[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-kibana-alerting-rules":3,"mdc-v0z9tg-key":34,"related-org-elastic-kibana-alerting-rules":3724,"related-repo-elastic-kibana-alerting-rules":3893},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"kibana-alerting-rules","manage Kibana alerting rules","Create and manage Kibana alerting rules via REST API or Terraform. Use when creating, updating, or managing rule lifecycle (enable, disable, mute, snooze) or rules-as-code workflows.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,19,20],{"name":13,"slug":14,"type":15},"Alerting","alerting","tag",{"name":17,"slug":18,"type":15},"Monitoring","monitoring",{"name":9,"slug":8,"type":15},{"name":21,"slug":22,"type":15},"Kibana","kibana",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:50.009104",null,41,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fkibana\u002Fkibana-alerting-rules","---\nname: kibana-alerting-rules\ndescription: >\n Create and manage Kibana alerting rules via REST API or Terraform. Use when creating,\n updating, or managing rule lifecycle (enable, disable, mute, snooze) or rules-as-code\n workflows.\nmetadata:\n author: elastic\n version: 0.1.0\n---\n\n# Kibana Alerting Rules\n\n## Core Concepts\n\nA rule has three parts: **conditions** (what to detect), **schedule** (how often to check), and **actions** (what\nhappens when conditions are met). When conditions are met, the rule creates **alerts**, which trigger **actions** via\n**connectors**.\n\n## Authentication\n\nAll alerting API calls require either API key auth or Basic auth. Every mutating request must include the `kbn-xsrf`\nheader.\n\n```http\nkbn-xsrf: true\n```\n\n## Required Privileges\n\n- `all` privileges for the appropriate Kibana feature (e.g., Stack Rules, Observability, Security)\n- `read` privileges for Actions and Connectors (to attach actions to rules)\n\n## API Reference\n\nBase path: `\u003Ckibana_url>\u002Fapi\u002Falerting` (or `\u002Fs\u002F\u003Cspace_id>\u002Fapi\u002Falerting` for non-default spaces).\n\n| Operation | Method | Endpoint |\n| ----------------- | ------ | ---------------------------------------------------------- |\n| Create rule | POST | `\u002Fapi\u002Falerting\u002Frule\u002F{id}` |\n| Update rule | PUT | `\u002Fapi\u002Falerting\u002Frule\u002F{id}` |\n| Get rule | GET | `\u002Fapi\u002Falerting\u002Frule\u002F{id}` |\n| Delete rule | DELETE | `\u002Fapi\u002Falerting\u002Frule\u002F{id}` |\n| Find rules | GET | `\u002Fapi\u002Falerting\u002Frules\u002F_find` |\n| List rule types | GET | `\u002Fapi\u002Falerting\u002Frule_types` |\n| Enable rule | POST | `\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_enable` |\n| Disable rule | POST | `\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_disable` |\n| Mute all alerts | POST | `\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_mute_all` |\n| Unmute all alerts | POST | `\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_unmute_all` |\n| Mute alert | POST | `\u002Fapi\u002Falerting\u002Frule\u002F{rule_id}\u002Falert\u002F{alert_id}\u002F_mute` |\n| Unmute alert | POST | `\u002Fapi\u002Falerting\u002Frule\u002F{rule_id}\u002Falert\u002F{alert_id}\u002F_unmute` |\n| Update API key | POST | `\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_update_api_key` |\n| Create snooze | POST | `\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002Fsnooze_schedule` |\n| Delete snooze | DELETE | `\u002Fapi\u002Falerting\u002Frule\u002F{ruleId}\u002Fsnooze_schedule\u002F{scheduleId}` |\n| Health check | GET | `\u002Fapi\u002Falerting\u002F_health` |\n\n## Creating a Rule\n\n### Required Fields\n\n| Field | Type | Description |\n| -------------- | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `name` | string | Display name (does not need to be unique) |\n| `rule_type_id` | string | The rule type (e.g., `.es-query`, `.index-threshold`) |\n| `consumer` | string | Owning app: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, `uptime` |\n| `params` | object | Rule-type-specific parameters |\n| `schedule` | object | Check interval, e.g., `{\"interval\": \"5m\"}` |\n\n### Optional Fields\n\n| Field | Type | Description |\n| ------------- | ----------- | --------------------------------------------------------------------------------------------------- |\n| `actions` | array | Actions to run when conditions are met (each references a connector) |\n| `tags` | array | Tags for organizing rules |\n| `enabled` | boolean | Whether the rule runs immediately (default: true) |\n| `notify_when` | string | `onActionGroupChange`, `onActiveAlert`, or `onThrottleInterval` (prefer setting per-action instead) |\n| `alert_delay` | object | Alert only after N consecutive matches, e.g., `{\"active\": 3}` |\n| `flapping` | object\u002Fnull | Override flapping detection settings |\n\n### Example: Create an Elasticsearch Query Rule\n\n```bash\ncurl -X POST \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Falerting\u002Frule\u002Fmy-rule-id\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application\u002Fjson\" \\\n -H \"Authorization: ApiKey \u003Cyour-api-key>\" \\\n -d '{\n \"name\": \"High error rate\",\n \"rule_type_id\": \".es-query\",\n \"consumer\": \"stackAlerts\",\n \"schedule\": { \"interval\": \"5m\" },\n \"params\": {\n \"index\": [\"logs-*\"],\n \"timeField\": \"@timestamp\",\n \"esQuery\": \"{\\\"query\\\":{\\\"match\\\":{\\\"log.level\\\":\\\"error\\\"}}}\",\n \"threshold\": [100],\n \"thresholdComparator\": \">\",\n \"timeWindowSize\": 5,\n \"timeWindowUnit\": \"m\",\n \"size\": 100\n },\n \"actions\": [\n {\n \"id\": \"my-slack-connector-id\",\n \"group\": \"query matched\",\n \"params\": {\n \"message\": \"Alert: {{rule.name}} - {{context.hits}} hits detected\"\n },\n \"frequency\": {\n \"summary\": false,\n \"notify_when\": \"onActionGroupChange\"\n }\n }\n ],\n \"tags\": [\"production\", \"errors\"]\n }'\n```\n\nThe same structure applies to other rule types — set the appropriate `rule_type_id` (e.g., `.index-threshold`,\n`.es-query`) and provide the matching `params` object. Use `GET \u002Fapi\u002Falerting\u002Frule_types` to discover params schemas.\n\n## Updating a Rule\n\n`PUT \u002Fapi\u002Falerting\u002Frule\u002F{id}` — send the complete rule body. `rule_type_id` and `consumer` are immutable after creation.\nReturns **409 Conflict** if another user updated the rule concurrently; re-fetch and retry.\n\n## Finding Rules\n\n```bash\ncurl -X GET \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Falerting\u002Frules\u002F_find?per_page=20&page=1&search=cpu&sort_field=name&sort_order=asc\" \\\n -H \"Authorization: ApiKey \u003Cyour-api-key>\"\n```\n\nQuery parameters: `per_page`, `page`, `search`, `default_search_operator`, `search_fields`, `sort_field`, `sort_order`,\n`has_reference`, `fields`, `filter`, `filter_consumers`.\n\nUse the `filter` parameter with KQL syntax for advanced queries:\n\n```text\nfilter=alert.attributes.tags:\"production\"\n```\n\n## Lifecycle Operations\n\n```bash\n# Enable\ncurl -X POST \"...\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_enable\" -H \"kbn-xsrf: true\"\n\n# Disable\ncurl -X POST \"...\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_disable\" -H \"kbn-xsrf: true\"\n\n# Mute all alerts\ncurl -X POST \"...\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_mute_all\" -H \"kbn-xsrf: true\"\n\n# Mute specific alert\ncurl -X POST \"...\u002Fapi\u002Falerting\u002Frule\u002F{rule_id}\u002Falert\u002F{alert_id}\u002F_mute\" -H \"kbn-xsrf: true\"\n\n# Delete\ncurl -X DELETE \"...\u002Fapi\u002Falerting\u002Frule\u002F{id}\" -H \"kbn-xsrf: true\"\n```\n\n## Terraform Provider\n\nUse the `elasticstack` provider resource `elasticstack_kibana_alerting_rule`.\n\n```hcl\nterraform {\n required_providers {\n elasticstack = {\n source = \"elastic\u002Felasticstack\"\n }\n }\n}\n\nprovider \"elasticstack\" {\n kibana {\n endpoints = [\"https:\u002F\u002Fmy-kibana:5601\"]\n api_key = var.kibana_api_key\n }\n}\n\nresource \"elasticstack_kibana_alerting_rule\" \"cpu_alert\" {\n name = \"CPU usage critical\"\n consumer = \"stackAlerts\"\n rule_type_id = \".index-threshold\"\n interval = \"1m\"\n enabled = true\n\n params = jsonencode({\n index = [\"metrics-*\"]\n timeField = \"@timestamp\"\n aggType = \"avg\"\n aggField = \"system.cpu.total.pct\"\n groupBy = \"top\"\n termField = \"host.name\"\n termSize = 10\n threshold = [0.9]\n thresholdComparator = \">\"\n timeWindowSize = 5\n timeWindowUnit = \"m\"\n })\n\n tags = [\"infrastructure\", \"production\"]\n}\n```\n\n**Key Terraform notes:**\n\n- `params` must be passed as a JSON-encoded string via `jsonencode()`\n- Use `elasticstack_kibana_action_connector` data source or resource to reference connector IDs in actions\n- Import existing rules: `terraform import elasticstack_kibana_alerting_rule.my_rule \u003Cspace_id>\u002F\u003Crule_id>` (use\n `default` for the default space)\n\n## Triggering Kibana Workflows from Rules\n\n> **Preview feature** — available from Elastic Stack 9.3 and Elastic Cloud Serverless. APIs may change.\n\nAttach a workflow as a rule action using the workflow ID as the connector ID. Set `params: {}` — alert context flows\nautomatically through the `event` object inside the workflow.\n\n```bash\ncurl -X PUT \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Falerting\u002Frule\u002Fmy-rule-id\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application\u002Fjson\" \\\n -H \"Authorization: ApiKey \u003Cyour-api-key>\" \\\n -d '{\n \"name\": \"High error rate\",\n \"schedule\": { \"interval\": \"5m\" },\n \"params\": { ... },\n \"actions\": [\n {\n \"id\": \"\u003Cworkflow-id>\",\n \"group\": \"query matched\",\n \"params\": {},\n \"frequency\": { \"summary\": false, \"notify_when\": \"onActionGroupChange\" }\n }\n ]\n }'\n```\n\nIn the UI: **Stack Management > Rules > Actions > Workflows**. Only `enabled: true` workflows appear in the picker.\n\nFor workflow YAML structure, `{{ event }}` context fields, step types, and patterns, refer to the `kibana-connectors`\nskill if available.\n\n## Connectors and Actions in Rules\n\nEach action references a connector by ID, an action `group`, action `params` (using Mustache templates), and a\nper-action `frequency` object. Key fields:\n\n- `group` — which trigger state fires this action (e.g., `\"query matched\"`, `\"Recovered\"`). Discover valid groups via\n `GET \u002Fapi\u002Falerting\u002Frule_types`.\n- `frequency.summary` — `true` for a digest of all alerts; `false` for per-alert.\n- `frequency.notify_when` — `onActionGroupChange` | `onActiveAlert` | `onThrottleInterval`.\n- `frequency.throttle` — minimum repeat interval (e.g., `\"10m\"`); only applies with `onThrottleInterval`.\n\nFor full reference on action structure, Mustache variables (`{{rule.name}}`, `{{context.*}}`, `{{alerts.new.count}}`),\nMustache lambdas (`EvalMath`, `FormatDate`, `ParseHjson`), recovery actions, and multi-channel patterns, refer to the\n`kibana-connectors` skill if available.\n\n## Best Practices\n\n1. **Set action frequency per action, not per rule.** The `notify_when` field at the rule level is deprecated in favor\n of per-action `frequency` objects. If you set it at the rule level and later edit the rule in the Kibana UI, it is\n automatically converted to action-level values.\n\n2. **Use alert summaries to reduce notification noise.** Instead of sending one notification per alert, configure\n actions to send periodic summaries at a custom interval. Use `\"summary\": true` and set a `throttle` interval. This is\n especially valuable for rules that monitor many hosts or documents.\n\n3. **Choose the right action frequency for each channel.** Use `onActionGroupChange` for paging\u002Fticketing systems (fire\n once, resolve once). Use `onActiveAlert` for audit logging to an Index connector. Use `onThrottleInterval` with a\n throttle like `\"30m\"` for dashboards or lower-priority notifications.\n\n4. **Always add a recovery action.** Rules without a recovery action leave incidents open in PagerDuty, Jira, and\n ServiceNow indefinitely. Use the connector's native close\u002Fresolve event action (e.g., `eventAction: \"resolve\"` for\n PagerDuty) in the `Recovered` action group.