Body

• actions array[object]

  An action that runs under defined conditions.

  Default value is [] (empty).

  Hide actions attributes Show actions attributes object

  • alerts_filter object

    Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.

    Additional properties are NOT allowed.

    Hide alerts_filter attributes Show alerts_filter attributes object

    • query object

      Additional properties are NOT allowed.

      Hide query attributes Show query attributes object

      • dsl string

        A filter written in Elasticsearch Query Domain Specific Language (DSL).

      • filters array[object] Required

        A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the kbn-es-query package.

        Hide filters attributes Show filters attributes object

        • $state object

          Additional properties are NOT allowed.

          Hide $state attribute Show $state attribute object

          • store string Required

            A filter can be either specific to an application context or applied globally.

            Values are appState or globalState.

        • meta object Required

          Additional properties are allowed.

        • query object

          Additional properties are allowed.

      • kql string Required

        A filter written in Kibana Query Language (KQL).

    • timeframe object

      Defines a period that limits whether the action runs.

      Additional properties are NOT allowed.

      Hide timeframe attributes Show timeframe attributes object

      • days array[integer] Required

        Defines the days of the week that the action can run, represented as an array of numbers. For example, 1 represents Monday. An empty array is equivalent to specifying all the days of the week.

        Values are 1, 2, 3, 4, 5, 6, or 7.

      • hours object Required

        Defines the range of time in a day that the action can run. If the start value is 00:00 and the end value is 24:00, actions be generated all day.

        Additional properties are NOT allowed.

        Hide hours attributes Show hours attributes object

        • end string Required

          The end of the time frame in 24-hour notation (hh:mm).

        • start string Required

          The start of the time frame in 24-hour notation (hh:mm).

      • timezone string Required

        The ISO time zone for the hours values. Values such as UTC and UTC+1 also work but lack built-in daylight savings time support and are not recommended.

  • frequency object

    Additional properties are NOT allowed.

    Hide frequency attributes Show frequency attributes object

    • notify_when string Required

      Indicates how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify notify_when at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

      Values are onActionGroupChange, onActiveAlert, or onThrottleInterval.

    • summary boolean Required

      Indicates whether the action is a summary.

    • throttle string | null Required

      The throttle interval, which defines how often an alert generates repeated actions. It is specified in seconds, minutes, hours, or days and is applicable only if notify_when is set to onThrottleInterval. NOTE: You cannot specify the throttle interval at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

  • group string

    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to default.

  • id string Required

    The identifier for the connector saved object.

  • params object

    The parameters for the action, which are sent to the connector. The params are handled as Mustache templates and passed a default set of context.

    Default value is {} (empty). Additional properties are allowed.

  • use_alert_data_for_template boolean

    Indicates whether to use alert data as a template.

  • uuid string

    A universally unique identifier (UUID) for the action.

• alert_delay object

  Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.

  Additional properties are NOT allowed.

  Hide alert_delay attribute Show alert_delay attribute object

  • active number Required

    The number of consecutive runs that must meet the rule conditions.

• consumer string Required

  The name of the application or feature that owns the rule. For example: alerts, apm, discover, infrastructure, logs, metrics, ml, monitoring, securitySolution, siem, stackAlerts, or uptime.

• enabled boolean

  Indicates whether you want to run the rule on an interval basis after it is created.

  Default value is true.

• flapping object | null

  When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.

  Additional properties are NOT allowed.

  Hide flapping attributes Show flapping attributes object | null

  • look_back_window number Required

    The minimum number of runs in which the threshold must be met.

    Minimum value is 2, maximum value is 20.

  • status_change_threshold number Required

    The minimum number of times an alert must switch states in the look back window.

    Minimum value is 2, maximum value is 20.

• name string Required

  The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.

• notify_when string | null

  Indicates how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify notify_when at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

  Values are onActionGroupChange, onActiveAlert, or onThrottleInterval.

• rule_type_id string Required

  The rule type identifier.

• schedule object Required

  The check interval, which specifies how frequently the rule conditions are checked.

  Additional properties are NOT allowed.

  Hide schedule attribute Show schedule attribute object

  • interval string Required

    The interval is specified in seconds, minutes, hours, or days.

• tags array[string]

  The tags for the rule.

