alerting-v2

Create or replace a rule

Spaces method and path for this operation:

<div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}</span></div>

Refer to Spaces for more information.

Creates a rule with the given identifier, or fully replaces it if one already exists.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.

put/api/alerting/v2/rules/{id}

Request

  • Base URL
    https://localhost:5601
  • URL
    https://localhost:5601/api/alerting/v2/rules/{id}
  • Auth
    • API key in header Authorization
    • or HTTP basic

Path parameters

idstring required

The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alerts recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.

Headers

kbn-xsrfstring required
Example:true

A required header to protect against CSRF attacks

Request body

enabledboolean

Whether the rule is enabled. On create, defaults to true when omitted. On replace, omitting this field preserves the existing enabled state.

time_fieldstring

Document field Kibana uses with schedule.lookback to time-filter query.base.

Response

Returns the replaced rule.

created_atstring date-time required

ISO timestamp when the rule was created.

enabledboolean required

Whether the rule is enabled.

idstring required

Unique rule identifier.

time_fieldstring

Document field Kibana uses with schedule.lookback to time-filter query.base.

updated_atstring date-time required

ISO timestamp when the rule was last updated.

versioninteger required

Monotonically increasing integer number representing a rule configuration version, incremented on every change. Used on generated rule events as rule.version.

Changes