- Kibana Guide: other versions:
- What is Kibana?
- What’s new in 8.13
- Kibana concepts
- Quick start
- Set up
- Install Kibana
- Configure Kibana
- Alerting and action settings
- APM settings
- Banners settings
- Cases settings
- Enterprise Search settings
- Fleet settings
- i18n settings
- Logging settings
- Logs settings
- Metrics settings
- Monitoring settings
- Reporting settings
- Search sessions settings
- Secure settings
- Security settings
- Spaces settings
- Task Manager settings
- Telemetry settings
- URL drilldown settings
- Start and stop Kibana
- Access Kibana
- Securing access to Kibana
- Add data
- Upgrade Kibana
- Configure security
- Configure reporting
- Configure logging
- Configure monitoring
- Command line tools
- Production considerations
- Discover
- Dashboard and visualizations
- Canvas
- Maps
- Build a map to compare metrics by country or region
- Track, visualize, and alert on assets in real time
- Map custom regions with reverse geocoding
- Heat map layer
- Tile layer
- Vector layer
- Plot big data
- Search geographic data
- Configure map settings
- Connect to Elastic Maps Service
- Import geospatial data
- Troubleshoot
- Reporting and sharing
- Machine learning
- Graph
- Alerting
- Observability
- APM
- Set up
- Get started
- How-to guides
- Configure APM agents with central config
- Control access to APM data
- Create an alert
- Create custom links
- Filter data
- Find transaction latency and failure correlations
- Identify deployment details for APM agents
- Integrate with machine learning
- Exploring mobile sessions with Discover
- Viewing sessions with Discover
- Observe Lambda functions
- Query your data
- Storage Explorer
- Track deployments with annotations
- Users and privileges
- Settings
- REST API
- Troubleshooting
- Security
- Dev Tools
- Fleet
- Osquery
- Stack Monitoring
- Stack Management
- REST API
- Get features API
- Kibana spaces APIs
- Kibana role management APIs
- User session management APIs
- Saved objects APIs
- Data views API
- Get all data views
- Get data view
- Create data view
- Update data view
- Delete data view
- Swap references preview
- Swap references
- Get default data view
- Set default data view
- Update data view fields metadata
- Get runtime field
- Create runtime field
- Upsert runtime field
- Update runtime field
- Delete runtime field
- Index patterns APIs
- Alerting APIs
- Action and connector APIs
- Cases APIs
- Add comment
- Create case
- Delete cases
- Delete comments
- Find case activity
- Find cases
- Find connectors
- Get alerts
- Get case activity
- Get case
- Get case status
- Get cases by alert
- Get comments
- Get configuration
- Get reporters
- Get tags
- Push case
- Set configuration
- Update cases
- Update comment
- Update configuration
- Import and export dashboard APIs
- Logstash configuration management APIs
- Machine learning APIs
- Osquery manager API
- Short URLs APIs
- Get Task Manager health
- Upgrade assistant APIs
- Synthetics APIs
- Uptime APIs
- Kibana plugins
- Troubleshooting
- Accessibility
- Release notes
- Kibana 8.13.4
- Kibana 8.13.3
- Kibana 8.13.2
- Kibana 8.13.1
- Kibana 8.13.0
- Kibana 8.12.2
- Kibana 8.12.1
- Kibana 8.12.0
- Kibana 8.11.4
- Kibana 8.11.3
- Kibana 8.11.2
- Kibana 8.11.1
- Kibana 8.11.0
- Kibana 8.10.4
- Kibana 8.10.3
- Kibana 8.10.2
- Kibana 8.10.1
- Kibana 8.10.0
- Kibana 8.9.2
- Kibana 8.9.1
- Kibana 8.9.0
- Kibana 8.8.2
- Kibana 8.8.1
- Kibana 8.8.0
- Kibana 8.7.1
- Kibana 8.7.0
- Kibana 8.6.1
- Kibana 8.6.0
- Kibana 8.5.2
- Kibana 8.5.1
- Kibana 8.5.0
- Kibana 8.4.3
- Kibana 8.4.2
- Kibana 8.4.1
- Kibana 8.4.0
- Kibana 8.3.3
- Kibana 8.3.2
- Kibana 8.3.1
- Kibana 8.3.0
- Kibana 8.2.3
- Kibana 8.2.2
- Kibana 8.2.1
- Kibana 8.2.0
- Kibana 8.1.3
- Kibana 8.1.2
- Kibana 8.1.1
- Kibana 8.1.0
- Kibana 8.0.0
- Kibana 8.0.0-rc2
- Kibana 8.0.0-rc1
- Kibana 8.0.0-beta1
- Kibana 8.0.0-alpha2
- Kibana 8.0.0-alpha1
- Developer guide
Update rule API
editUpdate rule API
editUpdate the attributes for an existing rule.
