Get the Elasticsearch query for a rule

Base URL
https://{kibana_url}
  • GET /api/alerting/rule/{id}/query_inspector
  • GET /s/{space_id}/api/alerting/rule/{id}/query_inspector
Auth

Returns the Elasticsearch query that a rule executes, and optionally its response.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

id string required

The identifier for the rule.

Query parameters

mode enum · default: build

The inspection mode. Use "build" to return only the query, or "execute" to run the query and include the response.

Values: build execute
alert_id string

The alert document ID. When provided, the query inspector uses the evaluation time range from the alert instead of the current time.

Responses

Indicates a successful call.

application/json
queries object[] · max items: 1000 required
index string required
label string
request map string to object required
response map string to object
400

Indicates the rule type is not supported or the request parameters are invalid.

404

Indicates a rule with the specified rule ID does not exist.

Base URL
https://{kibana_url}