  Default value is [] (empty).

• throttle string | null

  Use the throttle property in the action frequency object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.

• params object

  The parameters for the rule.

  Any of:

  params_property_apm_anomaly object params_property_apm_error_count object params_property_apm_transaction_duration object params_property_apm_transaction_error_rate object params_es_query_dsl_rule object params_es_query_esql_rule object params_es_query_kql_rule object params_index_threshold_rule object params_property_infra_inventory object Count object Ratio object params_property_infra_metric_threshold object params_property_slo_burn_rate object params_property_synthetics_uptime_tls object params_property_synthetics_monitor_status object

  Hide attributes Show attributes

  • serviceName string

    The service name from APM

  • transactionType string

    The transaction type from APM

  • windowSize number Required

    The window size

  • windowUnit string Required

    The window size unit

    Values are m, h, or d.

  • environment string Required

    The environment from APM

  • anomalySeverityType string Required

    The anomaly threshold value

    Values are critical, major, minor, or warning.

  Hide attributes Show attributes

  • serviceName string

    The service name from APM

  • windowSize number Required

    The window size

  • windowUnit string Required

    The window size unit

    Values are m, h, or d.

  • environment string Required

    The environment from APM

  • threshold number Required

    The error count threshold value

  • groupBy array[string]

    Values are service.name, service.environment, transaction.name, or error.grouping_key. Default value is ["service.name", "service.environment"].

  • errorGroupingKey string

  Hide attributes Show attributes

  • serviceName string

    The service name from APM

  • transactionType string

    The transaction type from APM

  • transactionName string

    The transaction name from APM

  • windowSize number Required

    The window size

  • windowUnit string Required

    ç

    Values are m, h, or d.

  • environment string Required
  • threshold number Required

    The latency threshold value

  • groupBy array[string]

    Values are service.name, service.environment, transaction.type, or transaction.name. Default value is ["service.name", "service.environment", "transaction.type"].

  • aggregationType string Required

    Values are avg, 95th, or 99th.

  Hide attributes Show attributes

  • serviceName string

    The service name from APM

  • transactionType string

    The transaction type from APM

  • transactionName string

    The transaction name from APM

  • windowSize number Required

    The window size

  • windowUnit string Required

    The window size unit

    Values are m, h, or d.

  • environment string Required

    The environment from APM

  • threshold number Required

    The error rate threshold value

  • groupBy array[string]

    Values are service.name, service.environment, transaction.type, or transaction.name. Default value is ["service.name", "service.environment", "transaction.type"].

  An Elasticsearch query rule can run a query defined in Elasticsearch Query DSL and compare the number of matches to a configured threshold. These parameters are appropriate when rule_type_id is .es-query.

  Hide attributes Show attributes

  • aggField string

    The name of the numeric field that is used in the aggregation. This property is required when aggType is avg, max, min or sum.

  • aggType string

    The type of aggregation to perform.

    Values are avg, count, max, min, or sum. Default value is count.

  • esQuery string Required

    The query definition, which uses Elasticsearch Query DSL.

  • excludeHitsFromPreviousRun boolean

    Indicates whether to exclude matches from previous runs. If true, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.

  • groupBy string

    Indicates whether the aggregation is applied over all documents (all) or split into groups (top) using a grouping field (termField). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to termSize number of groups) are checked.

    Values are all or top. Default value is all.

  • index array[string] | string Required

    The indices to query.

    One of:

    array-1 array[string] string-2 string
  • searchType string

    The type of query, in this case a query that uses Elasticsearch Query DSL.

    Value is esQuery. Default value is esQuery.

  • size integer

    The number of documents to pass to the configured actions when the threshold condition is met.

  • termField string | array[string]

    The names of up to four fields that are used for grouping the aggregation. This property is required when groupBy is top.

    One of:

    string-1 string array-2 array[string]

    Not more than 4 elements.

  • termSize integer

    This property is required when groupBy is top. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.

  • threshold array[integer] Required

    The threshold value that is used with the thresholdComparator. If the thresholdComparator is between or notBetween, you must specify the boundary values.

  • thresholdComparator string Required

    The comparison function for the threshold. For example, "is above", "is above or equals", "is below", "is below or equals", "is between", and "is not between".

