List rule executions

Base URL
https://{kibana_url}
  • GET /api/alerting/v2/execution_history/rules
  • GET /s/{space_id}/api/alerting/v2/execution_history/rules
Auth

Get a paginated list of rule execution events.

Required authorization

Privileges read_alerting-v2-execution-history

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

rule_ids string[] · min items: 1 · max items: 50

Rule id filter.

Free-text search. Matches rule name, description or rule ID (case-insensitive). Combined with rule_ids using AND.

outcomes enum[] · min items: 1 · max items: 2

Outcome filter.

Values: success failure
from string · format: date-time · max length: 64

Inclusive ISO datetime lower bound on event.start. Defaults to 24 hours before to, or before the request when to is omitted. Set it to see older executions.

to string · format: date-time · max length: 64

Inclusive ISO datetime upper bound on event.start.

sort_field enum · default: started_at required

Sort field. Defaults to started_at.

Values: started_at duration_ms
sort_order enum · default: desc required

Sort direction.

Values: asc desc
page integer · min: 1 · max: 10000 · default: 1 required

Page number.

per_page integer · min: 1 · max: 100 · default: 20 required

Number of results per page.

Responses

Returns a paginated list of rule execution events.

application/json
items object[] required
ended_at string · format: date-time · max length: 64 required
error object

Failure details. Omitted on a successful run, or when the failure was unclassified.

message string required
stack_trace string

Omitted when the source recorded no trace.

id string required
outcome enum required
Values: success failure
reason string

Why the run ended the way it did. Omitted when the source recorded no reason.

rule object required
id string required
version integer · min: -9007199254740991 · max: 9007199254740991

The rule version this run executed. Omitted until the rule executor emits its own event; the task-run event does not carry one.

started_at string · format: date-time · max length: 64 required
timings object required
duration_ms integer · min: 0 · max: 9007199254740991 required

Wall-clock duration of the run, in milliseconds.

scheduled_delay_ms integer · min: -9007199254740991 · max: 9007199254740991 required

Delay between the scheduled run time and the actual start, in milliseconds. Negative when the run started ahead of its scheduled time.

page integer · min: 1 · max: 9007199254740991 required
per_page integer · min: 1 · max: 9007199254740991 required
search_matches object

Match counts for the active search. Omitted when no search was provided.

is_truncated boolean required

True when more than 500 rules matched the search. Only the executions of the first 500 matching rules are returned, so the results are incomplete. Narrow the search to see the rest.

rule_count integer · min: 0 · max: 9007199254740991 required

The number of rules matching the search. This count is an estimate: results above 10,000 may be reported as 10,000.

total integer · min: 0 · max: 9007199254740991 required

The number of rule executions matching the query. This count is an estimate: results above 10,000 may be reported as 10,000.

Indicates an invalid schema or parameters.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the request was not authenticated.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the user does not have the required privileges to perform the request.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates an unexpected server-side error.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Base URL
https://{kibana_url}