Create rules in bulk
- Base URL
-
https://{kibana_url}
- POST /api/alerting/v2/rules/_bulk_create
- POST /s/{space_id}/api/alerting/v2/rules/_bulk_create
Refer to Spaces for more information.
Creates up to 100 rules in a single request. Each item can include a client-supplied id. Kibana generates an identifier when id is omitted. The request succeeds with HTTP 200 even when some rules fail. Created rules are returned in items. Failures are returned in errors. Check errors before treating the request as fully successful. To create a single rule, use POST /api/alerting/v2/rules.
Required authorization
- Privileges manage_alerting-v2-rules
Request body
-
itemsobject · min items: 1 · max items: 100required -
The rules to create. Must contain between 1 and 100 rules.
-
artifactsobject · min items: 1 · max items: 100 -
Optional objects attached to the rule, such as a runbook or a dashboard. Each item has
id,type, anddata. The shape ofdatadepends ontype. For example, arunbookusescontentand adashboardusesdashboard_id. Known types are validated against that shape. Unknown types are stored whenid,type, anddataare present. An empty array is rejected: omitartifactson create, or sendnullon PATCH to clear. -
enabledboolean · default: true -
If
true(default), the rule runs on its schedule after creation. Iffalse, the rule is saved but does not run until you enable it. -
idstring · min length: 1 · max length: 150 · pattern: ^[a-zA-Z0-9_-]+$ -
Optional rule ID. If omitted, Kibana generates one. IDs in the request must be unique.
-
kindrequired -
Whether the rule creates alerts (
alert) or only stores matching events (signal). -
Values:
alertsignal -
metadataobjectrequired -
Rule metadata.
-
builderobject -
Identifies the rule builder that authored this rule (e.g. "threshold"). Absent for rules authored directly in ES|QL; send
nullon PATCH to clear it. -
descriptionstring · min length: 1 · max length: 1024 -
Human-readable description of the rule. Omit to leave it unset; send
nullon PATCH to clear it. An empty string is rejected. -
Routing tags that link alerts from this rule to action policies. An action policy applies when its
matcher.tagscontains at least one of these tags. Only allowed when kind is "alert". -
Tags for categorization, e.g. ["production", "infra"].
-
no_dataoneOf -
What the rule does when a group has no data. Required when
kindisalert. Not allowed whenkindissignal. Any strategy other thanignorerequires eitherquery.breachorno_data.query, so that a group with no data can be told apart from one that stopped breaching. -
queryobjectrequired -
ES|QL query the rule evaluates.
baseis required.breachis an optional clause appended to it. -
recoveryoneOf -
When an alert recovers. Required when
kindisalert. Not allowed whenkindissignal. -
state_transitionobject -
Specifies how many consecutive matches, or how long a condition must hold, before an alert becomes
activeorinactive. Allowed only whenkindisalert. -
pendingobject -
recoveringobject
Responses
Created rules are returned in items. Failures are returned in errors.
-
errorsobjectrequired -
Errors for rules that could not be created. Each entry includes the rule
idand the error. Empty when every requested rule was created. -
itemsobjectrequired -
Rules that were created. Rules listed in
errorsare not included. -
artifactsobject · min items: 1 · max items: 100 -
Optional objects attached to the rule, such as a runbook or a dashboard. Each item has
id,type, anddata. The shape ofdatadepends ontype. For example, arunbookusescontentand adashboardusesdashboard_id. Known types are validated against that shape. Unknown types are stored whenid,type, anddataare present. An empty array is rejected: omitartifactson create, or sendnullon PATCH to clear. -
kindrequired -
Whether the rule creates alerts (
alert) or only stores matching events (signal). -
Values:
alertsignal -
metadataobjectrequired -
Rule metadata.
-
builderobject -
Identifies the rule builder that authored this rule (e.g. "threshold"). Absent for rules authored directly in ES|QL; send
nullon PATCH to clear it. -
descriptionstring · min length: 1 · max length: 1024 -
Human-readable description of the rule. Omit to leave it unset; send
nullon PATCH to clear it. An empty string is rejected. -
Routing tags that link alerts from this rule to action policies. An action policy applies when its
matcher.tagscontains at least one of these tags. Only allowed when kind is "alert". -
Tags for categorization, e.g. ["production", "infra"].
-
no_dataoneOf -
What the rule does when a group has no data. Required when
kindisalert. Not allowed whenkindissignal. Any strategy other thanignorerequires eitherquery.breachorno_data.query, so that a group with no data can be told apart from one that stopped breaching. -
queryobjectrequired -
ES|QL query the rule evaluates.
baseis required.breachis an optional clause appended to it. -
recoveryoneOf -
When an alert recovers. Required when
kindisalert. Not allowed whenkindissignal. -
state_transitionobject -
Specifies how many consecutive matches, or how long a condition must hold, before an alert becomes
activeorinactive. Allowed only whenkindisalert. -
pendingobject -
recoveringobject -
time_fieldstring · min length: 1 · max length: 256 · default: @timestamp -
Document field Kibana uses with
schedule.lookbackto time-filterquery.base.
Indicates an invalid schema or parameters.
Indicates the request was not authenticated.
Indicates the user does not have the required privileges to perform the request.
Indicates an unexpected server-side error.
Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.