Get rule details

Base URL: https://{kibana_url}

GET /api/alerting/rule/{id}
GET /s/{space_id}/api/alerting/rule/{id}

Auth

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
id string required: The identifier for the rule.

Responses

Indicates a successful call.

application/json

actions object[] required
active_snoozes string[]
alert_delay object: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
api_key_created_by_user boolean nullable: Indicates whether the API key that is associated with the rule was created by the user.
api_key_owner string required nullable: The owner of the API key that is associated with the rule and used to run background tasks.
artifacts object
consumer string required: The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.
created_at string required: The date and time that the rule was created.
created_by string required nullable: The identifier for the user that created the rule.
enabled boolean required: Indicates whether you want to run the rule on an interval basis after it is created.
execution_status object required
flapping object nullable: When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.
id string required: The identifier for the rule.
is_snoozed_until string nullable: The date when the rule will no longer be snoozed.
last_run object nullable
mapped_params map string to object
monitoring object: Monitoring details of the rule.
mute_all boolean required: Indicates whether all alerts are muted.
muted_alert_ids string[] required
name string required: The name of the rule.
next_run string nullable: Date and time of the next run of the rule.
notify_when enum nullable: Indicates how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify notify_when at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.; Values: onActionGroupChange onActiveAlert onThrottleInterval
params map string to object required: The parameters for the rule.
revision number required: The rule revision number.
rule_type_id string required: The rule type identifier.
running boolean nullable: Indicates whether the rule is running.
schedule object required
scheduled_task_id string: Identifier of the scheduled task.
snooze_schedule object[]
tags string[] required
throttle string nullable deprecated: Deprecated in 8.13.0. Use the throttle property in the action frequency object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
updated_at string required: The date and time that the rule was updated most recently.
updated_by string required nullable: The identifier for the user that updated this rule most recently.
view_in_app_relative_url string nullable: Relative URL to view rule in the app.

400

Indicates an invalid schema or parameters.

403

Indicates that this call is forbidden.

404

Indicates a rule with the given ID does not exist.