\n\n5. **Set a reasonable check interval.** The minimum recommended interval is `1m`. Very short intervals across many rules\n clog Task Manager throughput and increase schedule drift. The server setting\n `xpack.alerting.rules.minimumScheduleInterval.value` enforces this.\n\n6. **Use `alert_delay` to suppress transient spikes.** Setting `{\"active\": 3}` means the alert only fires after 3\n consecutive runs match the condition, filtering out brief anomalies.\n\n7. **Enable flapping detection.** Alerts that rapidly switch between active and recovered are marked as \"flapping\" and\n notifications are suppressed. This is on by default but can be tuned per-rule with the `flapping` object.\n\n8. **Use `server.publicBaseUrl` for deep links.** Set `server.publicBaseUrl` in `kibana.yml` so that `{{rule.url}}` and\n `{{kibanaBaseUrl}}` variables resolve to valid URLs in notifications.\n\n9. **Tag rules consistently.** Use tags like `production`, `staging`, `team-platform` for filtering and organization in\n the Find API and UI.\n\n10. **Use Kibana Spaces** to isolate rules by team or environment. Prefix API paths with `\u002Fs\u002F\u003Cspace_id>\u002F` for\n non-default spaces. Connectors are also space-scoped, so create matching connectors in each space.\n\n## Common Pitfalls\n\n1. **Missing `kbn-xsrf` header.** All POST, PUT, DELETE requests require `kbn-xsrf: true` or any truthy value. Omitting\n it returns a 400 error.\n\n2. **Wrong `consumer` value.** Using an invalid consumer (e.g., `observability` instead of `infrastructure`) causes a\n 400 error. Check the rule type's supported consumers via `GET \u002Fapi\u002Falerting\u002Frule_types`.\n\n3. **Immutable fields on update.** You cannot change `rule_type_id` or `consumer` with PUT. You must delete and recreate\n the rule.\n\n4. **Rule-level `notify_when` and `throttle` are deprecated.** Setting these at the rule level still works but conflicts\n with action-level frequency settings. Always use `frequency` inside each action object.\n\n5. **Rule ID conflicts.** POST to `\u002Fapi\u002Falerting\u002Frule\u002F{id}` with an existing ID returns 409. Either omit the ID to\n auto-generate, or check existence first.\n\n6. **API key ownership.** Rules run using the API key of the user who created or last updated them. If that user's\n permissions change or the user is deleted, the rule may fail silently. Use `_update_api_key` to re-associate.\n\n7. **Too many actions per rule.** Rules generating thousands of alerts with multiple actions can clog Task Manager. The\n server setting `xpack.alerting.rules.run.actions.max` (default varies) limits actions per run. Design rules to use\n alert summaries or limit term sizes.\n\n8. **Long-running rules.** Rules that run expensive queries are cancelled after `xpack.alerting.rules.run.timeout`\n (default `5m`). When cancelled, all alerts and actions from that run are discarded. Optimize queries or increase the\n timeout for specific rule types.\n\n9. **Concurrent update conflicts.** PUT returns 409 if the rule was modified by another user since you last read it.\n Always GET the latest version before updating.\n\n10. **Import\u002Fexport loses secrets.** Rules exported via Saved Objects are disabled on import. Connectors lose their\n secrets and must be re-configured.\n\n## Examples\n\n**Create a threshold alert:** \"Alert me when CPU exceeds 90% on any host for 5 minutes.\" Use\n`rule_type_id: \".index-threshold\"`, `aggField: \"system.cpu.total.pct\"`, `threshold: [0.9]`, and `timeWindowSize: 5`.\nAttach a PagerDuty action on `\"threshold met\"` and a matching `Recovered` action to auto-close incidents.\n\n**Find rules by tag:** \"Show all production alerting rules.\" `GET \u002Fapi\u002Falerting\u002Frules\u002F_find` with\n`filter=alert.attributes.tags:\"production\"` and `sort_field=name` to page through results.\n\n**Pause a rule temporarily:** \"Disable rule abc123 until next Monday.\" `POST \u002Fapi\u002Falerting\u002Frule\u002Fabc123\u002F_disable`.\nRe-enable with `_enable` when ready; the rule retains all configuration while disabled.\n\n## Guidelines\n\n- Include `kbn-xsrf: true` on every POST, PUT, and DELETE; omitting it returns 400.\n- Set `frequency` inside each action object — rule-level `notify_when` and `throttle` are deprecated.\n- `rule_type_id` and `consumer` are immutable after creation; delete and recreate the rule to change them.\n- Prefix paths with `\u002Fs\u002F\u003Cspace_id>\u002Fapi\u002Falerting\u002F` for non-default Kibana Spaces.\n- Always pair an active action with a `Recovered` action to auto-close PagerDuty, Jira, and ServiceNow incidents.\n- Run `GET \u002Fapi\u002Falerting\u002Frule_types` first to discover valid `consumer` values and action group names.\n- Use `alert_delay` to suppress transient spikes; use the `flapping` object to reduce noise from unstable conditions.\n\n## Additional Resources\n\n- [Kibana Alerting API Reference](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fapi\u002Fdoc\u002Fkibana\u002Fgroup\u002Fendpoint-alerting)\n- [Alerting Concepts](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fexplore-analyze\u002Falerting\u002Falerts)\n- [Create and Manage Rules (UI)](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fexplore-analyze\u002Falerting\u002Falerts\u002Fcreate-manage-rules)\n- [Rule Action Variables](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fexplore-analyze\u002Falerting\u002Falerts\u002Frule-action-variables)\n- [Alerting Production Considerations](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fdeploy-manage\u002Fproduction-guidance\u002Fkibana-alerting-production-considerations)\n- [Terraform: elasticstack_kibana_alerting_rule](https:\u002F\u002Fregistry.terraform.io\u002Fproviders\u002Felastic\u002Felasticstack\u002Flatest\u002Fdocs\u002Fresources\u002Fkibana_alerting_rule)\n- [Terraform: Managing Kibana Rule and Connector Resources](https:\u002F\u002Fregistry.terraform.io\u002Fproviders\u002Felastic\u002Felasticstack\u002Flatest\u002Fdocs\u002Fguides\u002Felasticstack-kibana-rule)\n",{"data":35,"body":38},{"name":4,"description":6,"metadata":36},{"author":8,"version":37},"0.1.0",{"type":39,"children":40},"root",[41,49,56,104,110,124,145,151,178,184,205,575,581,588,824,830,1009,1015,1427,1468,1474,1506,1512,1572,1654,1666,1676,1682,1982,1988,2007,2317,2325,2378,2384,2398,2419,2635,2655,2676,2682,2710,2825,2881,2887,3170,3176,3394,3400,3455,3488,3514,3520,3637,3643,3718],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":48},"text","Kibana Alerting Rules",{"type":42,"tag":50,"props":51,"children":53},"h2",{"id":52},"core-concepts",[54],{"type":47,"value":55},"Core Concepts",{"type":42,"tag":57,"props":58,"children":59},"p",{},[60,62,68,70,75,77,82,84,89,91,95,97,102],{"type":47,"value":61},"A rule has three parts: ",{"type":42,"tag":63,"props":64,"children":65},"strong",{},[66],{"type":47,"value":67},"conditions",{"type":47,"value":69}," (what to detect), ",{"type":42,"tag":63,"props":71,"children":72},{},[73],{"type":47,"value":74},"schedule",{"type":47,"value":76}," (how often to check), and ",{"type":42,"tag":63,"props":78,"children":79},{},[80],{"type":47,"value":81},"actions",{"type":47,"value":83}," (what\nhappens when conditions are met). When conditions are met, the rule creates ",{"type":42,"tag":63,"props":85,"children":86},{},[87],{"type":47,"value":88},"alerts",{"type":47,"value":90},", which trigger ",{"type":42,"tag":63,"props":92,"children":93},{},[94],{"type":47,"value":81},{"type":47,"value":96}," via\n",{"type":42,"tag":63,"props":98,"children":99},{},[100],{"type":47,"value":101},"connectors",{"type":47,"value":103},".",{"type":42,"tag":50,"props":105,"children":107},{"id":106},"authentication",[108],{"type":47,"value":109},"Authentication",{"type":42,"tag":57,"props":111,"children":112},{},[113,115,122],{"type":47,"value":114},"All alerting API calls require either API key auth or Basic auth. Every mutating request must include the ",{"type":42,"tag":116,"props":117,"children":119},"code",{"className":118},[],[120],{"type":47,"value":121},"kbn-xsrf",{"type":47,"value":123},"\nheader.",{"type":42,"tag":125,"props":126,"children":131},"pre",{"className":127,"code":128,"language":129,"meta":130,"style":130},"language-http shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","kbn-xsrf: true\n","http","",[132],{"type":42,"tag":116,"props":133,"children":134},{"__ignoreMap":130},[135],{"type":42,"tag":136,"props":137,"children":140},"span",{"class":138,"line":139},"line",1,[141],{"type":42,"tag":136,"props":142,"children":143},{},[144],{"type":47,"value":128},{"type":42,"tag":50,"props":146,"children":148},{"id":147},"required-privileges",[149],{"type":47,"value":150},"Required Privileges",{"type":42,"tag":152,"props":153,"children":154},"ul",{},[155,167],{"type":42,"tag":156,"props":157,"children":158},"li",{},[159,165],{"type":42,"tag":116,"props":160,"children":162},{"className":161},[],[163],{"type":47,"value":164},"all",{"type":47,"value":166}," privileges for the appropriate Kibana feature (e.g., Stack Rules, Observability, Security)",{"type":42,"tag":156,"props":168,"children":169},{},[170,176],{"type":42,"tag":116,"props":171,"children":173},{"className":172},[],[174],{"type":47,"value":175},"read",{"type":47,"value":177}," privileges for Actions and Connectors (to attach actions to rules)",{"type":42,"tag":50,"props":179,"children":181},{"id":180},"api-reference",[182],{"type":47,"value":183},"API Reference",{"type":42,"tag":57,"props":185,"children":186},{},[187,189,195,197,203],{"type":47,"value":188},"Base path: ",{"type":42,"tag":116,"props":190,"children":192},{"className":191},[],[193],{"type":47,"value":194},"\u003Ckibana_url>\u002Fapi\u002Falerting",{"type":47,"value":196}," (or ",{"type":42,"tag":116,"props":198,"children":200},{"className":199},[],[201],{"type":47,"value":202},"\u002Fs\u002F\u003Cspace_id>\u002Fapi\u002Falerting",{"type":47,"value":204}," for non-default spaces).",{"type":42,"tag":206,"props":207,"children":208},"table",{},[209,233],{"type":42,"tag":210,"props":211,"children":212},"thead",{},[213],{"type":42,"tag":214,"props":215,"children":216},"tr",{},[217,223,228],{"type":42,"tag":218,"props":219,"children":220},"th",{},[221],{"type":47,"value":222},"Operation",{"type":42,"tag":218,"props":224,"children":225},{},[226],{"type":47,"value":227},"Method",{"type":42,"tag":218,"props":229,"children":230},{},[231],{"type":47,"value":232},"Endpoint",{"type":42,"tag":234,"props":235,"children":236},"tbody",{},[237,260,281,302,323,344,365,386,407,428,449,470,491,512,533,554],{"type":42,"tag":214,"props":238,"children":239},{},[240,246,251],{"type":42,"tag":241,"props":242,"children":243},"td",{},[244],{"type":47,"value":245},"Create rule",{"type":42,"tag":241,"props":247,"children":248},{},[249],{"type":47,"value":250},"POST",{"type":42,"tag":241,"props":252,"children":253},{},[254],{"type":42,"tag":116,"props":255,"children":257},{"className":256},[],[258],{"type":47,"value":259},"\u002Fapi\u002Falerting\u002Frule\u002F{id}",{"type":42,"tag":214,"props":261,"children":262},{},[263,268,273],{"type":42,"tag":241,"props":264,"children":265},{},[266],{"type":47,"value":267},"Update rule",{"type":42,"tag":241,"props":269,"children":270},{},[271],{"type":47,"value":272},"PUT",{"type":42,"tag":241,"props":274,"children":275},{},[276],{"type":42,"tag":116,"props":277,"children":279},{"className":278},[],[280],{"type":47,"value":259},{"type":42,"tag":214,"props":282,"children":283},{},[284,289,294],{"type":42,"tag":241,"props":285,"children":286},{},[287],{"type":47,"value":288},"Get rule",{"type":42,"tag":241,"props":290,"children":291},{},[292],{"type":47,"value":293},"GET",{"type":42,"tag":241,"props":295,"children":296},{},[297],{"type":42,"tag":116,"props":298,"children":300},{"className":299},[],[301],{"type":47,"value":259},{"type":42,"tag":214,"props":303,"children":304},{},[305,310,315],{"type":42,"tag":241,"props":306,"children":307},{},[308],{"type":47,"value":309},"Delete