Create a maintenance window.
- Base URL
-
https://{kibana_url}
- POST /api/maintenance_window
- POST /s/{space_id}/api/maintenance_window
Refer to Spaces for more information.
Required authorization
- Privileges write-maintenance-window
Request body
-
enabledboolean -
Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
-
scheduleobjectrequired -
customobjectrequired -
durationstring · max length: 100required -
The duration of the schedule. It allows values in
<integer><unit>format.<unit>is one ofd,h,m, orsfor hours, minutes, seconds. For example:1d,5h,30m,5000s. -
recurringobject -
endstring · max length: 100 -
The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example:
2025-04-01T00:00:00.000Z. -
everystring · max length: 100 -
The interval and frequency of a recurring schedule. It allows values in
<integer><unit>format.<unit>is one ofd,w,M, oryfor days, weeks, months, years. For example:15d,2w,3m,1y. -
onMonthnumber · min items: 1 · max items: 12 -
The specific months for a recurring schedule. Valid values are 1-12.
-
scopeobject -
alertingobject -
Settings that control how this maintenance window affects Alerting V1 alerts, including an optional KQL filter. If you include
scopebut omitalerting, the maintenance window doesn't affect these alerts. -
alerting_v2object -
Settings that control how this maintenance window affects Alerting V2 alerts, including an optional KQL filter. If you omit
alerting_v2, the maintenance window doesn't affect Alerting V2 alerts. -
queryobject -
kqlstring · max length: 4096required -
A KQL filter that limits which Alerting V2 alerts this maintenance window affects. You can filter on
alert_id,alert_status,group_hash,last_event_timestamp,severity, anddata.*. Matching alerts don't send notifications while the window is active. If you omit query, the window affects all Alerting V2 alerts.
Responses
Indicates a successful call.
-
created_bystring · default: nullnullable -
The identifier for the user that created the maintenance window.
-
enabledbooleanrequired -
Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
-
scheduleobjectrequired -
customobjectrequired -
durationstringrequired -
The duration of the schedule. It allows values in
<integer><unit>format.<unit>is one ofd,h,m, orsfor hours, minutes, seconds. For example:1d,5h,30m,5000s. -
recurringobject -
endstring -
The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example:
2025-04-01T00:00:00.000Z. -
everystring -
The interval and frequency of a recurring schedule. It allows values in
<integer><unit>format.<unit>is one ofd,w,M, oryfor days, weeks, months, years. For example:15d,2w,3m,1y. -
scopeobject -
alertingobjectrequired -
Settings that control how this maintenance window affects Alerting V1 alerts, including an optional KQL filter. Always returned when scope is returned. Check
enabledto see whether the maintenance window affects these alerts. -
alerting_v2object -
Settings that control how this maintenance window affects Alerting V2 alerts, including an optional KQL filter. If you omit
alerting_v2, the maintenance window doesn't affect Alerting V2 alerts. -
enabledboolean -
Whether the maintenance window applies to Alerting V2 alerts. If omitted, is treated as
true. -
queryobject -
kqlstring · max length: 4096required -
A KQL filter that limits which Alerting V2 alerts this maintenance window affects. It can filter on
alert_id,alert_status,group_hash,last_event_timestamp,severity, anddata.*. Matching alerts don't send notifications while the window is active. If query isn't returned, the window affects all Alerting V2 alerts.
Indicates an invalid schema or parameters.
Indicates that this call is forbidden.