    Values are >, >=, <, <=, between, or notBetween.

  • timeField string Required

    The field that is used to calculate the time window.

  • timeWindowSize integer Required

    The size of the time window (in timeWindowUnit units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.

  • timeWindowUnit string Required

    The type of units for the time window: seconds, minutes, hours, or days.

    Values are s, m, h, or d.

  An Elasticsearch query rule can run an ES|QL query and compare the number of matches to a configured threshold. These parameters are appropriate when rule_type_id is .es-query.

  Hide attributes Show attributes

  • aggField string

    The name of the numeric field that is used in the aggregation. This property is required when aggType is avg, max, min or sum.

  • aggType string

    The type of aggregation to perform.

    Values are avg, count, max, min, or sum. Default value is count.

  • esqlQuery object Required
    Hide esqlQuery attribute Show esqlQuery attribute object

    • esql string Required

      The query definition, which uses Elasticsearch Query Language.

  • excludeHitsFromPreviousRun boolean

    Indicates whether to exclude matches from previous runs. If true, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.

  • groupBy string

    Indicates whether the aggregation is applied over all documents (all) or split into groups (top) using a grouping field (termField). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to termSize number of groups) are checked.

    Values are all or top. Default value is all.

  • searchType string Required

    The type of query, in this case a query that uses Elasticsearch Query Language (ES|QL).

    Value is esqlQuery.

  • size integer Required

    When searchType is esqlQuery, this property is required but it does not affect the rule behavior.

  • termSize integer

    This property is required when groupBy is top. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.

  • threshold array[integer] Required

    The threshold value that is used with the thresholdComparator. When searchType is esqlQuery, this property is required and must be set to zero.

    Minimum value of each is 0, maximum value of each is 0.

  • thresholdComparator string Required

    The comparison function for the threshold. When searchType is esqlQuery, this property is required and must be set to ">". Since the threshold value must be 0, the result is that an alert occurs whenever the query returns results.

    Value is >.

  • timeField string

    The field that is used to calculate the time window.

  • timeWindowSize integer Required

    The size of the time window (in timeWindowUnit units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.

  • timeWindowUnit string Required

    The type of units for the time window: seconds, minutes, hours, or days.

    Values are s, m, h, or d.

  An Elasticsearch query rule can run a query defined in KQL or Lucene and compare the number of matches to a configured threshold. These parameters are appropriate when rule_type_id is .es-query.

  Hide attributes Show attributes

  • aggField string

    The name of the numeric field that is used in the aggregation. This property is required when aggType is avg, max, min or sum.

  • aggType string

    The type of aggregation to perform.

    Values are avg, count, max, min, or sum. Default value is count.

  • excludeHitsFromPreviousRun boolean

    Indicates whether to exclude matches from previous runs. If true, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.

  • groupBy string

    Indicates whether the aggregation is applied over all documents (all) or split into groups (top) using a grouping field (termField). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to termSize number of groups) are checked.

    Values are all or top. Default value is all.

  • searchConfiguration object

    The query definition, which uses KQL or Lucene to fetch the documents from Elasticsearch.

    Hide searchConfiguration attributes Show searchConfiguration attributes object

    • filter array[object]

      A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the kbn-es-query package.

      Hide filter attributes Show filter attributes object

      • meta object
        Hide meta attributes Show meta attributes object

        • alias string | null
        • controlledBy string
        • disabled boolean
        • field string
        • group string
        • index string
        • isMultiIndex boolean
        • key string
        • negate boolean
        • params object
        • type string
        • value string
      • query object
      • $state object

    • index string | array[string]

      The indices to query.

      One of:

      string-1 string array-2 array[string]
    • query object
      Hide query attributes Show query attributes object

      • language string
      • query string
  • searchType string Required

    The type of query, in this case a text-based query that uses KQL or Lucene.

    Value is searchSource.

  • size integer Required

    The number of documents to pass to the configured actions when the threshold condition is met.

  • termField string | array[string]

    The names of up to four fields that are used for grouping the aggregation. This property is required when groupBy is top.

    One of:

    string-1 string array-2 array[string]

    Not more than 4 elements.

  • termSize integer

    This property is required when groupBy is top. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.