rule",{"type":42,"tag":241,"props":311,"children":312},{},[313],{"type":47,"value":314},"DELETE",{"type":42,"tag":241,"props":316,"children":317},{},[318],{"type":42,"tag":116,"props":319,"children":321},{"className":320},[],[322],{"type":47,"value":259},{"type":42,"tag":214,"props":324,"children":325},{},[326,331,335],{"type":42,"tag":241,"props":327,"children":328},{},[329],{"type":47,"value":330},"Find rules",{"type":42,"tag":241,"props":332,"children":333},{},[334],{"type":47,"value":293},{"type":42,"tag":241,"props":336,"children":337},{},[338],{"type":42,"tag":116,"props":339,"children":341},{"className":340},[],[342],{"type":47,"value":343},"\u002Fapi\u002Falerting\u002Frules\u002F_find",{"type":42,"tag":214,"props":345,"children":346},{},[347,352,356],{"type":42,"tag":241,"props":348,"children":349},{},[350],{"type":47,"value":351},"List rule types",{"type":42,"tag":241,"props":353,"children":354},{},[355],{"type":47,"value":293},{"type":42,"tag":241,"props":357,"children":358},{},[359],{"type":42,"tag":116,"props":360,"children":362},{"className":361},[],[363],{"type":47,"value":364},"\u002Fapi\u002Falerting\u002Frule_types",{"type":42,"tag":214,"props":366,"children":367},{},[368,373,377],{"type":42,"tag":241,"props":369,"children":370},{},[371],{"type":47,"value":372},"Enable rule",{"type":42,"tag":241,"props":374,"children":375},{},[376],{"type":47,"value":250},{"type":42,"tag":241,"props":378,"children":379},{},[380],{"type":42,"tag":116,"props":381,"children":383},{"className":382},[],[384],{"type":47,"value":385},"\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_enable",{"type":42,"tag":214,"props":387,"children":388},{},[389,394,398],{"type":42,"tag":241,"props":390,"children":391},{},[392],{"type":47,"value":393},"Disable rule",{"type":42,"tag":241,"props":395,"children":396},{},[397],{"type":47,"value":250},{"type":42,"tag":241,"props":399,"children":400},{},[401],{"type":42,"tag":116,"props":402,"children":404},{"className":403},[],[405],{"type":47,"value":406},"\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_disable",{"type":42,"tag":214,"props":408,"children":409},{},[410,415,419],{"type":42,"tag":241,"props":411,"children":412},{},[413],{"type":47,"value":414},"Mute all alerts",{"type":42,"tag":241,"props":416,"children":417},{},[418],{"type":47,"value":250},{"type":42,"tag":241,"props":420,"children":421},{},[422],{"type":42,"tag":116,"props":423,"children":425},{"className":424},[],[426],{"type":47,"value":427},"\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_mute_all",{"type":42,"tag":214,"props":429,"children":430},{},[431,436,440],{"type":42,"tag":241,"props":432,"children":433},{},[434],{"type":47,"value":435},"Unmute all alerts",{"type":42,"tag":241,"props":437,"children":438},{},[439],{"type":47,"value":250},{"type":42,"tag":241,"props":441,"children":442},{},[443],{"type":42,"tag":116,"props":444,"children":446},{"className":445},[],[447],{"type":47,"value":448},"\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_unmute_all",{"type":42,"tag":214,"props":450,"children":451},{},[452,457,461],{"type":42,"tag":241,"props":453,"children":454},{},[455],{"type":47,"value":456},"Mute alert",{"type":42,"tag":241,"props":458,"children":459},{},[460],{"type":47,"value":250},{"type":42,"tag":241,"props":462,"children":463},{},[464],{"type":42,"tag":116,"props":465,"children":467},{"className":466},[],[468],{"type":47,"value":469},"\u002Fapi\u002Falerting\u002Frule\u002F{rule_id}\u002Falert\u002F{alert_id}\u002F_mute",{"type":42,"tag":214,"props":471,"children":472},{},[473,478,482],{"type":42,"tag":241,"props":474,"children":475},{},[476],{"type":47,"value":477},"Unmute alert",{"type":42,"tag":241,"props":479,"children":480},{},[481],{"type":47,"value":250},{"type":42,"tag":241,"props":483,"children":484},{},[485],{"type":42,"tag":116,"props":486,"children":488},{"className":487},[],[489],{"type":47,"value":490},"\u002Fapi\u002Falerting\u002Frule\u002F{rule_id}\u002Falert\u002F{alert_id}\u002F_unmute",{"type":42,"tag":214,"props":492,"children":493},{},[494,499,503],{"type":42,"tag":241,"props":495,"children":496},{},[497],{"type":47,"value":498},"Update API key",{"type":42,"tag":241,"props":500,"children":501},{},[502],{"type":47,"value":250},{"type":42,"tag":241,"props":504,"children":505},{},[506],{"type":42,"tag":116,"props":507,"children":509},{"className":508},[],[510],{"type":47,"value":511},"\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_update_api_key",{"type":42,"tag":214,"props":513,"children":514},{},[515,520,524],{"type":42,"tag":241,"props":516,"children":517},{},[518],{"type":47,"value":519},"Create snooze",{"type":42,"tag":241,"props":521,"children":522},{},[523],{"type":47,"value":250},{"type":42,"tag":241,"props":525,"children":526},{},[527],{"type":42,"tag":116,"props":528,"children":530},{"className":529},[],[531],{"type":47,"value":532},"\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002Fsnooze_schedule",{"type":42,"tag":214,"props":534,"children":535},{},[536,541,545],{"type":42,"tag":241,"props":537,"children":538},{},[539],{"type":47,"value":540},"Delete snooze",{"type":42,"tag":241,"props":542,"children":543},{},[544],{"type":47,"value":314},{"type":42,"tag":241,"props":546,"children":547},{},[548],{"type":42,"tag":116,"props":549,"children":551},{"className":550},[],[552],{"type":47,"value":553},"\u002Fapi\u002Falerting\u002Frule\u002F{ruleId}\u002Fsnooze_schedule\u002F{scheduleId}",{"type":42,"tag":214,"props":555,"children":556},{},[557,562,566],{"type":42,"tag":241,"props":558,"children":559},{},[560],{"type":47,"value":561},"Health check",{"type":42,"tag":241,"props":563,"children":564},{},[565],{"type":47,"value":293},{"type":42,"tag":241,"props":567,"children":568},{},[569],{"type":42,"tag":116,"props":570,"children":572},{"className":571},[],[573],{"type":47,"value":574},"\u002Fapi\u002Falerting\u002F_health",{"type":42,"tag":50,"props":576,"children":578},{"id":577},"creating-a-rule",[579],{"type":47,"value":580},"Creating a Rule",{"type":42,"tag":582,"props":583,"children":585},"h3",{"id":584},"required-fields",[586],{"type":47,"value":587},"Required Fields",{"type":42,"tag":206,"props":589,"children":590},{},[591,612],{"type":42,"tag":210,"props":592,"children":593},{},[594],{"type":42,"tag":214,"props":595,"children":596},{},[597,602,607],{"type":42,"tag":218,"props":598,"children":599},{},[600],{"type":47,"value":601},"Field",{"type":42,"tag":218,"props":603,"children":604},{},[605],{"type":47,"value":606},"Type",{"type":42,"tag":218,"props":608,"children":609},{},[610],{"type":47,"value":611},"Description",{"type":42,"tag":234,"props":613,"children":614},{},[615,637,674,776,798],{"type":42,"tag":214,"props":616,"children":617},{},[618,627,632],{"type":42,"tag":241,"props":619,"children":620},{},[621],{"type":42,"tag":116,"props":622,"children":624},{"className":623},[],[625],{"type":47,"value":626},"name",{"type":42,"tag":241,"props":628,"children":629},{},[630],{"type":47,"value":631},"string",{"type":42,"tag":241,"props":633,"children":634},{},[635],{"type":47,"value":636},"Display name (does not need to be unique)",{"type":42,"tag":214,"props":638,"children":639},{},[640,649,653],{"type":42,"tag":241,"props":641,"children":642},{},[643],{"type":42,"tag":116,"props":644,"children":646},{"className":645},[],[647],{"type":47,"value":648},"rule_type_id",{"type":42,"tag":241,"props":650,"children":651},{},[652],{"type":47,"value":631},{"type":42,"tag":241,"props":654,"children":655},{},[656,658,664,666,672],{"type":47,"value":657},"The rule type (e.g., ",{"type":42,"tag":116,"props":659,"children":661},{"className":660},[],[662],{"type":47,"value":663},".es-query",{"type":47,"value":665},", ",{"type":42,"tag":116,"props":667,"children":669},{"className":668},[],[670],{"type":47,"value":671},".index-threshold",{"type":47,"value":673},")",{"type":42,"tag":214,"props":675,"children":676},{},[677,686,690],{"type":42,"tag":241,"props":678,"children":679},{},[680],{"type":42,"tag":116,"props":681,"children":683},{"className":682},[],[684],{"type":47,"value":685},"consumer",{"type":42,"tag":241,"props":687,"children":688},{},[689],{"type":47,"value":631},{"type":42,"tag":241,"props":691,"children":692},{},[693,695,700,701,707,708,714,715,721,722,728,729,735,736,742,743,748,749,755,756,762,763,769,770],{"type":47,"value":694},"Owning app: ",{"type":42,"tag":116,"props":696,"children":698},{"className":697},[],[699],{"type":47,"value":88},{"type":47,"value":665},{"type":42,"tag":116,"props":702,"children":704},{"className":703},[],[705],{"type":47,"value":706},"apm",{"type":47,"value":665},{"type":42,"tag":116,"props":709,"children":711},{"className":710},[],[712],{"type":47,"value":713},"discover",{"type":47,"value":665},{"type":42,"tag":116,"props":716,"children":718},{"className":717},[],[719],{"type":47,"value":720},"infrastructure",{"type":47,"value":665},{"type":42,"tag":116,"props":723,"children":725},{"className":724},[],[726],{"type":47,"value":727},"logs",{"type":47,"value":665},{"type":42,"tag":116,"props":730,"children":732},{"className":731},[],[733],{"type":47,"value":734},"metrics",{"type":47,"value":665},{"type":42,"tag":116,"props":737,"children":739},{"className":738},[],[740],{"type":47,"value":741},"ml",{"type":47,"value":665},{"type":42,"tag":116,"props":744,"children":746},{"className":745},[],[747],{"type":47,"value":18},{"type":47,"value":665},{"type":42,"tag":116,"props":750,"children":752},{"className":751},[],[753],{"type":47,"value":754},"securitySolution",{"type":47,"value":665},{"type":42,"tag":116,"props":757,"children":759},{"className":758},[],[760],{"type":47,"value":761},"siem",{"type":47,"value":665},{"type":42,"tag":116,"props":764,"children":766},{"className":765},[],[767],{"type":47,"value":768},"stackAlerts",{"type":47,"value":665},{"type":42,"tag":116,"props":771,"children":773},{"className":772},[],[774],{"type":47,"value":775},"uptime",{"type":42,"tag":214,"props":777,"children":778},{},[779,788,793],{"type":42,"tag":241,"props":780,"children":781},{},[782],{"type":42,"tag":116,"props":783,"children":785},{"className":784},[],[786],{"type":47,"value":787},"params",{"type":42,"tag":241,"props":789,"children":790},{},[791],{"type":47,"value":792},"object",{"type":42,"tag":241,"props":794,"children":795},{},[796],{"type":47,"value":797},"Rule-type-specific parameters",{"type":42,"tag":214,"props":799,"children":800},{},[801,809,813],{"type":42,"tag":241,"props":802,"children":803},{},[804],{"type":42,"tag":116,"props":805,"children":807},{"className":806},[],[808],{"type":47,"value":74},{"type":42,"tag":241,"props":810,"children":811},{},[812],{"type":47,"value":792},{"type":42,"tag":241,"props":814,"children":815},{},[816,818],{"type":47,"value":817},"Check interval, e.g., ",{"type":42,"tag":116,"props":819,"children":821},{"className":820},[],[822],{"type":47,"value":823},"{\"interval\": \"5m\"}",{"type":42,"tag":582,"props":825,"children":827},{"id":826},"optional-fields",[828],{"type":47,"value":829},"Optional Fields",{"type":42,"tag":206,"props":831,"children":832},{},[833,851],{"type":42,"tag":210,"props":834,"children":835},{},[836],{"type":42,"tag":214,"props":837,"children":838},{},[839,843,847],{"type":42,"tag":218,"props":840,"children":841},{},[842],{"type":47,"value":601},{"type":42,"tag":218,"props":844,"children":845},{},[846],{"type":47,"value":606},{"type":42,"tag":218,"props":848,"children":849},{},[850],{"type":47,"value":611},{"type":42,"tag":234,"props":852,"children":853},{},[854,875,896,918,960,987],{"type":42,"tag":214,"props":855,"children":856},{},[857,865,870],{"type":42,"tag":241,"props":858,"children":859},{},[860],{"type":42,"tag":116,"props":861,"children":863},{"className":862},[],[864],{"type":47,"value":81},{"type":42,"tag":241,"props":866,"children":867},{},[868],{"type":47,"value":869},"array",{"type":42,"tag":241,"props":871,"children":872},{},[873],{"type":47,"value":874},"Actions to run when conditions are met (each references a connector)",{"type":42,"tag":214,"props":876,"children":877},{},[878,887,891],{"type":42,"tag":241,"props":879,"children":880},{},[881],{"type":42,"tag":116,"props":882,"children":884},{"className":883},[],[885],{"type":47,"value":886},"tags",{"type":42,"tag":241,"props":888,"children":889},{},[890],{"type":47,"value":869},{"type":42,"tag":241,"props":892,"children":893},{},[894],{"type":47,"value":895},"Tags