Update a rule
- Base URL
-
https://{kibana_url}
Refer to Spaces for more information.
Request body
-
actionsobject · default: [] -
alerts_filterobject -
frequencyobject -
notify_whenrequired -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleInterval -
throttlestring · default: nullnullable -
The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when
notify_whenis set toonThrottleInterval. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values. -
groupstring -
The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to
default. -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
namestringrequired -
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_whennullable -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
throttlestringnullable -
Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
Responses
Indicates a successful call.
-
actionsobjectrequired -
alerts_filterobject -
Defines a period that limits whether the action runs.
-
connector_type_idstringrequired -
The type of connector. This property appears in responses but cannot be set in requests.
-
frequencyobject -
notify_whenrequired -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleInterval -
throttlestring · default: nullnullable -
The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when 'notify_when' is set to 'onThrottleInterval'. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
-
groupstring -
The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to
default. -
alert_delayobject -
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
-
api_key_created_by_userbooleannullable -
Indicates whether the API key that is associated with the rule was created by the user.
-
api_key_ownerstring · default: nullnullable -
The owner of the API key that is associated with the rule and used to run background tasks.
-
consumerstringrequired -
The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabledbooleanrequired -
Indicates whether you want the rule to run on an interval basis after it is created.
-
notify_whennullable -
Indicates how frequently rule actions are triggered. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specifynotify_whenat both the rule and action level. The recommended approach is to set it for each action individually. If you setnotify_whenat the rule level and then edit the rule, it will automatically be converted to action-specific values. -
Values:
onActionGroupChangeonActiveAlertonThrottleIntervalnull -
throttlestringnullable deprecated -
Deprecated in 8.13.0. Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
Indicates an invalid schema or parameters.
Indicates that this call is forbidden.
Indicates a rule with the given ID does not exist.
Indicates that the rule has already been updated by another user.