  • threshold array[integer] Required

    The threshold value that is used with the thresholdComparator. If the thresholdComparator is between or notBetween, you must specify the boundary values.

  • thresholdComparator string Required

    The comparison function for the threshold. For example, "is above", "is above or equals", "is below", "is below or equals", "is between", and "is not between".

    Values are >, >=, <, <=, between, or notBetween.

  • timeField string

    The field that is used to calculate the time window.

  • timeWindowSize integer Required

    The size of the time window (in timeWindowUnit units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.

  • timeWindowUnit string Required

    The type of units for the time window: seconds, minutes, hours, or days.

    Values are s, m, h, or d.

  An index threshold rule runs an Elasticsearch query, aggregates field values from documents, compares them to threshold values, and schedules actions to run when the thresholds are met. These parameters are appropriate when rule_type_id is .index-threshold.

  Hide attributes Show attributes

  • aggField string

    The name of the numeric field that is used in the aggregation. This property is required when aggType is avg, max, min or sum.

  • aggType string

    The type of aggregation to perform.

    Values are avg, count, max, min, or sum. Default value is count.

  • filterKuery string

    A KQL expression thats limits the scope of alerts.

  • groupBy string

    Indicates whether the aggregation is applied over all documents (all) or split into groups (top) using a grouping field (termField). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to termSize number of groups) are checked.

    Values are all or top. Default value is all.

  • index array[string] Required

    The indices to query.

  • termField string | array[string]

    The names of up to four fields that are used for grouping the aggregation. This property is required when groupBy is top.

    One of:

    string-1 string array-2 array[string]

    Not more than 4 elements.

  • termSize integer

    This property is required when groupBy is top. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.

  • threshold array[integer] Required

    The threshold value that is used with the thresholdComparator. If the thresholdComparator is between or notBetween, you must specify the boundary values.

  • thresholdComparator string Required

    The comparison function for the threshold. For example, "is above", "is above or equals", "is below", "is below or equals", "is between", and "is not between".

    Values are >, >=, <, <=, between, or notBetween.

  • timeField string Required

    The field that is used to calculate the time window.

  • timeWindowSize integer Required

    The size of the time window (in timeWindowUnit units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.

  • timeWindowUnit string Required

    The type of units for the time window: seconds, minutes, hours, or days.

    Values are s, m, h, or d.

  Hide attributes Show attributes

  • criteria array[object]
    Hide criteria attributes Show criteria attributes object

    • metric string

      Values are count, cpu, diskLatency, load, memory, memoryTotal, tx, rx, logRate, diskIOReadBytes, diskIOWriteBytes, s3TotalRequests, s3NumberOfObjects, s3BucketSize, s3DownloadBytes, s3UploadBytes, rdsConnections, rdsQueriesExecuted, rdsActiveTransactions, rdsLatency, sqsMessagesVisible, sqsMessagesDelayed, sqsMessagesSent, sqsMessagesEmpty, sqsOldestMessage, or custom.

    • timeSize number
    • timeUnit string

      Values are s, m, h, or d.

    • sourceId string
    • threshold array[number]
    • comparator string

      Values are <, <=, >, >=, between, or outside.

    • customMetric object
      Hide customMetric attributes Show customMetric attributes object

      • type string

        Value is custom.

      • field string
      • aggregation string

        Values are avg, max, min, or rate.

      • id string
      • label string
    • warningThreshold array[number]
    • warningComparator string

      Values are <, <=, >, >=, between, or outside.

  • filterQuery string
  • filterQueryText string
  • nodeType string

    Values are host, pod, container, awsEC2, awsS3, awsSQS, or awsRDS.

  • sourceId string
  • alertOnNoData boolean

  Hide attributes Show attributes

  • criteria array[object]
    Hide criteria attributes Show criteria attributes object

    • field string
    • comparator string

      Values are more than, more than or equals, less than, less than or equals, equals, does not equal, matches, does not match, matches phrase, or does not match phrase.

    • value number | string

      One of:

      number-1 number string-2 string
  • count object Required
    Hide count attributes Show count attributes object

    • comparator string

      Values are more than, more than or equals, less than, less than or equals, equals, does not equal, matches, does not match, matches phrase, or does not match phrase.

