Update a maintenance window.

Base URL
https://{kibana_url}
Auth

Required authorization

Privileges write-maintenance-window

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

id string required

The identifier for the maintenance window.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

enabled boolean

Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.

schedule object
custom object required
duration string · max length: 100 required

The duration of the schedule. It allows values in <integer><unit> format. <unit> is one of d, h, m, or s for hours, minutes, seconds. For example: 1d, 5h, 30m, 5000s.

recurring object
end string · max length: 100

The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: 2025-04-01T00:00:00.000Z.

every string · max length: 100

The interval and frequency of a recurring schedule. It allows values in <integer><unit> format. <unit> is one of d, w, M, or y for days, weeks, months, years. For example: 15d, 2w, 3m, 1y.

occurrences number · min: 1

The total number of recurrences of the schedule.

onMonth number[] · min items: 1 · max items: 12

The specific months for a recurring schedule. Valid values are 1-12.

onMonthDay number[] · min items: 1 · max items: 31

The specific days of the month for a recurring schedule. Valid values are 1 to 31, or -1 for the last day of the month.

onWeekDay string[] · min items: 1 · max items: 77

The specific days of the week ([MO,TU,WE,TH,FR,SA,SU]) or nth day of month ([+1MO, -3FR, +2WE, -4SA, -5SU]) for a recurring schedule.

start string · max length: 100 required

The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: 2025-03-12T12:00:00.000Z.

timezone string · max length: 64

The timezone of the schedule. The default timezone is UTC.

scope object
alerting object

Settings that control how this maintenance window affects Alerting V1 alerts, including an optional KQL filter. If you include scope but omit alerting, the maintenance window doesn't affect these alerts.

enabled boolean

Whether this maintenance window applies to Alerting V1 alerts. If omitted, is treated as true.

query object
kql string · max length: 10000 required

A KQL filter that limits which Alerting V1 alerts this maintenance window affects. Matching alerts don't run rule actions while the window is active. If you omit query, the window affects all alerts.

alerting_v2 object

Settings that control how this maintenance window affects Alerting V2 alerts, including an optional KQL filter. If you omit alerting_v2, the maintenance window doesn't affect Alerting V2 alerts.

enabled boolean

Whether this maintenance window affects Alerting V2 alerts. Defaults to true.

query object
kql string · max length: 4096 required

A KQL filter that limits which Alerting V2 alerts this maintenance window affects. You can filter on alert_id, alert_status, group_hash, last_event_timestamp, severity, and data.*. Matching alerts don't send notifications while the window is active. If you omit query, the window affects all Alerting V2 alerts.

title string

The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window.

Responses

Indicates a successful call.

application/json
created_at string required

The date and time when the maintenance window was created.

created_by string · default: null nullable

The identifier for the user that created the maintenance window.

enabled boolean required

Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.

id string required

The identifier for the maintenance window.

schedule object required
custom object required
duration string required

The duration of the schedule. It allows values in <integer><unit> format. <unit> is one of d, h, m, or s for hours, minutes, seconds. For example: 1d, 5h, 30m, 5000s.

recurring object
end string

The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: 2025-04-01T00:00:00.000Z.

every string

The interval and frequency of a recurring schedule. It allows values in <integer><unit> format. <unit> is one of d, w, M, or y for days, weeks, months, years. For example: 15d, 2w, 3m, 1y.

occurrences number

The total number of recurrences of the schedule.

onMonth number[] · max items: 12

The specific months for a recurring schedule. Valid values are 1-12.

onMonthDay number[] · max items: 31

The specific days of the month for a recurring schedule. Valid values are 1 to 31, or -1 for the last day of the month.

onWeekDay string[] · max items: 77

The specific days of the week ([MO,TU,WE,TH,FR,SA,SU]) or nth day of month ([+1MO, -3FR, +2WE, -4SA, -5SU]) for a recurring schedule.

start string required

The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: 2025-03-12T12:00:00.000Z.

timezone string

The timezone of the schedule. The default timezone is UTC.

scope object
alerting object required

Settings that control how this maintenance window affects Alerting V1 alerts, including an optional KQL filter. Always returned when scope is returned. Check enabled to see whether the maintenance window affects these alerts.

enabled boolean

Whether this maintenance window applies to Alerting V1 alerts. If omitted, is treated as true.

query object required
kql string required

A filter written in Kibana Query Language (KQL). Only alerts matching this query will be suppressed by the maintenance window.

alerting_v2 object

Settings that control how this maintenance window affects Alerting V2 alerts, including an optional KQL filter. If you omit alerting_v2, the maintenance window doesn't affect Alerting V2 alerts.

enabled boolean

Whether the maintenance window applies to Alerting V2 alerts. If omitted, is treated as true.

query object
kql string · max length: 4096 required

A KQL filter that limits which Alerting V2 alerts this maintenance window affects. It can filter on alert_id, alert_status, group_hash, last_event_timestamp, severity, and data.*. Matching alerts don't send notifications while the window is active. If query isn't returned, the window affects all Alerting V2 alerts.

status enum required

The current status of the maintenance window.

Values: running upcoming finished archived disabled
title string required

The name of the maintenance window.

updated_at string required

The date and time when the maintenance window was last updated.

updated_by string · default: null nullable

The identifier for the user that last updated this maintenance window.

400

Indicates an invalid schema or parameters.

403

Indicates that this call is forbidden.

404

Indicates a maintenance window with the given ID does not exist.

409

Indicates that the maintenance window has already been updated by another user.

Base URL
https://{kibana_url}