List rule executions

Base URL
https://{kibana_url}
  • GET /api/alerting/v2/execution_history/rules
Auth

Get a paginated list of rule execution events.

Required authorization

Privileges read_alerting-v2-execution-history

Query parameters

rule_ids string[] · min items: 1 · max items: 50

Rule id filter.

outcome enum[] · min items: 1 · max items: 2

Outcome filter.

Values: success failure
from string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$

Inclusive ISO datetime lower bound on event.start.

to string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$

Inclusive ISO datetime upper bound on event.start.

sort enum · default: started_at required

Sort field. Defaults to started_at.

Values: started_at duration
sort_order enum · default: desc required

Sort direction.

Values: asc desc
page integer · min: 1 · max: 10000 · default: 1 required

Page number.

per_page integer · min: 1 · max: 100 · default: 20 required

Number of results per page.

Responses

Returns a paginated list of rule execution events.

application/json
items object[] required
ended_at string required
error object required nullable
message string required
stack_trace string required nullable
id string required
outcome enum required
Values: success failure
reason string required nullable
rule object required
id string required
version integer · min: -9007199254740991 · max: 9007199254740991 required nullable
space_id string required
started_at string required
timings object required
duration integer · min: 0 · max: 9007199254740991 required
scheduled_delay integer · min: -9007199254740991 · max: 9007199254740991 required
page integer · min: 1 · max: 9007199254740991 required
per_page integer · min: 1 · max: 9007199254740991 required
total integer · min: 0 · max: 9007199254740991 required

Indicates an invalid schema or parameters.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the request was not authenticated.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the user does not have the required privileges to perform the request.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates an unexpected server-side error.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Base URL
https://{kibana_url}