Get rules in bulk
- Base URL
-
https://{kibana_url}
- POST /api/alerting/v2/rules/_bulk_get
- POST /s/{space_id}/api/alerting/v2/rules/_bulk_get
Refer to Spaces for more information.
Required authorization
- Privileges read_alerting-v2-rules
Responses
Returns the requested rules.
-
itemsobjectrequired -
The requested rules, in the same order as the requested ids.
-
artifactsobject · min items: 1 · max items: 100 -
Optional objects attached to the rule, such as a runbook or a dashboard. Each item has
id,type, anddata. The shape ofdatadepends ontype. For example, arunbookusescontentand adashboardusesdashboard_id. Known types are validated against that shape. Unknown types are stored whenid,type, anddataare present. An empty array is rejected: omitartifactson create, or sendnullon PATCH to clear. -
kindrequired -
Whether the rule creates alerts (
alert) or only stores matching events (signal). -
Values:
alertsignal -
metadataobjectrequired -
Rule metadata.
-
builderobject -
Identifies the rule builder that authored this rule (e.g. "threshold"). Absent for rules authored directly in ES|QL; send
nullon PATCH to clear it. -
descriptionstring · min length: 1 · max length: 1024 -
Human-readable description of the rule. Omit to leave it unset; send
nullon PATCH to clear it. An empty string is rejected. -
Routing tags that link alerts from this rule to action policies. An action policy applies when its
matcher.tagscontains at least one of these tags. Only allowed when kind is "alert". -
Tags for categorization, e.g. ["production", "infra"].
-
no_dataoneOf -
What the rule does when a group has no data. Required when
kindisalert. Not allowed whenkindissignal. Any strategy other thanignorerequires eitherquery.breachorno_data.query, so that a group with no data can be told apart from one that stopped breaching. -
queryobjectrequired -
ES|QL query the rule evaluates.
baseis required.breachis an optional clause appended to it. -
recoveryoneOf -
When an alert recovers. Required when
kindisalert. Not allowed whenkindissignal. -
state_transitionobject -
Specifies how many consecutive matches, or how long a condition must hold, before an alert becomes
activeorinactive. Allowed only whenkindisalert. -
pendingobject -
recoveringobject -
time_fieldstring · min length: 1 · max length: 256 · default: @timestamp -
Document field Kibana uses with
schedule.lookbackto time-filterquery.base.
Indicates an invalid schema or parameters.
Indicates the request was not authenticated.
Indicates the user does not have the required privileges to perform the request.
One or more rule ids could not be found.
Indicates an unexpected server-side error.
Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.