Update a rule

Base URL
https://{kibana_url}
Auth

Apply a partial update. A field you omit keeps its stored value, and that applies at every level: send {"metadata": {"name": "Disk pressure"}} to change one leaf while leaving its siblings alone. Send null to clear a field, again at any level: {"metadata": {"description": null}} clears a single leaf, while {"grouping": null} clears a whole object. Lists and variant objects are replaced as a unit rather than merged, since a partly-sent variant could never be valid. The merged result is validated as a whole, so a patch that would leave the resource invalid is rejected with a 400 and nothing is stored.

Required privileges

Privileges manage_alerting-v2-rules

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

id string · min length: 1 · max length: 150 · pattern: ^[a-zA-Z0-9_-]+$ required

The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alerts recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

no_data union oneOf

What the rule does when a group has no data. Required when kind is alert. Not allowed when kind is signal. Any strategy other than ignore requires either query.breach or no_data.query, so that a group with no data can be told apart from one that stopped breaching.

One of: (determined by strategy)
strategy: ignore

Does not check whether a group still has data. Missing groups do not produce no_data events.

strategy enum required
Values: ignore
recovery union oneOf

When an alert recovers. Required when kind is alert. Not allowed when kind is signal.

One of: (determined by strategy)
strategy: no_breach

Recovers the alert when its group no longer appears in the breach results.

strategy enum required
Values: no_breach
time_field string · min length: 1 · max length: 256

Document field Kibana uses with schedule.lookback to time-filter query.base.

Responses

Returns the updated rule.

application/json
created_at string · format: date-time · max length: 64 required

ISO timestamp when the rule was created.

created_by object required

Actor who created the rule.

profile_uid string required nullable

User profile ID of the actor, or null when it cannot be resolved.

enabled boolean required

Whether the rule is enabled.

id string required

Unique rule identifier.

kind enum required

Whether the rule creates alerts (alert) or only stores matching events (signal).

Values: alert signal
metadata object required

Rule metadata.

description string · min length: 1 · max length: 1024

Human-readable description of the rule. Omit to leave it unset; send null on PATCH to clear it. An empty string is rejected.

name string · min length: 1 · max length: 256 required

Rule name (must be unique within the space).

routing_tags string[] · min items: 1 · max items: 20

Routing tags that link alerts from this rule to action policies. An action policy applies when its matcher.tags contains at least one of these tags. Only allowed when kind is "alert".

tags string[] · min items: 1 · max items: 20

Tags for categorization, e.g. ["production", "infra"].

no_data union oneOf

What the rule does when a group has no data. Required when kind is alert. Not allowed when kind is signal. Any strategy other than ignore requires either query.breach or no_data.query, so that a group with no data can be told apart from one that stopped breaching.

One of: (determined by strategy)
strategy: ignore

Does not check whether a group still has data. Missing groups do not produce no_data events.

strategy enum required
Values: ignore
query object required

ES|QL query the rule evaluates. base is required. breach is an optional clause appended to it.

base string · min length: 1 · max length: 10000 required

ES|QL query that specifies the data to evaluate. Must include a FROM clause. Kibana applies the time filter from schedule.lookback using time_field.

recovery union oneOf

When an alert recovers. Required when kind is alert. Not allowed when kind is signal.

One of: (determined by strategy)
strategy: no_breach

Recovers the alert when its group no longer appears in the breach results.

strategy enum required
Values: no_breach
schedule object required

Execution schedule configuration.

every string · max length: 32 required

Execution interval, e.g. 1m, 5m, 1h.

lookback string · max length: 32

Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.

time_field string · min length: 1 · max length: 256 · default: @timestamp

Document field Kibana uses with schedule.lookback to time-filter query.base.

updated_at string · format: date-time · max length: 64 required

ISO timestamp when the rule was last updated.

updated_by object required

Actor who last updated the rule.

profile_uid string required nullable

User profile ID of the actor, or null when it cannot be resolved.

version integer · min: 1 · max: 9007199254740991 required

Monotonically increasing integer number representing a rule configuration version, incremented on every change. Used on generated rule events as rule.version.

Base URL
https://{kibana_url}