- Kibana Guide: other versions:
- What is Kibana?
- What’s new in 8.2
- Kibana concepts
- Quick start
- Set up
- Install Kibana
- Configure Kibana
- Alerting and action settings
- APM settings
- Banners settings
- Enterprise Search settings
- Fleet settings
- i18n settings
- Logging settings
- Logs settings
- Metrics settings
- Monitoring settings
- Reporting settings
- Search sessions settings
- Secure settings
- Security settings
- Spaces settings
- Task Manager settings
- Telemetry settings
- URL drilldown settings
- Start and stop Kibana
- Access Kibana
- Securing access to Kibana
- Add data
- Upgrade Kibana
- Configure security
- Configure reporting
- Configure logging
- Configure monitoring
- Command line tools
- Production considerations
- Discover
- Dashboard and visualizations
- Canvas
- Maps
- Build a map to compare metrics by country or region
- Track, visualize, and alert on assets in real time
- Map custom regions with reverse geocoding
- Heat map layer
- Tile layer
- Vector layer
- Plot big data
- Search geographic data
- Configure map settings
- Connect to Elastic Maps Service
- Import geospatial data
- Troubleshoot
- Reporting and sharing
- Machine learning
- Graph
- Alerting
- Observability
- APM
- Security
- Dev Tools
- Fleet
- Osquery
- Stack Monitoring
- Stack Management
- REST API
- Get features API
- Kibana spaces APIs
- Kibana role management APIs
- User session management APIs
- Saved objects APIs
- Data views API
- Index patterns APIs
- Alerting APIs
- Action and connector APIs
- Cases APIs
- Import and export dashboard APIs
- Logstash configuration management APIs
- Machine learning APIs
- Short URLs APIs
- Get Task Manager health
- Upgrade assistant APIs
- Kibana plugins
- Troubleshooting
- Accessibility
- Release notes
- Developer guide
Get cases by alert API
editGet cases by alert API
editThis functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Returns the cases associated with a specific alert.
Request
editGET <kibana host>:<port>/api/cases/alerts/<alert_id>
GET <kibana host>:<port>/s/<space_id>/api/cases/alerts/<alert_id>
Prerequisites
editYou must have read
privileges for the Cases feature in the Management,
Observability, or Security section of the
Kibana feature privileges, depending on the
owner
of the cases you’re seeking.
Path parameters
edit-
<alert_id>
- (Required, string) The alert identifier.
-
<space_id>
- (Optional, string) An identifier for the space. If it is not specified, the default space is used.
Query parameters
edit-
owner
-
(Optional, string or array of strings) A filter to limit the retrieved cases to
a specific set of applications. Valid values are:
cases
,observability
, andsecuritySolution
. If this parameter is omitted, the response contains all cases that the user has access to read.
Response codes
edit-
200
- Indicates a successful call.
Examples
editReturn cases associated with the alert ID
09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540
:
GET api/cases/alerts/09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540
The API returns a JSON array containing the identifier and title of the cases. For example:
[ { "id": "8af6ac20-74f6-11ea-b83a-553aecdb28b6", "title": "Case 1" }, { "id": "a18b38a0-71b0-11ea-a0b2-c51ea50a58e2", "title": "Case 2" } ]