Delete rules matching a query (dry-run by default)

Base URL
https://{kibana_url}
  • POST /api/alerting/v2/rules/_delete_by_query
  • POST /s/{space_id}/api/alerting/v2/rules/_delete_by_query
Auth

Required privileges

Privileges manage_alerting-v2-rules

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

filter string · min length: 1 · max length: 4096

KQL filter string to match target resources. At most 10000 matching resources are processed per request. Cannot be empty; to target every resource use match_all: true.

force boolean · default: false

When true, executes the operation. When false (default), returns a dry-run preview with match_count and a sample of matching resource IDs so the client can verify before committing.

match_all enum

When true, targets every resource. Requires an explicit opt-in. Omitted by default.

Values: true

Free-text search string matched against the resource-defined searchable fields. Cannot be empty; to target every resource use match_all: true.

Responses

Returns a dry-run preview by default, or the executed operation when force is true.

application/json
Any of:

Dry-run preview returned by a by-query bulk endpoint when force is false.

match_count integer · min: 0 · max: 9007199254740991 required

Total number of resources matching the query. A dry run never fails on size, but if this exceeds 10000, re-sending the same query with force: true is rejected with BULK_QUERY_MATCH_LIMIT_EXCEEDED; narrow the query before executing.

sample string[] · max items: 100 required

Sample of matching resource IDs (up to 100) for spot-checking before executing.

Base URL
https://{kibana_url}