Create a rule

Base URL: https://{kibana_url}

POST /api/alerting/rule/{id}

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Header parameters

Request body

Any of:

actions object[] · default: []
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the CCR read exceptions rule. These parameters are appropriate when rule_type_id is monitoring_ccr_read_exceptions.
rule_type_id enum required: Values: monitoring_ccr_read_exceptions
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the cluster health rule. These parameters are appropriate when rule_type_id is monitoring_alert_cluster_health.
rule_type_id enum required: Values: monitoring_alert_cluster_health
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the CPU usage rule. These parameters are appropriate when rule_type_id is monitoring_alert_cpu_usage.
rule_type_id enum required: Values: monitoring_alert_cpu_usage
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the disk usage rule. These parameters are appropriate when rule_type_id is monitoring_alert_disk_usage.
rule_type_id enum required: Values: monitoring_alert_disk_usage
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the ES version mismatch rule. These parameters are appropriate when rule_type_id is monitoring_alert_elasticsearch_version_mismatch.
rule_type_id enum required: Values: monitoring_alert_elasticsearch_version_mismatch
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the Kibana version mismatch rule. These parameters are appropriate when rule_type_id is monitoring_alert_kibana_version_mismatch.
rule_type_id enum required: Values: monitoring_alert_kibana_version_mismatch
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the license expiration rule. These parameters are appropriate when rule_type_id is monitoring_alert_license_expiration.
rule_type_id enum required: Values: monitoring_alert_license_expiration
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the logstash version mismatch rule. These parameters are appropriate when rule_type_id is monitoring_alert_logstash_version_mismatch.
rule_type_id enum required: Values: monitoring_alert_logstash_version_mismatch
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the memory usage rule. These parameters are appropriate when rule_type_id is monitoring_alert_jvm_memory_usage.
rule_type_id enum required: Values: monitoring_alert_jvm_memory_usage
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the missing monitoring data rule. These parameters are appropriate when rule_type_id is monitoring_alert_missing_monitoring_data.
rule_type_id enum required: Values: monitoring_alert_missing_monitoring_data
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the nodes changed rule. These parameters are appropriate when rule_type_id is monitoring_alert_nodes_changed.
rule_type_id enum required: Values: monitoring_alert_nodes_changed
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the large shard size rule. These parameters are appropriate when rule_type_id is monitoring_shard_size.
rule_type_id enum required: Values: monitoring_shard_size
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the thread pool search rejections rule. These parameters are appropriate when rule_type_id is monitoring_alert_thread_pool_search_rejections.
rule_type_id enum required: Values: monitoring_alert_thread_pool_search_rejections
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the thread pool write rejections rule. These parameters are appropriate when rule_type_id is monitoring_alert_thread_pool_write_rejections.
rule_type_id enum required: Values: monitoring_alert_thread_pool_write_rejections
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the anomaly detection rule. These parameters are appropriate when rule_type_id is xpack.ml.anomaly_detection_alert".
rule_type_id enum required: Values: xpack.ml.anomaly_detection_alert
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the anomaly detection jobs health rule. These parameters are appropriate when rule_type_id is xpack.ml.anomaly_detection_jobs_health".
rule_type_id enum required: Values: xpack.ml.anomaly_detection_jobs_health
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the degraded docs rule. These parameters are appropriate when rule_type_id is datasetQuality.degradedDocs.
rule_type_id enum required: Values: datasetQuality.degradedDocs
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the ES query rule. These parameters are appropriate when rule_type_id is .es-query.
rule_type_id enum required: Values: .es-query
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the index threshold rule. These parameters are appropriate when rule_type_id is .index-threshold.
rule_type_id enum required: Values: .index-threshold
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the geo containment rule. These parameters are appropriate when rule_type_id is .geo-containment.
rule_type_id enum required: Values: .geo-containment
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the transform health rule. These parameters are appropriate when rule_type_id is transform_health.
rule_type_id enum required: Values: transform_health
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the APM anomaly rule. These parameters are appropriate when rule_type_id is apm.anomaly".
rule_type_id enum required: Values: apm.anomaly
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the error count rule. These parameters are appropriate when rule_type_id is apm.error_rate.
rule_type_id enum required: Values: apm.error_rate
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the transaction error rate rule. These parameters are appropriate when rule_type_id is apm.transaction_error_rate.
rule_type_id enum required: Values: apm.transaction_error_rate
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the transaction duration rule. These parameters are appropriate when rule_type_id is apm.transaction_duration.
rule_type_id enum required: Values: apm.transaction_duration
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the synthetics monitor status rule. These parameters are appropriate when rule_type_id is xpack.synthetics.alerts.monitorStatus.
rule_type_id enum required: Values: xpack.synthetics.alerts.monitorStatus
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the synthetics tls rule. These parameters are appropriate when rule_type_id is xpack.synthetics.alerts.tls.
rule_type_id enum required: Values: xpack.synthetics.alerts.tls
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the uptime monitor status rule. These parameters are appropriate when rule_type_id is xpack.uptime.alerts.monitorStatus.
rule_type_id enum required: Values: xpack.uptime.alerts.monitorStatus
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the uptime tls rule. These parameters are appropriate when rule_type_id is xpack.uptime.alerts.tlsCertificate.
rule_type_id enum required: Values: xpack.uptime.alerts.tlsCertificate
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the uptime duration anomaly rule. These parameters are appropriate when rule_type_id is xpack.uptime.alerts.durationAnomaly.
rule_type_id enum required: Values: xpack.uptime.alerts.durationAnomaly
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the metric inventory threshold rule. These parameters are appropriate when rule_type_id is metrics.alert.inventory.threshold.
rule_type_id enum required: Values: metrics.alert.inventory.threshold
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the metric threshold rule. These parameters are appropriate when rule_type_id is metrics.alert.threshold.
rule_type_id enum required: Values: metrics.alert.threshold
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the custom threshold rule. These parameters are appropriate when rule_type_id is observability.rules.custom_threshold.
rule_type_id enum required: Values: observability.rules.custom_threshold
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params union anyOf required: The parameters for the log threshold rule. These parameters are appropriate when rule_type_id is logs.alert.document.count.; Any of:
rule_type_id enum required: Values: logs.alert.document.count
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params object required: The parameters for the slo burn rate rule. These parameters are appropriate when rule_type_id is slo.rules.burnRate.
rule_type_id enum required: Values: slo.rules.burnRate
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

