Get a rule

Base URL
https://{kibana_url}
  • GET /api/alerting/v2/rules/{id}
Auth

Required authorization

Privileges read_alerting-v2-rules

Path parameters

id string · min length: 1 · max length: 150 required

The identifier for the rule.

Responses

Returns the requested rule.

application/json
artifacts object[] · max items: 100

Optional objects attached to the rule, such as a runbook or a dashboard. Each item has id, type, and data. The shape of data depends on type. For example, a runbook uses content and a dashboard uses dashboard_id. Known types are validated against that shape. Unknown types are stored when id, type, and data are present.

data map string to object required

Structured artifact data.

id string · min length: 1 · max length: 256 required

Artifact identifier.

type string · min length: 1 · max length: 128 required

Artifact type.

created_at string required

ISO timestamp when the rule was created.

created_by string required nullable

User who created the rule.

enabled boolean required

Whether the rule is enabled.

grouping object

Grouping configuration.

fields string[] · max items: 16 required

Fields to group alerts by, e.g. ["host.name", "service.name"]. Should match ES|QL GROUP BY fields.

id string required

Unique rule identifier.

kind enum required

Whether the rule creates alerts (alert) or only stores matching events (signal).

Values: alert signal
metadata object required
builder_type string · max length: 64

Identifies the rule builder that authored this rule (e.g. "threshold"). Absent for rules authored directly in ES|QL.

description string · max length: 1024

Human-readable description of the rule.

name string · min length: 1 · max length: 256 required

Rule name (must be unique within the space).

owner string · max length: 256

Owner of the rule.

tags string[] · min items: 1 · max items: 20

Tags for categorization, e.g. ["production", "infra"].

version integer · min: 1 · max: 9007199254740991 required

Monotonically increasing integer number representing a rule configuration version, incremented on every change. Used on generated rule events as rule.version.

no_data_strategy enum

How the rule behaves when it finds no data for a group. If you omit this field or set it to none, those runs are ignored. If you set last_known_status or recover, a standalone query (query.format: standalone) must include query.no_data. A composed query (query.format: composed) uses query.base to detect whether data is present. The emit value is not accepted when creating or updating rules.

Values: last_known_status emit recover none
query union oneOf required

Detection query configuration.

One of: (determined by format)
format: composed

Composed query: a shared base with appendable breach and recovery segments.

format enum required
Values: composed
base string · min length: 1 · max length: 10000 required

Base ES|QL query. Time filters are applied automatically via the lookback window.

breach object

Breach detection configuration. Omit to treat every base row as a breach.

segment string · min length: 1 · max length: 10000 required

A clause appended to the end of the rule's ES|QL query. Required in breach blocks.

recovery object

Recovery query segment. Required when recovery_strategy is "query".

segment string · min length: 1 · max length: 10000 required

Appendable ES|QL segment for recovery detection.

recovery_strategy enum

The condition that marks an alert recovered. If omitted or set to none, recovery is disabled: the alert stays active even after the breach query stops returning matches, and state_transition.recovering_count / recovering_timeframe are not allowed. Set to no_breach to recover when the breach query stops returning matches. Set to query only when you also provide query.recovery.

Values: no_breach query none
schedule object required

Execution schedule configuration.

every string · max length: 32 required

Execution interval, e.g. 1m, 5m, 1h.

lookback string · max length: 32

Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.

state_transition object nullable

Consecutive-match or time requirements before an alert becomes active or inactive. Applies only when kind is alert.

pending_count integer · min: 0 · max: 1000

Number of consecutive matches required before the alert becomes active.

pending_operator enum

The operator that combines pending_count and pending_timeframe. AND requires both. OR requires either.

Values: AND OR
pending_timeframe string · max length: 32

Time window used with pending_count, for example 5m or 15m.

recovering_count integer · min: 0 · max: 1000

Number of consecutive recoveries required before the alert becomes inactive.

recovering_operator enum

The operator that combines recovering_count and recovering_timeframe. AND requires both. OR requires either.

Values: AND OR
recovering_timeframe string · max length: 32

Time window used with recovering_count, for example 5m or 15m.

time_field string · min length: 1 · max length: 128 · default: @timestamp

Document field used as the event time when applying the lookback window. Defaults to @timestamp.

updated_at string required

ISO timestamp when the rule was last updated.

updated_by string required nullable

User who last updated the rule.

version string

The saved object version token of the rule, used for optimistic concurrency control.

Indicates the request failed schema validation.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the request was not authenticated.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the user does not have the required privileges to perform the request.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates a rule with the given ID does not exist.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates an unexpected server-side error.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Base URL
https://{kibana_url}