Disable rules matching a query (dry-run by default)

Base URL: https://{kibana_url}

POST /api/alerting/v2/rules/_disable_by_query
POST /s/{space_id}/api/alerting/v2/rules/_disable_by_query

Refer to Spaces for more information.

Required authorization

Authentication

Header parameters

Request body

Responses

Returns a dry-run preview by default, or the executed operation when force is true.

application/json

Any of:

Dry-run preview returned by a by-query bulk endpoint when force is false.

match_count integer · min: 0 · max: 9007199254740991 required: Total number of resources matching the query. A dry run never fails on size, but if this exceeds 10000, re-sending the same query with force: true is rejected with BULK_QUERY_MATCH_LIMIT_EXCEEDED; narrow the query before executing.
sample string[] · max items: 100 required: Sample of matching resource IDs (up to 100) for spot-checking before executing.

Indicates an invalid schema or parameters.

application/json

Indicates the request was not authenticated.

application/json

Indicates the user does not have the required privileges to perform the request.

application/json

Indicates an unexpected server-side error.

application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/alerting/v2/rules/_disable_by_query
{
  "filter": "tags: production"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/alerting/v2/rules/_disable_by_query" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "filter": "tags: production"
  }'

Generated from the API spec

Response

{
  "match_count": 2,
  "sample": [
    "rule-1",
    "rule-2"
  ]
}

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "": [
        "At least one of filter, search, or match_all must be provided."
      ]
    }
  },
  "error": "Bad Request",
  "message": "At least one of filter, search, or match_all must be provided."
}

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}

Required authorization

Authentication

Header parameters

Request body { }

Responses

Request body