For the most up-to-date API details, refer to the open API specification.
Request
editPUT <kibana host>:<port>/api/alerting/rule/<id>
PUT <kibana host>:<port>/s/<space_id>/api/alerting/rule/<id>
Prerequisites
editYou must have all
privileges for the appropriate Kibana features, depending on
the consumer
and rule_type_id
of the rule you’re updating. For example, the
Management > Stack Rules feature, Analytics > Discover and Machine Learning
features, Observability, or Security features. If the rule has
actions
, you must also have read
privileges for the Management >
Actions and Connectors feature. For more details, refer to
Feature privileges.
Path parameters
edit-
id
- (Required, string) The ID of the rule that you want to update.
-
space_id
-
(Optional, string) An identifier for the space. If
space_id
is not provided in the URL, the default space is used.
Request body
edit-
actions
-
(Optional, object array) An array of action objects. The default value is an empty array (
[]
).Properties of the action objects:
-
group
-
(Required, string) Grouping actions is recommended for escalations for different
types of alerts. If you don’t need this, set the value to
default
. -
id
- (Required, string) The identifier of the action.
-
params
-
(Required, object) The map to the
params
that the connector type will receive. Theparams
are handled as Mustache templates and passed a default set of context.
-
-
name
- (Required, string) A name to reference and search.
-
notify_when
-
(Required, string) The condition for throttling the notification:
onActionGroupChange
,onActiveAlert
, oronThrottleInterval
. -
params
-
(Required, object) The parameters to pass to the rule type executor
params
value. This will also validate against the rule type params validator, if defined. -
schedule
-
(Required, object) When to run this rule. Use one of the available schedule formats.
Schedule formats
A schedule uses a
key: value
format. Kibana currently supports the interval format, which specifies the interval in seconds, minutes, hours, or days at which to run the rule. For example:{ "interval": "10s" }
,{ "interval": "5m" }
,{ "interval": "1h" }
, or{ "interval": "1d" }
. -
tags
-
(Optional, string array) A list of keywords to reference and search. The default
value is an empty array (
[]
). -
throttle
-
(Optional, string) How often this rule should fire the same actions. This will
prevent the rule from sending out the same notification over and over. For
example, if a rule with a
schedule
of 1 minute stays in a triggered state for 90 minutes, setting athrottle
of10m
or1h
will prevent it from sending 90 notifications during this period. The default value isnull
.
Response codes
edit-
200
- Indicates a successful call.
Examples
editUpdate an index threshold rule with ID ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74
:
PUT api/alerting/rule/ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74 { "notify_when": "onActionGroupChange", "params": { "index":[".test-index"], "timeField":"@timestamp", "groupBy":"top", "aggType":"avg", "timeWindowSize":5, "timeWindowUnit":"m", "thresholdComparator":">", "threshold":[1000], "aggField":"sheet.version", "termField":"name.keyword", "termSize":6 }, "schedule": { "interval": "1m" }, "actions": [], "tags": [], "name": "new name", "throttle": null }
The API returns the following:
{ "id": "ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74", "consumer": "alerts", "tags": [], "name": "new name", "enabled": true, "throttle": null, "schedule": { "interval": "1m" }, "params": { "index": [".updated-index"], "timeField": "@timestamp", "groupBy": "top", "aggType": "avg", "timeWindowSize": 5, "timeWindowUnit": "m", "thresholdComparator": ">", "threshold": [1000], "aggField": "sheet.version", "termField": "name.keyword", "termSize": 6 }, "api_key_owner": "elastic", "created_by": "elastic", "updated_by": "elastic", "rule_type_id": ".index-threshold", "scheduled_task_id": "4c5eda00-e74f-11ec-b72f-5b18752ff9ea", "created_at": "2022-12-12T22:43:20.578Z", "updated_at": "2022-12-12T22:44:21.783Z", "notify_when": "onActionGroupChange", "mute_all": false, "muted_alert_ids": [], "execution_status": { "status": "ok", "last_execution_date": "2022-12-12T22:43:21.723Z", "last_duration": 125 }, "actions":[], "last_run":{ "alerts_count": { "new": 0, "ignored": 0, "recovered": 0, "active": 0 }, "outcome_msg" :null, "warning": null, "outcome": "succeeded" }, "next_run": "2022-12-12T22:44:21.653Z" }