    • value number
  • timeSize number Required
  • timeUnit string Required

    Values are s, m, h, or d.

  • logView object Required
    Hide logView attributes Show logView attributes object

    • logViewId string
    • type string

      Value is log-view-reference.

  • groupBy array[string]

  Hide attributes Show attributes

  • criteria array[array]
    Hide criteria attributes Show criteria attributes object

    • field string
    • comparator string

      Values are more than, more than or equals, less than, less than or equals, equals, does not equal, matches, does not match, matches phrase, or does not match phrase.

    • value number | string

      One of:

      number-1 number string-2 string
  • count object Required
    Hide count attributes Show count attributes object

    • comparator string

      Values are more than, more than or equals, less than, less than or equals, equals, does not equal, matches, does not match, matches phrase, or does not match phrase.

    • value number
  • timeSize number Required
  • timeUnit string Required

    Values are s, m, h, or d.

  • logView object Required
    Hide logView attributes Show logView attributes object

    • logViewId string
    • type string

      Value is log-view-reference.

  • groupBy array[string]

  Hide attributes Show attributes

  • criteria array[object]
    One of:

    non count criterion object count criterion object custom criterion object

    Hide attributes Show attributes

    • threshold array[number]
    • comparator string

      Values are <, <=, >, >=, between, or outside.

    • timeUnit string
    • timeSize number
    • warningThreshold array[number]
    • warningComparator string

      Values are <, <=, >, >=, between, or outside.

    • metric string
    • aggType string

      Values are avg, max, min, cardinality, rate, count, sum, p95, p99, or custom.

    Hide attributes Show attributes

    • threshold array[number]
    • comparator string

      Values are <, <=, >, >=, between, or outside.

    • timeUnit string
    • timeSize number
    • warningThreshold array[number]
    • warningComparator string

      Values are <, <=, >, >=, between, or outside.

    • aggType string

      Value is count.

    Hide attributes Show attributes

    • threshold array[number]
    • comparator string

      Values are <, <=, >, >=, between, or outside.

    • timeUnit string
    • timeSize number
    • warningThreshold array[number]
    • warningComparator string

      Values are <, <=, >, >=, between, or outside.

    • aggType string

      Value is custom.

    • customMetric array[object]
      One of:

      object-1 object object-2 object

      Hide attributes Show attributes

      • name string
      • aggType string

        Values are avg, sum, max, min, or cardinality.

      • field string

      Hide attributes Show attributes

      • name string
      • aggType string

        Value is count.

      • filter string
    • equation string
    • label string

  • groupBy string | array[string]

    One of:

    string-1 string array-2 array[string]
  • filterQuery string
  • sourceId string
  • alertOnNoData boolean
  • alertOnGroupDisappear boolean

  Hide attributes Show attributes

  • sloId string

    The SLO identifier used by the rule

  • burnRateThreshold number

    The burn rate threshold used to trigger the alert

  • maxBurnRateThreshold number

    The maximum burn rate threshold value defined by the SLO error budget

  • longWindow object

    The duration of the long window used to compute the burn rate

    Hide longWindow attributes Show longWindow attributes object

    • value number

      The duration value

    • unit string

      The duration unit

  • shortWindow object

    The duration of the short window used to compute the burn rate

    Hide shortWindow attributes Show shortWindow attributes object

    • value number

      The duration value

    • unit string

      The duration unit

  Hide attributes Show attributes

  • search string
  • certExpirationThreshold number
  • certAgeThreshold number

  Hide attributes Show attributes

  • availability object
    Hide availability attributes Show availability attributes object

    • range number
    • rangeUnit string
    • threshold string

  • filters string | object

    One of:

    string-1 string object-2 object Deprecated

    Hide attributes Show attributes

    • monitor.type array[string]
    • observer.geo.name array[string]
    • tags array[string]
    • url.port array[string]
  • locations array[string] Deprecated
  • numTimes number Required
  • search string
  • shouldCheckStatus boolean Required
  • shouldCheckAvailability boolean Required
  • timerangeCount number
  • timerangeUnit string
  • timerange object Deprecated
    Hide timerange attributes Show timerange attributes object Deprecated

    • from string
    • to string
  • version number
  • isAutoGenerated boolean