for organizing rules",{"type":42,"tag":214,"props":897,"children":898},{},[899,908,913],{"type":42,"tag":241,"props":900,"children":901},{},[902],{"type":42,"tag":116,"props":903,"children":905},{"className":904},[],[906],{"type":47,"value":907},"enabled",{"type":42,"tag":241,"props":909,"children":910},{},[911],{"type":47,"value":912},"boolean",{"type":42,"tag":241,"props":914,"children":915},{},[916],{"type":47,"value":917},"Whether the rule runs immediately (default: true)",{"type":42,"tag":214,"props":919,"children":920},{},[921,930,934],{"type":42,"tag":241,"props":922,"children":923},{},[924],{"type":42,"tag":116,"props":925,"children":927},{"className":926},[],[928],{"type":47,"value":929},"notify_when",{"type":42,"tag":241,"props":931,"children":932},{},[933],{"type":47,"value":631},{"type":42,"tag":241,"props":935,"children":936},{},[937,943,944,950,952,958],{"type":42,"tag":116,"props":938,"children":940},{"className":939},[],[941],{"type":47,"value":942},"onActionGroupChange",{"type":47,"value":665},{"type":42,"tag":116,"props":945,"children":947},{"className":946},[],[948],{"type":47,"value":949},"onActiveAlert",{"type":47,"value":951},", or ",{"type":42,"tag":116,"props":953,"children":955},{"className":954},[],[956],{"type":47,"value":957},"onThrottleInterval",{"type":47,"value":959}," (prefer setting per-action instead)",{"type":42,"tag":214,"props":961,"children":962},{},[963,972,976],{"type":42,"tag":241,"props":964,"children":965},{},[966],{"type":42,"tag":116,"props":967,"children":969},{"className":968},[],[970],{"type":47,"value":971},"alert_delay",{"type":42,"tag":241,"props":973,"children":974},{},[975],{"type":47,"value":792},{"type":42,"tag":241,"props":977,"children":978},{},[979,981],{"type":47,"value":980},"Alert only after N consecutive matches, e.g., ",{"type":42,"tag":116,"props":982,"children":984},{"className":983},[],[985],{"type":47,"value":986},"{\"active\": 3}",{"type":42,"tag":214,"props":988,"children":989},{},[990,999,1004],{"type":42,"tag":241,"props":991,"children":992},{},[993],{"type":42,"tag":116,"props":994,"children":996},{"className":995},[],[997],{"type":47,"value":998},"flapping",{"type":42,"tag":241,"props":1000,"children":1001},{},[1002],{"type":47,"value":1003},"object\u002Fnull",{"type":42,"tag":241,"props":1005,"children":1006},{},[1007],{"type":47,"value":1008},"Override flapping detection settings",{"type":42,"tag":582,"props":1010,"children":1012},{"id":1011},"example-create-an-elasticsearch-query-rule",[1013],{"type":47,"value":1014},"Example: Create an Elasticsearch Query Rule",{"type":42,"tag":125,"props":1016,"children":1020},{"className":1017,"code":1018,"language":1019,"meta":130,"style":130},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -X POST \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Falerting\u002Frule\u002Fmy-rule-id\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application\u002Fjson\" \\\n -H \"Authorization: ApiKey \u003Cyour-api-key>\" \\\n -d '{\n \"name\": \"High error rate\",\n \"rule_type_id\": \".es-query\",\n \"consumer\": \"stackAlerts\",\n \"schedule\": { \"interval\": \"5m\" },\n \"params\": {\n \"index\": [\"logs-*\"],\n \"timeField\": \"@timestamp\",\n \"esQuery\": \"{\\\"query\\\":{\\\"match\\\":{\\\"log.level\\\":\\\"error\\\"}}}\",\n \"threshold\": [100],\n \"thresholdComparator\": \">\",\n \"timeWindowSize\": 5,\n \"timeWindowUnit\": \"m\",\n \"size\": 100\n },\n \"actions\": [\n {\n \"id\": \"my-slack-connector-id\",\n \"group\": \"query matched\",\n \"params\": {\n \"message\": \"Alert: {{rule.name}} - {{context.hits}} hits detected\"\n },\n \"frequency\": {\n \"summary\": false,\n \"notify_when\": \"onActionGroupChange\"\n }\n }\n ],\n \"tags\": [\"production\", \"errors\"]\n }'\n","bash",[1021],{"type":42,"tag":116,"props":1022,"children":1023},{"__ignoreMap":130},[1024,1066,1092,1117,1142,1161,1170,1179,1188,1197,1206,1215,1224,1233,1242,1251,1260,1269,1278,1287,1296,1305,1314,1323,1332,1341,1350,1359,1368,1377,1386,1395,1404,1413],{"type":42,"tag":136,"props":1025,"children":1026},{"class":138,"line":139},[1027,1033,1039,1044,1050,1055,1060],{"type":42,"tag":136,"props":1028,"children":1030},{"style":1029},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1031],{"type":47,"value":1032},"curl",{"type":42,"tag":136,"props":1034,"children":1036},{"style":1035},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1037],{"type":47,"value":1038}," -X",{"type":42,"tag":136,"props":1040,"children":1041},{"style":1035},[1042],{"type":47,"value":1043}," POST",{"type":42,"tag":136,"props":1045,"children":1047},{"style":1046},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[1048],{"type":47,"value":1049}," \"",{"type":42,"tag":136,"props":1051,"children":1052},{"style":1035},[1053],{"type":47,"value":1054},"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Falerting\u002Frule\u002Fmy-rule-id",{"type":42,"tag":136,"props":1056,"children":1057},{"style":1046},[1058],{"type":47,"value":1059},"\"",{"type":42,"tag":136,"props":1061,"children":1063},{"style":1062},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[1064],{"type":47,"value":1065}," \\\n",{"type":42,"tag":136,"props":1067,"children":1069},{"class":138,"line":1068},2,[1070,1075,1079,1084,1088],{"type":42,"tag":136,"props":1071,"children":1072},{"style":1035},[1073],{"type":47,"value":1074}," -H",{"type":42,"tag":136,"props":1076,"children":1077},{"style":1046},[1078],{"type":47,"value":1049},{"type":42,"tag":136,"props":1080,"children":1081},{"style":1035},[1082],{"type":47,"value":1083},"kbn-xsrf: true",{"type":42,"tag":136,"props":1085,"children":1086},{"style":1046},[1087],{"type":47,"value":1059},{"type":42,"tag":136,"props":1089,"children":1090},{"style":1062},[1091],{"type":47,"value":1065},{"type":42,"tag":136,"props":1093,"children":1095},{"class":138,"line":1094},3,[1096,1100,1104,1109,1113],{"type":42,"tag":136,"props":1097,"children":1098},{"style":1035},[1099],{"type":47,"value":1074},{"type":42,"tag":136,"props":1101,"children":1102},{"style":1046},[1103],{"type":47,"value":1049},{"type":42,"tag":136,"props":1105,"children":1106},{"style":1035},[1107],{"type":47,"value":1108},"Content-Type: application\u002Fjson",{"type":42,"tag":136,"props":1110,"children":1111},{"style":1046},[1112],{"type":47,"value":1059},{"type":42,"tag":136,"props":1114,"children":1115},{"style":1062},[1116],{"type":47,"value":1065},{"type":42,"tag":136,"props":1118,"children":1120},{"class":138,"line":1119},4,[1121,1125,1129,1134,1138],{"type":42,"tag":136,"props":1122,"children":1123},{"style":1035},[1124],{"type":47,"value":1074},{"type":42,"tag":136,"props":1126,"children":1127},{"style":1046},[1128],{"type":47,"value":1049},{"type":42,"tag":136,"props":1130,"children":1131},{"style":1035},[1132],{"type":47,"value":1133},"Authorization: ApiKey \u003Cyour-api-key>",{"type":42,"tag":136,"props":1135,"children":1136},{"style":1046},[1137],{"type":47,"value":1059},{"type":42,"tag":136,"props":1139,"children":1140},{"style":1062},[1141],{"type":47,"value":1065},{"type":42,"tag":136,"props":1143,"children":1145},{"class":138,"line":1144},5,[1146,1151,1156],{"type":42,"tag":136,"props":1147,"children":1148},{"style":1035},[1149],{"type":47,"value":1150}," -d",{"type":42,"tag":136,"props":1152,"children":1153},{"style":1046},[1154],{"type":47,"value":1155}," '",{"type":42,"tag":136,"props":1157,"children":1158},{"style":1035},[1159],{"type":47,"value":1160},"{\n",{"type":42,"tag":136,"props":1162,"children":1164},{"class":138,"line":1163},6,[1165],{"type":42,"tag":136,"props":1166,"children":1167},{"style":1035},[1168],{"type":47,"value":1169}," \"name\": \"High error rate\",\n",{"type":42,"tag":136,"props":1171,"children":1173},{"class":138,"line":1172},7,[1174],{"type":42,"tag":136,"props":1175,"children":1176},{"style":1035},[1177],{"type":47,"value":1178}," \"rule_type_id\": \".es-query\",\n",{"type":42,"tag":136,"props":1180,"children":1182},{"class":138,"line":1181},8,[1183],{"type":42,"tag":136,"props":1184,"children":1185},{"style":1035},[1186],{"type":47,"value":1187}," \"consumer\": \"stackAlerts\",\n",{"type":42,"tag":136,"props":1189,"children":1191},{"class":138,"line":1190},9,[1192],{"type":42,"tag":136,"props":1193,"children":1194},{"style":1035},[1195],{"type":47,"value":1196}," \"schedule\": { \"interval\": \"5m\" },\n",{"type":42,"tag":136,"props":1198,"children":1200},{"class":138,"line":1199},10,[1201],{"type":42,"tag":136,"props":1202,"children":1203},{"style":1035},[1204],{"type":47,"value":1205}," \"params\": {\n",{"type":42,"tag":136,"props":1207,"children":1209},{"class":138,"line":1208},11,[1210],{"type":42,"tag":136,"props":1211,"children":1212},{"style":1035},[1213],{"type":47,"value":1214}," \"index\": [\"logs-*\"],\n",{"type":42,"tag":136,"props":1216,"children":1218},{"class":138,"line":1217},12,[1219],{"type":42,"tag":136,"props":1220,"children":1221},{"style":1035},[1222],{"type":47,"value":1223}," \"timeField\": \"@timestamp\",\n",{"type":42,"tag":136,"props":1225,"children":1227},{"class":138,"line":1226},13,[1228],{"type":42,"tag":136,"props":1229,"children":1230},{"style":1035},[1231],{"type":47,"value":1232}," \"esQuery\": \"{\\\"query\\\":{\\\"match\\\":{\\\"log.level\\\":\\\"error\\\"}}}\",\n",{"type":42,"tag":136,"props":1234,"children":1236},{"class":138,"line":1235},14,[1237],{"type":42,"tag":136,"props":1238,"children":1239},{"style":1035},[1240],{"type":47,"value":1241}," \"threshold\": [100],\n",{"type":42,"tag":136,"props":1243,"children":1245},{"class":138,"line":1244},15,[1246],{"type":42,"tag":136,"props":1247,"children":1248},{"style":1035},[1249],{"type":47,"value":1250}," \"thresholdComparator\": \">\",\n",{"type":42,"tag":136,"props":1252,"children":1254},{"class":138,"line":1253},16,[1255],{"type":42,"tag":136,"props":1256,"children":1257},{"style":1035},[1258],{"type":47,"value":1259}," \"timeWindowSize\": 5,\n",{"type":42,"tag":136,"props":1261,"children":1263},{"class":138,"line":1262},17,[1264],{"type":42,"tag":136,"props":1265,"children":1266},{"style":1035},[1267],{"type":47,"value":1268}," \"timeWindowUnit\": \"m\",\n",{"type":42,"tag":136,"props":1270,"children":1272},{"class":138,"line":1271},18,[1273],{"type":42,"tag":136,"props":1274,"children":1275},{"style":1035},[1276],{"type":47,"value":1277}," \"size\": 100\n",{"type":42,"tag":136,"props":1279,"children":1281},{"class":138,"line":1280},19,[1282],{"type":42,"tag":136,"props":1283,"children":1284},{"style":1035},[1285],{"type":47,"value":1286}," },\n",{"type":42,"tag":136,"props":1288,"children":1290},{"class":138,"line":1289},20,[1291],{"type":42,"tag":136,"props":1292,"children":1293},{"style":1035},[1294],{"type":47,"value":1295}," \"actions\": [\n",{"type":42,"tag":136,"props":1297,"children":1299},{"class":138,"line":1298},21,[1300],{"type":42,"tag":136,"props":1301,"children":1302},{"style":1035},[1303],{"type":47,"value":1304}," {\n",{"type":42,"tag":136,"props":1306,"children":1308},{"class":138,"line":1307},22,[1309],{"type":42,"tag":136,"props":1310,"children":1311},{"style":1035},[1312],{"type":47,"value":1313}," \"id\": \"my-slack-connector-id\",\n",{"type":42,"tag":136,"props":1315,"children":1317},{"class":138,"line":1316},23,[1318],{"type":42,"tag":136,"props":1319,"children":1320},{"style":1035},[1321],{"type":47,"value":1322}," \"group\": \"query matched\",\n",{"type":42,"tag":136,"props":1324,"children":1326},{"class":138,"line":1325},24,[1327],{"type":42,"tag":136,"props":1328,"children":1329},{"style":1035},[1330],{"type":47,"value":1331}," \"params\": {\n",{"type":42,"tag":136,"props":1333,"children":1335},{"class":138,"line":1334},25,[1336],{"type":42,"tag":136,"props":1337,"children":1338},{"style":1035},[1339],{"type":47,"value":1340}," \"message\": \"Alert: {{rule.name}} - {{context.hits}} hits