBy": "all",
    "searchType": "esQuery"
  },
  "scheduled_task_id": "58148c70-407f-11ee-850e-c71febc4ca7f",
  "created_by": "elastic",
  "updated_by": "elastic",
  "created_at": "2023-08-22T00:03:38.263Z",
  "updated_at": "2023-08-22T00:03:38.263Z",
  "api_key_owner": "elastic",
  "api_key_created_by_user": false,
  "throttle": "null",
  "mute_all": false,
  "notify_when": "null",
  "muted_alert_ids": [],
  "execution_status": {
    "status": "pending",
    "last_execution_date": "2023-08-22T00:03:38.263Z"
  },
  "revision": 0,
  "running": false
}
```

#### Elasticsearch query rule (KQL)

The response for successfully creating an Elasticsearch query rule that uses Kibana query language (KQL).

```json
{
  "id": "7bd506d0-2284-11ee-8fad-6101956ced88",
  "enabled": true,
  "name": "my Elasticsearch query KQL rule\u0022",
  "tags": [],
  "rule_type_id": ".es-query",
  "consumer": "alerts",
  "schedule": {
    "interval": "1m"
  },
  "actions": [],
  "params": {
    "searchConfiguration": {
      "query": {
        "query": "\u0022\u0022geo.src : \u0022US\u0022 \u0022\u0022",
        "language": "kuery"
      },
      "index": "90943e30-9a47-11e8-b64d-95841ca0b247"
    },
    "searchType": "searchSource",
    "timeWindowSize": 5,
    "timeWindowUnit": "m",
    "threshold": [
      1000
    ],
    "thresholdComparator": "\u003E",
    "size": 100,
    "aggType": "count",
    "groupBy": "all",
    "excludeHitsFromPreviousRun": true
  },
  "created_by": "elastic",
  "updated_by": "elastic",
  "created_at": "2023-07-14T20:24:50.729Z",
  "updated_at": "2023-07-14T20:24:50.729Z",
  "api_key_owner": "elastic",
  "api_key_created_by_user": false,
  "throttle": "null",
  "notify_when": "null",
  "mute_all": false,
  "muted_alert_ids": [],
  "scheduled_task_id": "7bd506d0-2284-11ee-8fad-6101956ced88",
  "execution_status": {
    "status": "pending",
    "last_execution_date": "2023-07-14T20:24:50.729Z"
  },
  "revision": 0,
  "running": false
}
```

#### Index threshold rule

The response for successfully creating an index threshold rule.

```json
{
  "actions": [
    {
      "group": "threshold met",
      "id": "dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2",
      "uuid": "07aef2a0-9eed-4ef9-94ec-39ba58eb609d",
      "connector_type_id": ".server-log",
      "frequency": {
        "notify_when": "onActionGroupChange",
        "summary": false,
        "throttle": "null"
      },
      "params": {
        "level": "info",
        "message": "Rule {{rule.name}} is active for group {{context.group} :\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
      }
    }
  ],
  "alert_delay": {
    "active": 3
  },
  "api_key_created_by_user": false,
  "api_key_owner": "elastic",
  "consumer": "alerts",
  "created_at": "2022-06-08T17:20:31.632Z",
  "created_by": "elastic",
  "enabled": true,
  "execution_status": {
    "last_execution_date": "2022-06-08T17:20:31.632Z",
    "status": "pending"
  },
  "id": "41893910-6bca-11eb-9e0d-85d233e3ee35",
  "muted_alert_ids": [],
  "mute_all": false,
  "name": "my rule",
  "notify_when": "null",
  "params": {
    "aggType": "avg",
    "termSize": 6,
    "thresholdComparator": "\u003E",
    "timeWindowSize": 5,
    "timeWindowUnit": "m",
    "groupBy": "top",
    "threshold": [
      1000
    ],
    "index": [
      ".test-index"
    ],
    "timeField": "@timestamp",
    "aggField": "sheet.version",
    "termField": "name.keyword"
  },
  "revision": 0,
  "rule_type_id": ".index-threshold",
  "running": false,
  "schedule": {
    "interval": "1m"
  },
  "scheduled_task_id": "425b0800-6bca-11eb-9e0d-85d233e3ee35",
  "tags": [
    "cpu"
  ],
  "throttle": "null",
  "updated_at": "2022-06-08T17:20:31.632Z",
  "updated_by": "elastic"
}
```

#### Tracking containment rule

The response for successfully creating a tracking containment rule.

```json
{
  "id": "b6883f9d-5f70-4758-a66e-369d7c26012f",
  "name": "my tracking rule",
  "tags": [],
  "enabled": true,
  "consumer": "alerts",
  "throttle": "null",
  "revision": 1,
  "running": false,
  "schedule": {
    "interval": "1h"
  },
  "params": {
    "index": "kibana_sample_data_logs",
    "dateField": "@timestamp",
    "geoField": "geo.coordinates",
    "entity": "agent.keyword",
    "boundaryType": "entireIndex",
    "boundaryIndexTitle": "boundary*",
    "boundaryGeoField": "location",
    "boundaryNameField": "name",
    "indexId": "90943e30-9a47-11e8-b64d-95841ca0b247",
    "boundaryIndexId": "0cd90abf-abe7-44c7-909a-f621bbbcfefc"
  },
  "rule_type_id": ".geo-containment",
  "created_by": "elastic",
  "updated_by": "elastic",
  "created_at": "2024-02-14T19:52:55.920Z",
  "updated_at": "2024-02-15T03:24:32.574Z",
  "api_key_owner": "elastic",
  "notify_when": "null",
  "mute_all": false,
  "muted_alert_ids": [],
  "scheduled_task_id": "b6883f9d-5f70-4758-a66e-369d7c26012f",
  "execution_status": {
    "status": "ok",
    "last_execution_date": "2024-02-15T03:25:38.125Z",
    "last_duration": 74
  },
  "actions": [],
  "last_run": {
    "alerts_count": {
      "active": 0,
      "new": 0,
      "recovered": 0,
      "ignored": 0
    },
    "outcome_msg": "null",
    "outcome_order": 0,
    "outcome": "succeeded",
    "warning": "null"
  },
  "next_run": "2024-02-15T03:26:38.033Z",
  "api_key_created_by_user": false
}
```