Partially update an action policy.
- Base URL
-
https://{kibana_url}
Refer to Spaces for more information.
Apply a partial update. A field you omit keeps its stored value, and that applies at every level: send {"matcher": {"tags": ["prod"]}} to change one leaf while leaving its siblings alone. Send null to clear a field, again at any level: {"matcher": {"expression": null}} clears a single leaf, while {"matcher": null} clears a whole object. Lists and variant objects are replaced as a unit rather than merged, since a partly-sent variant could never be valid. The merged result is validated as a whole, so a patch that would leave the resource invalid is rejected with a 400 and nothing is stored.
Required authorization
- Privileges manage_alerting-v2-action-policies and read_alerting-v2-rules
Path parameters
-
idstring · min length: 1 · max length: 150 · pattern: ^[a-zA-Z0-9_-]+$required -
The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alerts recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.
Request body
-
descriptionstring · min length: 1 · max length: 1024nullable -
A description of the action policy. Absent when the policy has none; send
nullon PATCH to clear it. -
destinationsoneOf · min items: 1 · max items: 10 -
The list of destinations. At least one is required.
-
groupingunion -
How matched alerts are batched into notifications. Absent falls back to
per_alert; sendnullon PATCH to clear it. The mode decides the rest of the block, so a PATCH replaces it whole: send the complete mode variant rather than a single field. -
matcherobjectnullable -
Selects the alerts this policy applies to. Set
tagsto match alerts from rules with those routing tags. Setexpressionto a KQL query, which will be evaluated against each alert.
If you set bothtagsandexpression, an alert must match the tags and the expression for the policy to apply. Omitmatcherto keep the stored matcher, or set it tonullfor a catch-all policy that applies to all alerts. An emptymatchernames no leaf and so changes nothing; clearing the last oftagsandexpressionclears the matcher itself, which is also a catch-all. -
expressionstring · min length: 1 · max length: 4096nullable -
A KQL query that's evaluated against each alert. Supported fields are:
alert_id,alert_status,group_hash,last_event_timestamp,severity, and your rule's query output columns underdata.*(for example,data.host.name). Referencing other fields won't work. Omitmatcher.expressionto keep the stored expression, or set it tonullto clear it and match ontagsalone. -
Routing tags this policy should match. The policy applies to alerts from any rule whose
metadata.routing_tagsinclude at least one of these tags. An empty array is not accepted. Omitmatcher.tagsto keep the stored tags, or set it tonullto clear them and match onmatcher.expressionalone.
Responses
Returns the updated action policy.
-
matcherobject -
Selects the alerts this policy applies to. Set
tagsto match alerts from rules with those routing tags. Setexpressionto a KQL query, which will be evaluated against each alert.
If you set bothtagsandexpression, an alert must match the tags and the expression for the policy to apply. At least one oftagsandexpressionmust be set, so an emptymatcheris rejected. Omitmatcherentirely for a catch-all policy that applies to all alerts. -
expressionstring · min length: 1 · max length: 4096 -
A KQL query that's evaluated against each alert. Supported fields are:
alert_id,alert_status,group_hash,last_event_timestamp,severity, and your rule's query output columns underdata.*(for example,data.host.name). Referencing other fields won't work. Omitmatcher.expressionto match ontagsalone. -
Routing tags this policy should match. The policy applies to alerts from any rule whose
metadata.routing_tagsinclude at least one of these tags. An empty array is not accepted. Omitmatcher.tagsto match onmatcher.expressionalone. -
snoozed_untilstring -
The ISO datetime until which the policy is snoozed. Omitted when the policy is not snoozed.
Indicates an invalid schema or parameters.
Indicates the request was not authenticated.
Indicates the user does not have the required privileges, or the current license does not support action policies. Creating, updating, and enabling action policies requires an active Enterprise license.
Indicates an action policy with the given ID does not exist.
Indicates the action policy was concurrently updated by another caller.
Indicates an unexpected server-side error.
Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.