Create rules in bulk
- Base URL
-
https://{kibana_url}
- POST /api/alerting/v2/rules/_bulk_create
Creates up to 100 rules in a single request. Each item can include a client-supplied id. Kibana generates an identifier when id is omitted. The request succeeds with HTTP 200 even when some rules fail. Created rules are returned in rules. Failures are returned in errors. Check errors before treating the request as fully successful. To create a single rule, use POST /api/alerting/v2/rules.
Required authorization
- Privileges manage_alerting-v2-rules
Request body
-
rulesobject · min items: 1 · max items: 100required -
The rules to create. Must contain between 1 and 100 rules.
-
artifactsobject · max items: 100 -
Optional objects attached to the rule, such as a runbook or a dashboard. Each item has
id,type, anddata. The shape ofdatadepends ontype. For example, arunbookusescontentand adashboardusesdashboard_id. Known types are validated against that shape. Unknown types are stored whenid,type, anddataare present. -
enabledboolean · default: true -
If
true(default), the rule runs on its schedule after creation. Iffalse, the rule is saved but does not run until you enable it. -
idstring · min length: 1 · max length: 150 -
Optional rule ID. If omitted, Kibana generates one. IDs in the request must be unique.
-
kindrequired -
Whether the rule creates alerts (
alert) or only stores matching events (signal). -
Values:
alertsignal -
no_data_strategy -
How the rule behaves when it finds no data for a group. If you omit this field or set it to
none, those runs are ignored. If you setlast_known_statusorrecover, a standalone query (query.format: standalone) must includequery.no_data. A composed query (query.format: composed) usesquery.baseto detect whether data is present. Theemitvalue is not accepted when creating or updating rules. -
Values:
last_known_statusemitrecovernone -
recovery_strategy -
The condition that marks an alert recovered. If omitted or set to
none, recovery is disabled: the alert staysactiveeven after the breach query stops returning matches, andstate_transition.recovering_count/recovering_timeframeare not allowed. Set tono_breachto recover when the breach query stops returning matches. Set toqueryonly when you also providequery.recovery. -
Values:
no_breachquerynone -
state_transitionobjectnullable -
Consecutive-match or time requirements before an alert becomes
activeorinactive. Applies only whenkindisalert. -
pending_countinteger · min: 0 · max: 1000 -
Number of consecutive matches required before the alert becomes
active. -
pending_operator -
The operator that combines
pending_countandpending_timeframe.ANDrequires both.ORrequires either. -
Values:
ANDOR -
pending_timeframestring · max length: 32 -
Time window used with
pending_count, for example5mor15m. -
recovering_countinteger · min: 0 · max: 1000 -
Number of consecutive recoveries required before the alert becomes
inactive.
Responses
Created rules are returned in rules. Failures are returned in errors.
-
errorsobjectrequired -
Errors for rules that could not be created. Each entry includes the rule
idand the error. Empty when every requested rule was created. -
rulesobjectrequired -
Rules that were created. Rules listed in
errorsare not included. -
artifactsobject · max items: 100 -
Optional objects attached to the rule, such as a runbook or a dashboard. Each item has
id,type, anddata. The shape ofdatadepends ontype. For example, arunbookusescontentand adashboardusesdashboard_id. Known types are validated against that shape. Unknown types are stored whenid,type, anddataare present. -
kindrequired -
Whether the rule creates alerts (
alert) or only stores matching events (signal). -
Values:
alertsignal -
no_data_strategy -
How the rule behaves when it finds no data for a group. If you omit this field or set it to
none, those runs are ignored. If you setlast_known_statusorrecover, a standalone query (query.format: standalone) must includequery.no_data. A composed query (query.format: composed) usesquery.baseto detect whether data is present. Theemitvalue is not accepted when creating or updating rules. -
Values:
last_known_statusemitrecovernone -
recovery_strategy -
The condition that marks an alert recovered. If omitted or set to
none, recovery is disabled: the alert staysactiveeven after the breach query stops returning matches, andstate_transition.recovering_count/recovering_timeframeare not allowed. Set tono_breachto recover when the breach query stops returning matches. Set toqueryonly when you also providequery.recovery. -
Values:
no_breachquerynone -
state_transitionobjectnullable -
Consecutive-match or time requirements before an alert becomes
activeorinactive. Applies only whenkindisalert. -
pending_countinteger · min: 0 · max: 1000 -
Number of consecutive matches required before the alert becomes
active. -
pending_operator -
The operator that combines
pending_countandpending_timeframe.ANDrequires both.ORrequires either. -
Values:
ANDOR -
pending_timeframestring · max length: 32 -
Time window used with
pending_count, for example5mor15m. -
recovering_countinteger · min: 0 · max: 1000 -
Number of consecutive recoveries required before the alert becomes
inactive.
Indicates an invalid schema or parameters.
Indicates the request was not authenticated.
Indicates the user does not have the required privileges to perform the request.
Indicates an unexpected server-side error.
Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.