detected\"\n",{"type":42,"tag":136,"props":1342,"children":1344},{"class":138,"line":1343},26,[1345],{"type":42,"tag":136,"props":1346,"children":1347},{"style":1035},[1348],{"type":47,"value":1349}," },\n",{"type":42,"tag":136,"props":1351,"children":1353},{"class":138,"line":1352},27,[1354],{"type":42,"tag":136,"props":1355,"children":1356},{"style":1035},[1357],{"type":47,"value":1358}," \"frequency\": {\n",{"type":42,"tag":136,"props":1360,"children":1362},{"class":138,"line":1361},28,[1363],{"type":42,"tag":136,"props":1364,"children":1365},{"style":1035},[1366],{"type":47,"value":1367}," \"summary\": false,\n",{"type":42,"tag":136,"props":1369,"children":1371},{"class":138,"line":1370},29,[1372],{"type":42,"tag":136,"props":1373,"children":1374},{"style":1035},[1375],{"type":47,"value":1376}," \"notify_when\": \"onActionGroupChange\"\n",{"type":42,"tag":136,"props":1378,"children":1380},{"class":138,"line":1379},30,[1381],{"type":42,"tag":136,"props":1382,"children":1383},{"style":1035},[1384],{"type":47,"value":1385}," }\n",{"type":42,"tag":136,"props":1387,"children":1389},{"class":138,"line":1388},31,[1390],{"type":42,"tag":136,"props":1391,"children":1392},{"style":1035},[1393],{"type":47,"value":1394}," }\n",{"type":42,"tag":136,"props":1396,"children":1398},{"class":138,"line":1397},32,[1399],{"type":42,"tag":136,"props":1400,"children":1401},{"style":1035},[1402],{"type":47,"value":1403}," ],\n",{"type":42,"tag":136,"props":1405,"children":1407},{"class":138,"line":1406},33,[1408],{"type":42,"tag":136,"props":1409,"children":1410},{"style":1035},[1411],{"type":47,"value":1412}," \"tags\": [\"production\", \"errors\"]\n",{"type":42,"tag":136,"props":1414,"children":1416},{"class":138,"line":1415},34,[1417,1422],{"type":42,"tag":136,"props":1418,"children":1419},{"style":1035},[1420],{"type":47,"value":1421}," }",{"type":42,"tag":136,"props":1423,"children":1424},{"style":1046},[1425],{"type":47,"value":1426},"'\n",{"type":42,"tag":57,"props":1428,"children":1429},{},[1430,1432,1437,1439,1444,1446,1451,1453,1458,1460,1466],{"type":47,"value":1431},"The same structure applies to other rule types — set the appropriate ",{"type":42,"tag":116,"props":1433,"children":1435},{"className":1434},[],[1436],{"type":47,"value":648},{"type":47,"value":1438}," (e.g., ",{"type":42,"tag":116,"props":1440,"children":1442},{"className":1441},[],[1443],{"type":47,"value":671},{"type":47,"value":1445},",\n",{"type":42,"tag":116,"props":1447,"children":1449},{"className":1448},[],[1450],{"type":47,"value":663},{"type":47,"value":1452},") and provide the matching ",{"type":42,"tag":116,"props":1454,"children":1456},{"className":1455},[],[1457],{"type":47,"value":787},{"type":47,"value":1459}," object. Use ",{"type":42,"tag":116,"props":1461,"children":1463},{"className":1462},[],[1464],{"type":47,"value":1465},"GET \u002Fapi\u002Falerting\u002Frule_types",{"type":47,"value":1467}," to discover params schemas.",{"type":42,"tag":50,"props":1469,"children":1471},{"id":1470},"updating-a-rule",[1472],{"type":47,"value":1473},"Updating a Rule",{"type":42,"tag":57,"props":1475,"children":1476},{},[1477,1483,1485,1490,1492,1497,1499,1504],{"type":42,"tag":116,"props":1478,"children":1480},{"className":1479},[],[1481],{"type":47,"value":1482},"PUT \u002Fapi\u002Falerting\u002Frule\u002F{id}",{"type":47,"value":1484}," — send the complete rule body. ",{"type":42,"tag":116,"props":1486,"children":1488},{"className":1487},[],[1489],{"type":47,"value":648},{"type":47,"value":1491}," and ",{"type":42,"tag":116,"props":1493,"children":1495},{"className":1494},[],[1496],{"type":47,"value":685},{"type":47,"value":1498}," are immutable after creation.\nReturns ",{"type":42,"tag":63,"props":1500,"children":1501},{},[1502],{"type":47,"value":1503},"409 Conflict",{"type":47,"value":1505}," if another user updated the rule concurrently; re-fetch and retry.",{"type":42,"tag":50,"props":1507,"children":1509},{"id":1508},"finding-rules",[1510],{"type":47,"value":1511},"Finding Rules",{"type":42,"tag":125,"props":1513,"children":1515},{"className":1017,"code":1514,"language":1019,"meta":130,"style":130},"curl -X GET \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Falerting\u002Frules\u002F_find?per_page=20&page=1&search=cpu&sort_field=name&sort_order=asc\" \\\n -H \"Authorization: ApiKey \u003Cyour-api-key>\"\n",[1516],{"type":42,"tag":116,"props":1517,"children":1518},{"__ignoreMap":130},[1519,1552],{"type":42,"tag":136,"props":1520,"children":1521},{"class":138,"line":139},[1522,1526,1530,1535,1539,1544,1548],{"type":42,"tag":136,"props":1523,"children":1524},{"style":1029},[1525],{"type":47,"value":1032},{"type":42,"tag":136,"props":1527,"children":1528},{"style":1035},[1529],{"type":47,"value":1038},{"type":42,"tag":136,"props":1531,"children":1532},{"style":1035},[1533],{"type":47,"value":1534}," GET",{"type":42,"tag":136,"props":1536,"children":1537},{"style":1046},[1538],{"type":47,"value":1049},{"type":42,"tag":136,"props":1540,"children":1541},{"style":1035},[1542],{"type":47,"value":1543},"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Falerting\u002Frules\u002F_find?per_page=20&page=1&search=cpu&sort_field=name&sort_order=asc",{"type":42,"tag":136,"props":1545,"children":1546},{"style":1046},[1547],{"type":47,"value":1059},{"type":42,"tag":136,"props":1549,"children":1550},{"style":1062},[1551],{"type":47,"value":1065},{"type":42,"tag":136,"props":1553,"children":1554},{"class":138,"line":1068},[1555,1559,1563,1567],{"type":42,"tag":136,"props":1556,"children":1557},{"style":1035},[1558],{"type":47,"value":1074},{"type":42,"tag":136,"props":1560,"children":1561},{"style":1046},[1562],{"type":47,"value":1049},{"type":42,"tag":136,"props":1564,"children":1565},{"style":1035},[1566],{"type":47,"value":1133},{"type":42,"tag":136,"props":1568,"children":1569},{"style":1046},[1570],{"type":47,"value":1571},"\"\n",{"type":42,"tag":57,"props":1573,"children":1574},{},[1575,1577,1583,1584,1590,1591,1597,1598,1604,1605,1611,1612,1618,1619,1625,1626,1632,1633,1639,1640,1646,1647,1653],{"type":47,"value":1576},"Query parameters: ",{"type":42,"tag":116,"props":1578,"children":1580},{"className":1579},[],[1581],{"type":47,"value":1582},"per_page",{"type":47,"value":665},{"type":42,"tag":116,"props":1585,"children":1587},{"className":1586},[],[1588],{"type":47,"value":1589},"page",{"type":47,"value":665},{"type":42,"tag":116,"props":1592,"children":1594},{"className":1593},[],[1595],{"type":47,"value":1596},"search",{"type":47,"value":665},{"type":42,"tag":116,"props":1599,"children":1601},{"className":1600},[],[1602],{"type":47,"value":1603},"default_search_operator",{"type":47,"value":665},{"type":42,"tag":116,"props":1606,"children":1608},{"className":1607},[],[1609],{"type":47,"value":1610},"search_fields",{"type":47,"value":665},{"type":42,"tag":116,"props":1613,"children":1615},{"className":1614},[],[1616],{"type":47,"value":1617},"sort_field",{"type":47,"value":665},{"type":42,"tag":116,"props":1620,"children":1622},{"className":1621},[],[1623],{"type":47,"value":1624},"sort_order",{"type":47,"value":1445},{"type":42,"tag":116,"props":1627,"children":1629},{"className":1628},[],[1630],{"type":47,"value":1631},"has_reference",{"type":47,"value":665},{"type":42,"tag":116,"props":1634,"children":1636},{"className":1635},[],[1637],{"type":47,"value":1638},"fields",{"type":47,"value":665},{"type":42,"tag":116,"props":1641,"children":1643},{"className":1642},[],[1644],{"type":47,"value":1645},"filter",{"type":47,"value":665},{"type":42,"tag":116,"props":1648,"children":1650},{"className":1649},[],[1651],{"type":47,"value":1652},"filter_consumers",{"type":47,"value":103},{"type":42,"tag":57,"props":1655,"children":1656},{},[1657,1659,1664],{"type":47,"value":1658},"Use the ",{"type":42,"tag":116,"props":1660,"children":1662},{"className":1661},[],[1663],{"type":47,"value":1645},{"type":47,"value":1665}," parameter with KQL syntax for advanced queries:",{"type":42,"tag":125,"props":1667,"children":1671},{"className":1668,"code":1670,"language":47,"meta":130},[1669],"language-text","filter=alert.attributes.tags:\"production\"\n",[1672],{"type":42,"tag":116,"props":1673,"children":1674},{"__ignoreMap":130},[1675],{"type":47,"value":1670},{"type":42,"tag":50,"props":1677,"children":1679},{"id":1678},"lifecycle-operations",[1680],{"type":47,"value":1681},"Lifecycle Operations",{"type":42,"tag":125,"props":1683,"children":1685},{"className":1017,"code":1684,"language":1019,"meta":130,"style":130},"# Enable\ncurl -X POST \"...\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_enable\" -H \"kbn-xsrf: true\"\n\n# Disable\ncurl -X POST \"...\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_disable\" -H \"kbn-xsrf: true\"\n\n# Mute all alerts\ncurl -X POST \"...\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_mute_all\" -H \"kbn-xsrf: true\"\n\n# Mute specific alert\ncurl -X POST \"...\u002Fapi\u002Falerting\u002Frule\u002F{rule_id}\u002Falert\u002F{alert_id}\u002F_mute\" -H \"kbn-xsrf: true\"\n\n# Delete\ncurl -X DELETE \"...\u002Fapi\u002Falerting\u002Frule\u002F{id}\" -H \"kbn-xsrf: true\"\n",[1686],{"type":42,"tag":116,"props":1687,"children":1688},{"__ignoreMap":130},[1689,1698,1743,1752,1760,1804,1811,1819,1863,1870,1878,1922,1929,1937],{"type":42,"tag":136,"props":1690,"children":1691},{"class":138,"line":139},[1692],{"type":42,"tag":136,"props":1693,"children":1695},{"style":1694},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1696],{"type":47,"value":1697},"# Enable\n",{"type":42,"tag":136,"props":1699,"children":1700},{"class":138,"line":1068},[1701,1705,1709,1713,1717,1722,1726,1731,1735,1739],{"type":42,"tag":136,"props":1702,"children":1703},{"style":1029},[1704],{"type":47,"value":1032},{"type":42,"tag":136,"props":1706,"children":1707},{"style":1035},[1708],{"type":47,"value":1038},{"type":42,"tag":136,"props":1710,"children":1711},{"style":1035},[1712],{"type":47,"value":1043},{"type":42,"tag":136,"props":1714,"children":1715},{"style":1046},[1716],{"type":47,"value":1049},{"type":42,"tag":136,"props":1718,"children":1719},{"style":1035},[1720],{"type":47,"value":1721},"...\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_enable",{"type":42,"tag":136,"props":1723,"children":1724},{"style":1046},[1725],{"type":47,"value":1059},{"type":42,"tag":136,"props":1727,"children":1728},{"style":1035},[1729],{"type":47,"value":1730}," -H",{"type":42,"tag":136,"props":1732,"children":1733},{"style":1046},[1734],{"type":47,"value":1049},{"type":42,"tag":136,"props":1736,"children":1737},{"style":1035},[1738],{"type":47,"value":1083},{"type":42,"tag":136,"props":1740,"children":1741},{"style":1046},[1742],{"type":47,"value":1571},{"type":42,"tag":136,"props":1744,"children":1745},{"class":138,"line":1094},[1746],{"type":42,"tag":136,"props":1747,"children":1749},{"emptyLinePlaceholder":1748},true,[1750],{"type":47,"value":1751},"\n",{"type":42,"tag":136,"props":1753,"children":1754},{"class":138,"line":1119},[1755],{"type":42,"tag":136,"props":1756,"children":1757},{"style":1694},[1758],{"type":47,"value":1759},"# Disable\n",{"type":42,"tag":136,"props":1761,"children":1762},{"class":138,"line":1144},[1763,1767,1771,1775,1779,1784,1788,1792,1796,1800],{"type":42,"tag":136,"props":1764,"children":1765},{"style":1029},[1766],{"type":47,"value":1032},{"type":42,"tag":136,"props":1768,"children":1769},{"style":1035},[1770],{"type":47,"value":1038},{"type":42,"tag":136,"props":1772,"children":1773},{"style":1035},[1774],{"type":47,"value":1043},{"type":42,"tag":136,"props":1776,"children":1777},{"style":1046},[1778],{"type":47,"value":1049},{"type":42,"tag":136,"props":1780,"children":1781},{"style":1035},[1782],{"type":47,"value":1783},"...