Get a paginated set of alerts

Base URL
https://{kibana_url}
  • GET /api/alerts/alerts/_find
  • GET /s/{space_id}/api/alerts/alerts/_find
Auth Deprecated

Deprecated in 7.13.0. Use the find rules API instead. NOTE: Alert params are stored as a flattened field type and analyzed as keywords. As alerts change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

default_search_operator string · default: OR

The default operator to use for the simple_query_string.

fields string[]

The fields to return in the attributes key of the response.

filter string

A KQL string that you filter with an attribute from your saved object. It should look like savedObjectType.attributes.title: "myTitle". However, if you used a direct attribute of a saved object, such as updatedAt, you must define your filter, for example, savedObjectType.updatedAt > 2018-12-22.

has_reference object

Filters the rules that have a relation with the reference objects with a specific type and identifier.

id string
type string
page integer · default: 1

The page number to return.

per_page integer · default: 20

The number of alerts to return per page.

An Elasticsearch simple_query_string query that filters the alerts in the response.

search_fields union string | string[]

The fields to perform the simple_query_string parsed query against.

sort_field string

Determines which field is used to sort the results. The field must exist in the attributes key of the response.

sort_order enum · default: desc

Determines the sort order.

Values: asc desc

Responses

Indicates a successful call.

application/json
data object[]
actions object[]
alertTypeId string
apiKeyOwner string nullable
createdAt string · format: date-time

The date and time that the alert was created.

createdBy string

The identifier for the user that created the alert.

enabled boolean

Indicates whether the alert is currently enabled.

executionStatus object
lastExecutionDate string · format: date-time
status string
id string

The identifier for the alert.

muteAll boolean
mutedInstanceIds string[] nullable
name string

The name of the alert.

notifyWhen string
params object
schedule object
interval string
scheduledTaskId string
tags string[]
throttle string nullable
updatedAt string
updatedBy string nullable

The identifier for the user that updated this alert most recently.

page integer
perPage integer
total integer

Authorization information is missing or invalid.

application/json
error enum
Values: Unauthorized
message string
statusCode enum
Values: 401
Base URL
https://{kibana_url}