actions object[] · default: []: Same fields as actions in CCR read exceptions
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
enabled boolean · default: true: Indicates whether you want the rule to run on an interval basis after it is created.
flapping object
name string required: The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params map string to object · default: {}: The parameters for the rule.
rule_type_id string required: The rule type identifier.
schedule object required: The check interval, which specifies how frequently the rule conditions are checked.
tags string[] · default: []: The tags for the rule.
template_id string · max length: 1024: The identifier for the rule template this rule was created from, when known.
throttle string nullable: Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

Responses

Indicates a successful call.

application/json

actions object[] required
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
api_key_created_by_user boolean nullable: Indicates whether the API key that is associated with the rule was created by the user.
api_key_owner string · default: null nullable: The owner of the API key that is associated with the rule and used to run background tasks.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
created_at string required: The date and time that the rule was created.
created_by string · default: null nullable: The identifier for the user that created the rule.
enabled boolean required: Indicates whether you want the rule to run on an interval basis after it is created.
execution_status object required
flapping object
id string required: The identifier for the rule.
last_run object nullable
mapped_params map string to object
mute_all boolean required: Indicates whether all alerts are muted.
muted_alert_ids string[] required
name string required: The name of the rule.
next_run string nullable: Date and time of the next rule run.
notify_when enum nullable: Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval null
params map string to object required: The parameters for the rule.
revision number required: The rule revision number.
rule_type_id string required: The rule type identifier.
running boolean nullable: Indicates whether the rule is running.
schedule object required
scheduled_task_id string: Identifier of the scheduled task.
tags string[] required
throttle string nullable deprecated: Deprecated in 8.13.0. Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
updated_at string required: The date and time of the latest updates to the rule.
updated_by string · default: null nullable: The identifier for the user who was the last to update the rule.

400

Indicates an invalid schema or parameters.

403

Indicates that this call is forbidden.

409

Indicates that the rule id is already in use.