Query alert indices

Serverless Stack

On Serverless alerts are stored in datastreams, on on-prem and Elastic Cloud Hosted (ECH) they are stored in the indices.

All the alert index names consist of 5 parts:

All of them start with .internal.alerts- prefix. Then the context, dataset, space-Id and version number parts follow it.

An index name template:
.internal.alerts-{{context}}.{{dataset}}-{{space-id}}-{{version-number}}

context: Usually the product group that the rule type belongs to. Such as Stack, Observability and Security.

dataset: “alert” for the alert indices.

space-id: Only the security rules are space-specific. All the other rules write into default for all spaces.

version-number: This starts from 000001 and gets increased by 1 as the index is rolled over

An example alert index name of the Elasticsearch Query rule:
.internal.alerts-stack.alerts-default-000001

All the alert indices have an alias too.

They start with .alerts prefix, then context, dataset, space-Id follows it.

Alias template:
.alerts-{{context}}.{{dataset}}-{{space-id}}

An example alias for the Elasticsearch Query rule index:
.alerts-stack.alerts-default

Note: Only the security rules are space-specific, other rule types use the default space.

You can find the index names and aliases per rule type in the below table.

You can simply search for an alert by using .internal.alerts-* index pattern or the index alias.

The below query returns top 100 alerts you have from all the alert indices you have.

GET /.internal.alerts-*/_search
{
 "query": {
   "match_all": {}
 },
 "size":100
}
		

An example for the Elasticsearch query rule:

With its index name:

GET /.internal.alerts-stack.alerts-default-000001/_mapping
		

Or with its alias:

GET /.alerts-stack.alerts-default/_mapping
		

Replace the kibana.alert.status value with recovered for the recovered alerts

GET /.internal.alerts-*/_search
{
 "query": {
   "bool": {
     "filter": [{ "term": { "kibana.alert.status": "active" } }]
   }
 },
 "size": 100
}
		

Replace the kibana.alert.rule.uuid value with your rule id

GET /.internal.alerts-*/_search
{
 "size": 100,
 "query": {
   "bool": {
     "filter": [
       { "term": { "kibana.alert.rule.uuid": "--your-rule-id--" } }
     ]
   }
 }
}
		

Replace the kibana.alert.status value with recovered for the recovered alerts

GET /.internal.alerts-*/_search
{
 "query": {
   "bool": {
     "filter": [
       { "term":  { "kibana.alert.status": "recovered"}},
       {
         "range": {
           "@timestamp": {
             "gte": "now-60m",
             "lte": "now"
           }
         }
       }
     ]
   }
 },
 "size": 100
}
		

Replace the kibana.alert.rule.category value with your rule type name

GET /.internal.alerts-*/_search
{
 "query": {
   "bool": {
     "filter": [
       { "term":  { "kibana.alert.rule.category": "Elasticsearch query"}}
     ]
   }
 },
 "size": 100
}