\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_disable",{"type":42,"tag":136,"props":1785,"children":1786},{"style":1046},[1787],{"type":47,"value":1059},{"type":42,"tag":136,"props":1789,"children":1790},{"style":1035},[1791],{"type":47,"value":1730},{"type":42,"tag":136,"props":1793,"children":1794},{"style":1046},[1795],{"type":47,"value":1049},{"type":42,"tag":136,"props":1797,"children":1798},{"style":1035},[1799],{"type":47,"value":1083},{"type":42,"tag":136,"props":1801,"children":1802},{"style":1046},[1803],{"type":47,"value":1571},{"type":42,"tag":136,"props":1805,"children":1806},{"class":138,"line":1163},[1807],{"type":42,"tag":136,"props":1808,"children":1809},{"emptyLinePlaceholder":1748},[1810],{"type":47,"value":1751},{"type":42,"tag":136,"props":1812,"children":1813},{"class":138,"line":1172},[1814],{"type":42,"tag":136,"props":1815,"children":1816},{"style":1694},[1817],{"type":47,"value":1818},"# Mute all alerts\n",{"type":42,"tag":136,"props":1820,"children":1821},{"class":138,"line":1181},[1822,1826,1830,1834,1838,1843,1847,1851,1855,1859],{"type":42,"tag":136,"props":1823,"children":1824},{"style":1029},[1825],{"type":47,"value":1032},{"type":42,"tag":136,"props":1827,"children":1828},{"style":1035},[1829],{"type":47,"value":1038},{"type":42,"tag":136,"props":1831,"children":1832},{"style":1035},[1833],{"type":47,"value":1043},{"type":42,"tag":136,"props":1835,"children":1836},{"style":1046},[1837],{"type":47,"value":1049},{"type":42,"tag":136,"props":1839,"children":1840},{"style":1035},[1841],{"type":47,"value":1842},"...\u002Fapi\u002Falerting\u002Frule\u002F{id}\u002F_mute_all",{"type":42,"tag":136,"props":1844,"children":1845},{"style":1046},[1846],{"type":47,"value":1059},{"type":42,"tag":136,"props":1848,"children":1849},{"style":1035},[1850],{"type":47,"value":1730},{"type":42,"tag":136,"props":1852,"children":1853},{"style":1046},[1854],{"type":47,"value":1049},{"type":42,"tag":136,"props":1856,"children":1857},{"style":1035},[1858],{"type":47,"value":1083},{"type":42,"tag":136,"props":1860,"children":1861},{"style":1046},[1862],{"type":47,"value":1571},{"type":42,"tag":136,"props":1864,"children":1865},{"class":138,"line":1190},[1866],{"type":42,"tag":136,"props":1867,"children":1868},{"emptyLinePlaceholder":1748},[1869],{"type":47,"value":1751},{"type":42,"tag":136,"props":1871,"children":1872},{"class":138,"line":1199},[1873],{"type":42,"tag":136,"props":1874,"children":1875},{"style":1694},[1876],{"type":47,"value":1877},"# Mute specific alert\n",{"type":42,"tag":136,"props":1879,"children":1880},{"class":138,"line":1208},[1881,1885,1889,1893,1897,1902,1906,1910,1914,1918],{"type":42,"tag":136,"props":1882,"children":1883},{"style":1029},[1884],{"type":47,"value":1032},{"type":42,"tag":136,"props":1886,"children":1887},{"style":1035},[1888],{"type":47,"value":1038},{"type":42,"tag":136,"props":1890,"children":1891},{"style":1035},[1892],{"type":47,"value":1043},{"type":42,"tag":136,"props":1894,"children":1895},{"style":1046},[1896],{"type":47,"value":1049},{"type":42,"tag":136,"props":1898,"children":1899},{"style":1035},[1900],{"type":47,"value":1901},"...\u002Fapi\u002Falerting\u002Frule\u002F{rule_id}\u002Falert\u002F{alert_id}\u002F_mute",{"type":42,"tag":136,"props":1903,"children":1904},{"style":1046},[1905],{"type":47,"value":1059},{"type":42,"tag":136,"props":1907,"children":1908},{"style":1035},[1909],{"type":47,"value":1730},{"type":42,"tag":136,"props":1911,"children":1912},{"style":1046},[1913],{"type":47,"value":1049},{"type":42,"tag":136,"props":1915,"children":1916},{"style":1035},[1917],{"type":47,"value":1083},{"type":42,"tag":136,"props":1919,"children":1920},{"style":1046},[1921],{"type":47,"value":1571},{"type":42,"tag":136,"props":1923,"children":1924},{"class":138,"line":1217},[1925],{"type":42,"tag":136,"props":1926,"children":1927},{"emptyLinePlaceholder":1748},[1928],{"type":47,"value":1751},{"type":42,"tag":136,"props":1930,"children":1931},{"class":138,"line":1226},[1932],{"type":42,"tag":136,"props":1933,"children":1934},{"style":1694},[1935],{"type":47,"value":1936},"# Delete\n",{"type":42,"tag":136,"props":1938,"children":1939},{"class":138,"line":1235},[1940,1944,1948,1953,1957,1962,1966,1970,1974,1978],{"type":42,"tag":136,"props":1941,"children":1942},{"style":1029},[1943],{"type":47,"value":1032},{"type":42,"tag":136,"props":1945,"children":1946},{"style":1035},[1947],{"type":47,"value":1038},{"type":42,"tag":136,"props":1949,"children":1950},{"style":1035},[1951],{"type":47,"value":1952}," DELETE",{"type":42,"tag":136,"props":1954,"children":1955},{"style":1046},[1956],{"type":47,"value":1049},{"type":42,"tag":136,"props":1958,"children":1959},{"style":1035},[1960],{"type":47,"value":1961},"...\u002Fapi\u002Falerting\u002Frule\u002F{id}",{"type":42,"tag":136,"props":1963,"children":1964},{"style":1046},[1965],{"type":47,"value":1059},{"type":42,"tag":136,"props":1967,"children":1968},{"style":1035},[1969],{"type":47,"value":1730},{"type":42,"tag":136,"props":1971,"children":1972},{"style":1046},[1973],{"type":47,"value":1049},{"type":42,"tag":136,"props":1975,"children":1976},{"style":1035},[1977],{"type":47,"value":1083},{"type":42,"tag":136,"props":1979,"children":1980},{"style":1046},[1981],{"type":47,"value":1571},{"type":42,"tag":50,"props":1983,"children":1985},{"id":1984},"terraform-provider",[1986],{"type":47,"value":1987},"Terraform Provider",{"type":42,"tag":57,"props":1989,"children":1990},{},[1991,1992,1998,2000,2006],{"type":47,"value":1658},{"type":42,"tag":116,"props":1993,"children":1995},{"className":1994},[],[1996],{"type":47,"value":1997},"elasticstack",{"type":47,"value":1999}," provider resource ",{"type":42,"tag":116,"props":2001,"children":2003},{"className":2002},[],[2004],{"type":47,"value":2005},"elasticstack_kibana_alerting_rule",{"type":47,"value":103},{"type":42,"tag":125,"props":2008,"children":2012},{"className":2009,"code":2010,"language":2011,"meta":130,"style":130},"language-hcl shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","terraform {\n required_providers {\n elasticstack = {\n source = \"elastic\u002Felasticstack\"\n }\n }\n}\n\nprovider \"elasticstack\" {\n kibana {\n endpoints = [\"https:\u002F\u002Fmy-kibana:5601\"]\n api_key = var.kibana_api_key\n }\n}\n\nresource \"elasticstack_kibana_alerting_rule\" \"cpu_alert\" {\n name = \"CPU usage critical\"\n consumer = \"stackAlerts\"\n rule_type_id = \".index-threshold\"\n interval = \"1m\"\n enabled = true\n\n params = jsonencode({\n index = [\"metrics-*\"]\n timeField = \"@timestamp\"\n aggType = \"avg\"\n aggField = \"system.cpu.total.pct\"\n groupBy = \"top\"\n termField = \"host.name\"\n termSize = 10\n threshold = [0.9]\n thresholdComparator = \">\"\n timeWindowSize = 5\n timeWindowUnit = \"m\"\n })\n\n tags = [\"infrastructure\", \"production\"]\n}\n","hcl",[2013],{"type":42,"tag":116,"props":2014,"children":2015},{"__ignoreMap":130},[2016,2024,2032,2040,2048,2056,2064,2072,2079,2087,2095,2103,2111,2118,2125,2132,2140,2148,2156,2164,2172,2180,2187,2195,2203,2211,2219,2227,2235,2243,2251,2259,2267,2275,2283,2292,2300,2309],{"type":42,"tag":136,"props":2017,"children":2018},{"class":138,"line":139},[2019],{"type":42,"tag":136,"props":2020,"children":2021},{},[2022],{"type":47,"value":2023},"terraform {\n",{"type":42,"tag":136,"props":2025,"children":2026},{"class":138,"line":1068},[2027],{"type":42,"tag":136,"props":2028,"children":2029},{},[2030],{"type":47,"value":2031}," required_providers {\n",{"type":42,"tag":136,"props":2033,"children":2034},{"class":138,"line":1094},[2035],{"type":42,"tag":136,"props":2036,"children":2037},{},[2038],{"type":47,"value":2039}," elasticstack = {\n",{"type":42,"tag":136,"props":2041,"children":2042},{"class":138,"line":1119},[2043],{"type":42,"tag":136,"props":2044,"children":2045},{},[2046],{"type":47,"value":2047}," source = \"elastic\u002Felasticstack\"\n",{"type":42,"tag":136,"props":2049,"children":2050},{"class":138,"line":1144},[2051],{"type":42,"tag":136,"props":2052,"children":2053},{},[2054],{"type":47,"value":2055}," }\n",{"type":42,"tag":136,"props":2057,"children":2058},{"class":138,"line":1163},[2059],{"type":42,"tag":136,"props":2060,"children":2061},{},[2062],{"type":47,"value":2063}," }\n",{"type":42,"tag":136,"props":2065,"children":2066},{"class":138,"line":1172},[2067],{"type":42,"tag":136,"props":2068,"children":2069},{},[2070],{"type":47,"value":2071},"}\n",{"type":42,"tag":136,"props":2073,"children":2074},{"class":138,"line":1181},[2075],{"type":42,"tag":136,"props":2076,"children":2077},{"emptyLinePlaceholder":1748},[2078],{"type":47,"value":1751},{"type":42,"tag":136,"props":2080,"children":2081},{"class":138,"line":1190},[2082],{"type":42,"tag":136,"props":2083,"children":2084},{},[2085],{"type":47,"value":2086},"provider \"elasticstack\" {\n",{"type":42,"tag":136,"props":2088,"children":2089},{"class":138,"line":1199},[2090],{"type":42,"tag":136,"props":2091,"children":2092},{},[2093],{"type":47,"value":2094}," kibana {\n",{"type":42,"tag":136,"props":2096,"children":2097},{"class":138,"line":1208},[2098],{"type":42,"tag":136,"props":2099,"children":2100},{},[2101],{"type":47,"value":2102}," endpoints = [\"https:\u002F\u002Fmy-kibana:5601\"]\n",{"type":42,"tag":136,"props":2104,"children":2105},{"class":138,"line":1217},[2106],{"type":42,"tag":136,"props":2107,"children":2108},{},[2109],{"type":47,"value":2110}," api_key = var.kibana_api_key\n",{"type":42,"tag":136,"props":2112,"children":2113},{"class":138,"line":1226},[2114],{"type":42,"tag":136,"props":2115,"children":2116},{},[2117],{"type":47,"value":2063},{"type":42,"tag":136,"props":2119,"children":2120},{"class":138,"line":1235},[2121],{"type":42,"tag":136,"props":2122,"children":2123},{},[2124],{"type":47,"value":2071},{"type":42,"tag":136,"props":2126,"children":2127},{"class":138,"line":1244},[2128],{"type":42,"tag":136,"props":2129,"children":2130},{"emptyLinePlaceholder":1748},[2131],{"type":47,"value":1751},{"type":42,"tag":136,"props":2133,"children":2134},{"class":138,"line":1253},[2135],{"type":42,"tag":136,"props":2136,"children":2137},{},[2138],{"type":47,"value":2139},"resource \"elasticstack_kibana_alerting_rule\" \"cpu_alert\" {\n",{"type":42,"tag":136,"props":2141,"children":2142},{"class":138,"line":1262},[2143],{"type":42,"tag":136,"props":2144,"children":2145},{},[2146],{"type":47,"value":2147}," name = \"CPU usage critical\"\n",{"type":42,"tag":136,"props":2149,"children":2150},{"class":138,"line":1271},[2151],{"type":42,"tag":136,"props":2152,"children":2153},{},[2154],{"type":47,"value":2155}," consumer = \"stackAlerts\"\n",{"type":42,"tag":136,"props":2157,"children":2158},{"class":138,"line":1280},[2159],{"type":42,"tag":136,"props":2160,"children":2161},{},[2162],{"type":47,"value":2163}," rule_type_id = \".index-threshold\"\n",{"type":42,"tag":136,"props":2165,"children":2166},{"class":138,"line":1289},[2167],{"type":42,"tag":136,"props":2168,"children":2169},{},[2170],{"type":47,"value":2171}," interval = \"1m\"\n",{"type":42,"tag":136,"props":2173,"children":2174},{"class":138,"line":1298},[2175],{"type":42,"tag":136,"props":2176,"children":2177},{},[2178],{"type":47,"value":2179}," enabled = true\n",{"type":42,"tag":136,"props":2181,"children":2182},{"class":138,"line":1307},[2183],{"type":42,"tag":136,"props":2184,"children":2185},{"emptyLinePlaceholder":1748},[2186],{"type":47,"value":1751},{"type":42,"tag":136,"props":2188,"children":2189},{"class":138,"line":1316},[2190],{"type":42,"tag":136,"props":2191,"children":2192},{},[2193],{"type":47,"value":2194}," params = jsonencode({\n",{"type":42,"tag":136,"props":2196,"children":2197},{"class":138,"line":1325},[2198],{"type":42,"tag":136,"props":2199,"children":2200},{},[2201],{"type":47,"value":2202}," index = [\"metrics-*\"]\n",{"type":42,"tag":136,"props":2204,"children":2205},{"class":138,"line":1334},[2206],{"type":42,"tag":136,"props":2207,"children":2208},{},[2209],{"type":47,"value":2210}," timeField = \"@timestamp\"\n",{"type":42,"tag":136,"props":2212,"children":2213},{"class":138,"line":1343},[2214],{"type":42,"tag":136,"props":2215,"children":2216},{},[2217],{"type":47,"value":2218}," aggType = \"avg\"\n",{"type":42,"tag":136,"props":2220,"children":2221},{"class":138,"line":1352},[2222],{"type":42,"tag":136,"props":2223,"children":2224},{},[2225],{"type":47,"value":2226}," aggField = \"system.cpu.total.pct\"\n",{"type":42,"tag":136,"props":2228,"children":2229},{"class":138,"line":1361},[2230],{"type":42,"tag":136,"props":2231,"children":2232},{},[2233],{"type":47,"value":2234}," groupBy = \"top\"\n",{"type":42,"tag":136,"props":2236,"children":2237},{"class":138,"line":1370},[2238],{"type":42,"tag":136,"props":2239,"children":2240},{},[2241],{"type":47,"value":2242}," termField = \"host.name\"\n",{"type":42,"tag":136,"props":2244,"children":2245},{"class":138,"line":1379},[2246],{"type":42,"tag":136,"props":2247,"children":2248},{},[2249],{"type":47,"value":2250}," termSize = 10\n",{"type":42,"tag":136,"props":2252,"children":2253},{"class":138,"line":1388},[2254],{"type":42,"tag":136,"props":2255,"children":2256},{},[2257],{"type":47,"value":2258}," threshold = [0.9]\n",{"type":42,"tag":136,"props":2260,"children":2261},{"class":138,"line":1397},[2262],{"type":42,"tag":136,"props":2263,"children":2264},{},[2265],{"type":47,"value":2266}," thresholdComparator = \">\"\n",{"type":42,"tag":136,"props":2268,"children":2269},{"class":138,"line":1406},[2270],{"type":42,"tag":136,"props":2271,"children":2272},{},[2273],{"type":47,"value":2274}," timeWindowSize = 5\n",{"type":42,"tag":136,"props":2276,"children":2277},{"class":138,"line":1415},[2278],{"type":42,"tag":136,"props":2279,"children":2280},{},[2281],{"type":47,"value":2282}," timeWindowUnit = \"m\"\n",{"type":42,"tag":136,"props":2284,"children":2286},{"class":138,"line":2285},35,[2287],{"type":42,"tag":136,"props":2288,"children":2289},{},[2290],{"type":47,"value":2291}," })\n",{"type":42,"tag":136,"props":2293,"children":2295},{"class":138,"line":2294},36,[2296],{"type":42,"tag":136,"props":2297,"children":2298},{"emptyLinePlaceholder":1748},[2299],{"type":47,"value":1751},{"type":42,"tag":136,"props":2301,"children":2303},{"class":138,"line":2302},37,[2304],{"type":42,"tag":136,"props":2305,"children":2306},{},[2307],{"type":47,"value":2308}," tags = [\"infrastructure\", \"production\"]\n",{"type":42,"tag":136,"props":2310,"children":2312},{"class":138,"line":2311},38,[2313],{"type":42,"tag":136,"props":2314,"children":2315},{},[2316],{"type":47,"value":2071},{"type":42,"tag":57,"props":2318,"children":2319},{},[2320],{"type":42,"tag":63,"props":2321,"children":2322},{},[2323],{"type":47,"value":2324},"Key Terraform notes:",{"type":42,"tag":152,"props":2326,"children":2327},{},[2328,2344,2357],{"type":42,"tag":156,"props":2329,"children":2330},{},[2331,2336,2338],{"type":42,"tag":116,"props":2332,"children":2334},{"className":2333},[],[2335],{"type":47,"value":787},{"type":47,"value":2337}," must be passed as a JSON-encoded string via ",{"type":42,"tag":116,"props":2339,"children":2341},{"className":2340},[],[2342],{"type":47,"value":2343},"jsonencode()",{"type":42,"tag":156,"props":2345,"children":2346},{},[2347,2349,2355],{"type":47,"value":2348},"Use ",{"type":42,"tag":116,"props":2350,"children":2352},{"className":2351},[],[2353],{"type":47,"value":2354},"elasticstack_kibana_action_connector",{"type":47,"value":2356}," data source or resource to reference connector IDs in actions",{"type":42,"tag":156,"props":2358,"children":2359},{},[2360,2362,2368,2370,2376],{"type":47,"value":2361},"Import existing rules: ",{"type":42,"tag":116,"props":2363,"children":2365},{"className":2364},[],[2366],{"type":47,"value":2367},"terraform import elasticstack_kibana_alerting_rule.my_rule \u003Cspace_id>\u002F\u003Crule_id>",{"type":47,"value":2369}," (use\n",{"type":42,"tag":116,"props":2371,"children":2373},{"className":2372},[],[2374],{"type":47,"value":2375},"default",{"type":47,"value":2377}," for the default space)",{"type":42,"tag":50,"props":2379,"children":2381},{"id":2380},"triggering-kibana-workflows-from-rules",[2382],{"type":47,"value":2383},"Triggering Kibana Workflows from Rules",{"type":42,"tag":2385,"props":2386,"children":2387},"blockquote",{},[2388],{"type":42,"tag":57,"props":2389,"children":2390},{},[2391,2396],{"type":42,"tag":63,"props":2392,"children":2393},{},[2394],{"type":47,"value":2395},"Preview feature",{"type":47,"value":2397}," — available from Elastic Stack 9.3 and Elastic Cloud Serverless. APIs may change.",{"type":42,"tag":57,"props":2399,"children":2400},{},[2401,2403,2409,2411,2417],{"type":47,"value":2402},"Attach a workflow as a rule action using the workflow ID as the connector ID. Set ",{"type":42,"tag":116,"props":2404,"children":2406},{"className":2405},[],[2407],{"type":47,"value":2408},"params: {}",{"type":47,"value":2410}," — alert context flows\nautomatically through the ",{"type":42,"tag":116,"props":2412,"children":2414},{"className":2413},[],[2415],{"type":47,"value":2416},"event",{"type":47,"value":2418}," object inside the workflow.",{"type":42,"tag":125,"props":2420,"children":2422},{"className":1017,"code":2421,"language":1019,"meta":130,"style":130},"curl -X PUT \"https:\u002F\u002Fmy-kibana:5601\u002Fapi\u002Falerting\u002Frule\u002Fmy-rule-id\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application\u002Fjson\" \\\n -H \"Authorization: ApiKey \u003Cyour-api-key>\" \\\n -d '{\n \"name\": \"High error rate\",\n \"schedule\": { \"interval\": \"5m\" },\n \"params\": { ... },\n \"actions\": [\n {\n \"id\": \"\u003Cworkflow-id>\",\n \"group\": \"query matched\",\n \"params\": {},\n \"frequency\": { \"summary\": false, \"notify_when\": \"onActionGroupChange\" }\n }\n ]\n }'\n",[2423],{"type":42,"tag":116,"props":2424,"children":2425},{"__ignoreMap":130},[2426,2458,2481,2504,2527,2542,2549,2556,2564,2571,2578,2586,2593,2601,2609,2616,2624],{"type":42,"tag":136,"props":2427,"children":2428},{"class":138,"line":139},[2429,2433,2437,2442,2446,2450,2454],{"type":42,"tag":136,"props":2430,"children":2431},{"style":1029},[2432],{"type":47,"value":1032},{"type":42,"tag":136,"props":2434,"children":2435},{"style":1035},[2436],{"type":47,"value":1038},{"type":42,"tag":136,"props":2438,"children":2439},{"style":1035},[2440],{"type":47,"value":2441}," PUT",{"type":42,"tag":136,"props":2443,"children":2444},{"style":1046},[2445],{"type":47,"value":1049},{"type":42,"tag":136,"props":2447,"children":2448},{"style":1035},[2449],{"type":47,"value":1054},{"type":42,"tag":136,"props":2451,"children":2452},{"style":1046},[2453],{"type":47,"value":1059},{"type":42,"tag":136,"props":2455,"children":2456},{"style":1062},[2457],{"type":47,"value":1065},{"type":42,"tag":136,"props":2459,"children":2460},{"class":138,"line":1068},[2461,2465,2469,2473,2477],{"type":42,"tag":136,"props":2462,"children":2463},{"style":1035},[2464],{"type":47,"value":1074},{"type":42,"tag":136,"props":2466,"children":2467},{"style":1046},[2468],{"type":47,"value":1049},{"type":42,"tag":136,"props":2470,"children":2471},{"style":1035},[2472],{"type":47,"value":1083},{"type":42,"tag":136,"props":2474,"children":2475},{"style":1046},[2476],{"type":47,"value":1059},{"type":42,"tag":136,"props":2478,"children":2479},{"style":1062},[2480],{"type":47,"value":1065},{"type":42,"tag":136,"props":2482,"children":2483},{"class":138,"line":1094},[2484,2488,2492,2496,2500],{"type":42,"tag":136,"props":2485,"children":2486},{"style":1035},[2487],{"type":47,"value":1074},{"type":42,"tag":136,"props":2489,"children":2490},{"style":1046},[2491],{"type":47,"value":1049},{"type":42,"tag":136,"props":2493,"children":2494},{"style":1035},[2495],{"type":47,"value":1108},{"type":42,"tag":136,"props":2497,"children":2498},{"style":1046},[2499],{"type":47,"value":1059},{"type":42,"tag":136,"props":2501,"children":2502},{"style":1062},[2503],{"type":47,"value":1065},{"type":42,"tag":136,"props":2505,"children":2506},{"class":138,"line":1119},[2507,2511,2515,2519,2523],{"type":42,"tag":136,"props":2508,"children":2509},{"style":1035},[2510],{"type":47,"value":1074},{"type":42,"tag":136,"props":2512,"children":2513},{"style":1046},[2514],{"type":47,"value":1049},{"type":42,"tag":136,"props":2516,"children":2517},{"style":1035},[2518],{"type":47,"value":1133},{"type":42,"tag":136,"props":2520,"children":2521},{"style":1046},[2522],{"type":47,"value":1059},{"type":42,"tag":136,"props":2524,"children":2525},{"style":1062},[2526],{"type":47,"value":1065},{"type":42,"tag":136,"props":2528,"children":2529},{"class":138,"line":1144},[2530,2534,2538],{"type":42,"tag":136,"props":2531,"children":2532},{"style":1035},[2533],{"type":47,"value":1150},{"type":42,"tag":136,"props":2535,"children":2536},{"style":1046},[2537],{"type":47,"value":1155},{"type":42,"tag":136,"props":2539,"children":2540},{"style":1035},[2541],{"type":47,"value":1160},{"type":42,"tag":136,"props":2543,"children":2544},{"class":138,"line":1163},[2545],{"type":42,"tag":136,"props":2546,"children":2547},{"style":1035},[2548],{"type":47,"value":1169},{"type":42,"tag":136,"props":2550,"children":2551},{"class":138,"line":1172},[2552],{"type":42,"tag":136,"props":2553,"children":2554},{"style":1035},[2555],{"type":47,"value":1196},{"type":42,"tag":136,"props":2557,"children":2558},{"class":138,"line":1181},[2559],{"type":42,"tag":136,"props":2560,"children":2561},{"style":1035},[2562],{"type":47,"value":2563}," \"params\": { ... },\n",{"type":42,"tag":136,"props":2565,"children":2566},{"class":138,"line":1190},[2567],{"type":42,"tag":136,"props":2568,"children":2569},{"style":1035},[2570],{"type":47,"value":1295},{"type":42,"tag":136,"props":2572,"children":2573},{"class":138,"line":1199},[2574],{"type":42,"tag":136,"props":2575,"children":2576},{"style":1035},[2577],{"type":47,"value":1304},{"type":42,"tag":136,"props":2579,"children":2580},{"class":138,"line":1208},[2581],{"type":42,"tag":136,"props":2582,"children":2583},{"style":1035},[2584],{"type":47,"value":2585}," \"id\": \"\u003Cworkflow-id>\",\n",{"type":42,"tag":136,"props":2587,"children":2588},{"class":138,"line":1217},[2589],{"type":42,"tag":136,"props":2590,"children":2591},{"style":1035},[2592],{"type":47,"value":1322},{"type":42,"tag":136,"props":2594,"children":2595},{"class":138,"line":1226},[2596],{"type":42,"tag":136,"props":2597,"children":2598},{"style":1035},[2599],{"type":47,"value":2600}," \"params\": {},\n",{"type":42,"tag":136,"props":2602,"children":2603},{"class":138,"line":1235},[2604],{"type":42,"tag":136,"props":2605,"children":2606},{"style":1035},[2607],{"type":47,"value":2608}," \"frequency\": { \"summary\": false, \"notify_when\": \"onActionGroupChange\" }\n",{"type":42,"tag":136,"props":2610,"children":2611},{"class":138,"line":1244},[2612],{"type":42,"tag":136,"props":2613,"children":2614},{"style":1035},[2615],{"type":47,"value":1394},{"type":42,"tag":136,"props":2617,"children":2618},{"class":138,"line":1253},[2619],{"type":42,"tag":136,"props":2620,"children":2621},{"style":1035},[2622],{"type":47,"value":2623}," ]\n",{"type":42,"tag":136,"props":2625,"children":2626},{"class":138,"line":1262},[2627,2631],{"type":42,"tag":136,"props":2628,"children":2629},{"style":1035},[2630],{"type":47,"value":1421},{"type":42,"tag":136,"props":2632,"children":2633},{"style":1046},[2634],{"type":47,"value":1426},{"type":42,"tag":57,"props":2636,"children":2637},{},[2638,2640,2645,2647,2653],{"type":47,"value":2639},"In the UI: ",{"type":42,"tag":63,"props":2641,"children":2642},{},[2643],{"type":47,"value":2644},"Stack Management > Rules > Actions > Workflows",{"type":47,"value":2646},". Only ",{"type":42,"tag":116,"props":2648,"children":2650},{"className":2649},[],[2651],{"type":47,"value":2652},"enabled: true",{"type":47,"value":2654}," workflows appear in the picker.",{"type":42,"tag":57,"props":2656,"children":2657},{},[2658,2660,2666,2668,2674],{"type":47,"value":2659},"For workflow YAML structure, ",{"type":42,"tag":116,"props":2661,"children":2663},{"className":2662},[],[2664],{"type":47,"value":2665},"{{ event }}",{"type":47,"value":2667}," context fields, step types, and patterns, refer to the ",{"type":42,"tag":116,"props":2669,"children":2671},{"className":2670},[],[2672],{"type":47,"value":2673},"kibana-connectors",{"type":47,"value":2675},"\nskill if available.",{"type":42,"tag":50,"props":2677,"children":2679},{"id":2678},"connectors-and-actions-in-rules",[2680],{"type":47,"value":2681},"Connectors and Actions in Rules",{"type":42,"tag":57,"props":2683,"children":2684},{},[2685,2687,2693,2695,2700,2702,2708],{"type":47,"value":2686},"Each action references a connector by ID, an action ",{"type":42,"tag":116,"props":2688,"children":2690},{"className":2689},[],[2691],{"type":47,"value":2692},"group",{"type":47,"value":2694},", action ",{"type":42,"tag":116,"props":2696,"children":2698},{"className":2697},[],[2699],{"type":47,"value":787},{"type":47,"value":2701}," (using Mustache templates), and a\nper-action ",{"type":42,"tag":116,"props":2703,"children":2705},{"className":2704},[],[2706],{"type":47,"value":2707},"frequency",{"type":47,"value":2709}," object. Key fields:",{"type":42,"tag":152,"props":2711,"children":2712},{},[2713,2744,2771,2800],{"type":42,"tag":156,"props":2714,"children":2715},{},[2716,2721,2723,2729,2730,2736,2738,2743],{"type":42,"tag":116,"props":2717,"children":2719},{"className":2718},[],[2720],{"type":47,"value":2692},{"type":47,"value":2722}," — which trigger state fires this action (e.g., ",{"type":42,"tag":116,"props":2724,"children":2726},{"className":2725},[],[2727],{"type":47,"value":2728},"\"query matched\"",{"type":47,"value":665},{"type":42,"tag":116,"props":2731,"children":2733},{"className":2732},[],[2734],{"type":47,"value":2735},"\"Recovered\"",{"type":47,"value":2737},"). Discover valid groups via\n",{"type":42,"tag":116,"props":2739,"children":2741},{"className":2740},[],[2742],{"type":47,"value":1465},{"type":47,"value":103},{"type":42,"tag":156,"props":2745,"children":2746},{},[2747,2753,2755,2761,2763,2769],{"type":42,"tag":116,"props":2748,"children":2750},{"className":2749},[],[2751],{"type":47,"value":2752},"frequency.summary",{"type":47,"value":2754}," — ",{"type":42,"tag":116,"props":2756,"children":2758},{"className":2757},[],[2759],{"type":47,"value":2760},"true",{"type":47,"value":2762}," for a digest of all alerts; ",{"type":42,"tag":116,"props":2764,"children":2766},{"className":2765},[],[2767],{"type":47,"value":2768},"false",{"type":47,"value":2770}," for per-alert.",{"type":42,"tag":156,"props":2772,"children":2773},{},[2774,2780,2781,2786,2788,2793,2794,2799],{"type":42,"tag":116,"props":2775,"children":2777},{"className":2776},[],[2778],{"type":47,"value":2779},"frequency.notify_when",{"type":47,"value":2754},{"type":42,"tag":116,"props":2782,"children":2784},{"className":2783},[],[2785],{"type":47,"value":942},{"type":47,"value":2787}," | ",{"type":42,"tag":116,"props":2789,"children":2791},{"className":2790},[],[2792],{"type":47,"value":949},{"type":47,"value":2787},{"type":42,"tag":116,"props":2795,"children":2797},{"className":2796},[],[2798],{"type":47,"value":957},{"type":47,"value":103},{"type":42,"tag":156,"props":2801,"children":2802},{},[2803,2809,2811,2817,2819,2824],{"type":42,"tag":116,"props":2804,"children":2806},{"className":2805},[],[2807],{"type":47,"value":2808},"frequency.throttle",{"type":47,"value":2810}," — minimum repeat interval (e.g., ",{"type":42,"tag":116,"props":2812,"children":2814},{"className":2813},[],[2815],{"type":47,"value":2816},"\"10m\"",{"type":47,"value":2818},"); only applies with ",{"type":42,"tag":116,"props":2820,"children":2822},{"className":2821},[],[2823],{"type":47,"value":957},{"type":47,"value":103},{"type":42,"tag":57,"props":2826,"children":2827},{},[2828,2830,2836,2837,2843,2844,2850,2852,2858,2859,2865,2866,2872,2874,2879],{"type":47,"value":2829},"For full reference on action structure, Mustache variables (",{"type":42,"tag":116,"props":2831,"children":2833},{"className":2832},[],[2834],{"type":47,"value":2835},"{{rule.name}}",{"type":47,"value":665},{"type":42,"tag":116,"props":2838,"children":2840},{"className":2839},[],[2841],{"type":47,"value":2842},"{{context.*}}",{"type":47,"value":665},{"type":42,"tag":116,"props":2845,"children":2847},{"className":2846},[],[2848],{"type":47,"value":2849},"{{alerts.new.count}}",{"type":47,"value":2851},"),\nMustache lambdas (",{"type":42,"tag":116,"props":2853,"children":2855},{"className":2854},[],[2856],{"type":47,"value":2857},"EvalMath",{"type":47,"value":665},{"type":42,"tag":116,"props":2860,"children":2862},{"className":2861},[],[2863],{"type":47,"value":2864},"FormatDate",{"type":47,"value":665},{"type":42,"tag":116,"props":2867,"children":2869},{"className":2868},[],[2870],{"type":47,"value":2871},"ParseHjson",{"type":47,"value":2873},"), recovery actions, and multi-channel patterns, refer to the\n",{"type":42,"tag":116,"props":2875,"children":2877},{"className":2876},[],[2878],{"type":47,"value":2673},{"type":47,"value":2880}," skill if available.",{"type":42,"tag":50,"props":2882,"children":2884},{"id":2883},"best-practices",[2885],{"type":47,"value":2886},"Best Practices",{"type":42,"tag":2888,"props":2889,"children":2890},"ol",{},[2891,2915,2941,2980,3006,3032,3055,3072,3120,3152],{"type":42,"tag":156,"props":2892,"children":2893},{},[2894,2899,2901,2906,2908,2913],{"type":42,"tag":63,"props":2895,"children":2896},{},[2897],{"type":47,"value":2898},"Set action frequency per action, not per rule.",{"type":47,"value":2900}," The ",{"type":42,"tag":116,"props":2902,"children":2904},{"className":2903},[],[2905],{"type":47,"value":929},{"type":47,"value":2907}," field at the rule level is deprecated in favor\nof per-action ",{"type":42,"tag":116,"props":2909,"children":2911},{"className":2910},[],[2912],{"type":47,"value":2707},{"type":47,"value":2914}," objects. If you set it at the rule level and later edit the rule in the Kibana UI, it is\nautomatically converted to action-level values.",{"type":42,"tag":156,"props":2916,"children":2917},{},[2918,2923,2925,2931,2933,2939],{"type":42,"tag":63,"props":2919,"children":2920},{},[2921],{"type":47,"value":2922},"Use alert summaries to reduce notification noise.",{"type":47,"value":2924}," Instead of sending one notification per alert, configure\nactions to send periodic summaries at a custom interval. Use ",{"type":42,"tag":116,"props":2926,"children":2928},{"className":2927},[],[2929],{"type":47,"value":2930},"\"summary\": true",{"type":47,"value":2932}," and set a ",{"type":42,"tag":116,"props":2934,"children":2936},{"className":2935},[],[2937],{"type":47,"value":2938},"throttle",{"type":47,"value":2940}," interval. This is\nespecially valuable for rules that monitor many hosts or documents.",{"type":42,"tag":156,"props":2942,"children":2943},{},[2944,2949,2951,2956,2958,2963,2965,2970,2972,2978],{"type":42,"tag":63,"props":2945,"children":2946},{},[2947],{"type":47,"value":2948},"Choose the right action frequency for each channel.",{"type":47,"value":2950}," Use ",{"type":42,"tag":116,"props":2952,"children":2954},{"className":2953},[],[2955],{"type":47,"value":942},{"type":47,"value":2957}," for paging\u002Fticketing systems (fire\nonce, resolve once). Use ",{"type":42,"tag":116,"props":2959,"children":2961},{"className":2960},[],[2962],{"type":47,"value":949},{"type":47,"value":2964}," for audit logging to an Index connector. Use ",{"type":42,"tag":116,"props":2966,"children":2968},{"className":2967},[],[2969],{"type":47,"value":957},{"type":47,"value":2971}," with a\nthrottle like ",{"type":42,"tag":116,"props":2973,"children":2975},{"className":2974},[],[2976],{"type":47,"value":2977},"\"30m\"",{"type":47,"value":2979}," for dashboards or lower-priority notifications.",{"type":42,"tag":156,"props":2981,"children":2982},{},[2983,2988,2990,2996,2998,3004],{"type":42,"tag":63,"props":2984,"children":2985},{},[2986],{"type":47,"value":2987},"Always add a recovery action.",{"type":47,"value":2989}," Rules without a recovery action leave incidents open in PagerDuty, Jira, and\nServiceNow indefinitely. Use the connector's native close\u002Fresolve event action (e.g., ",{"type":42,"tag":116,"props":2991,"children":2993},{"className":2992},[],[2994],{"type":47,"value":2995},"eventAction: \"resolve\"",{"type":47,"value":2997}," for\nPagerDuty) in the ",{"type":42,"tag":116,"props":2999,"children":3001},{"className":3000},[],[3002],{"type":47,"value":3003},"Recovered",{"type":47,"value":3005}," action group.",{"type":42,"tag":156,"props":3007,"children":3008},{},[3009,3014,3016,3022,3024,3030],{"type":42,"tag":63,"props":3010,"children":3011},{},[3012],{"type":47,"value":3013},"Set a reasonable check interval.",{"type":47,"value":3015}," The minimum recommended interval is ",{"type":42,"tag":116,"props":3017,"children":3019},{"className":3018},[],[3020],{"type":47,"value":3021},"1m",{"type":47,"value":3023},". Very short intervals across many rules\nclog Task Manager throughput and increase schedule drift. The server setting\n",{"type":42,"tag":116,"props":3025,"children":3027},{"className":3026},[],[3028],{"type":47,"value":3029},"xpack.alerting.rules.minimumScheduleInterval.value",{"type":47,"value":3031}," enforces this.",{"type":42,"tag":156,"props":3033,"children":3034},{},[3035,3046,3048,3053],{"type":42,"tag":63,"props":3036,"children":3037},{},[3038,3039,3044],{"type":47,"value":2348},{"type":42,"tag":116,"props":3040,"children":3042},{"className":3041},[],[3043],{"type":47,"value":971},{"type":47,"value":3045}," to suppress transient spikes.",{"type":47,"value":3047}," Setting ",{"type":42,"tag":116,"props":3049,"children":3051},{"className":3050},[],[3052],{"type":47,"value":986},{"type":47,"value":3054}," means the alert only fires after 3\nconsecutive runs match the condition, filtering out brief anomalies.",{"type":42,"tag":156,"props":3056,"children":3057},{},[3058,3063,3065,3070],{"type":42,"tag":63,"props":3059,"children":3060},{},[3061],{"type":47,"value":3062},"Enable flapping detection.",{"type":47,"value":3064}," Alerts that rapidly switch between active and recovered are marked as \"flapping\" and\nnotifications are suppressed. This is on by default but can be tuned per-rule with the ",{"type":42,"tag":116,"props":3066,"children":3068},{"className":3067},[],[3069],{"type":47,"value":998},{"type":47,"value":3071}," object.",{"type":42,"tag":156,"props":3073,"children":3074},{},[3075,3087,3089,3094,3096,3102,3104,3110,3112,3118],{"type":42,"tag":63,"props":3076,"children":3077},{},[3078,3079,3085],{"type":47,"value":2348},{"type":42,"tag":116,"props":3080,"children":3082},{"className":3081},[],[3083],{"type":47,"value":3084},"server.publicBaseUrl",{"type":47,"value":3086}," for deep links.",{"type":47,"value":3088}," Set ",{"type":42,"tag":116,"props":3090,"children":3092},{"className":3091},[],[3093],{"type":47,"value":3084},{"type":47,"value":3095}," in ",{"type":42,"tag":116,"props":3097,"children":3099},{"className":3098},[],[3100],{"type":47,"value":3101},"kibana.yml",{"type":47,"value":3103}," so that ",{"type":42,"tag":116,"props":3105,"children":3107},{"className":3106},[],[3108],{"type":47,"value":3109},"{{rule.url}}",{"type":47,"value":3111}," and\n",{"type":42,"tag":116,"props":3113,"children":3115},{"className":3114},[],[3116],{"type":47,"value":3117},"{{kibanaBaseUrl}}",{"type":47,"value":3119}," variables resolve to valid URLs in notifications.",{"type":42,"tag":156,"props":3121,"children":3122},{},[3123,3128,3130,3136,3137,3143,3144,3150],{"type":42,"tag":63,"props":3124,"children":3125},{},[3126],{"type":47,"value":3127},"Tag rules consistently.",{"type":47,"value":3129}," Use tags like ",{"type":42,"tag":116,"props":3131,"children":3133},{"className":3132},[],[3134],{"type":47,"value":3135},"production",{"type":47,"value":665},{"type":42,"tag":116,"props":3138,"children":3140},{"className":3139},[],[3141],{"type":47,"value":3142},"staging",{"type":47,"value":665},{"type":42,"tag":116,"props":3145,"children":3147},{"className":3146},[],[3148],{"type":47,"value":3149},"team-platform",{"type":47,"value":3151}," for filtering and organization in\nthe Find API and UI.",{"type":42,"tag":156,"props":3153,"children":3154},{},[3155,3160,3162,3168],{"type":42,"tag":63,"props":3156,"children":3157},{},[3158],{"type":47,"value":3159},"Use Kibana Spaces",{"type":47,"value":3161}," to isolate rules by team or environment. Prefix API paths with ",{"type":42,"tag":116,"props":3163,"children":3165},{"className":3164},[],[3166],{"type":47,"value":3167},"\u002Fs\u002F\u003Cspace_id>\u002F",{"type":47,"value":3169}," for\nnon-default spaces. Connectors are also space-scoped, so create matching connectors in each space.",{"type":42,"tag":50,"props":3171,"children":3173},{"id":3172},"common-pitfalls",[3174],{"type":47,"value":3175},"Common Pitfalls",{"type":42,"tag":2888,"props":3177,"children":3178},{},[3179,3203,3241,3265,3295,3312,3330,3348,3374,3384],{"type":42,"tag":156,"props":3180,"children":3181},{},[3182,3194,3196,3201],{"type":42,"tag":63,"props":3183,"children":3184},{},[3185,3187,3192],{"type":47,"value":3186},"Missing ",{"type":42,"tag":116,"props":3188,"children":3190},{"className":3189},[],[3191],{"type":47,"value":121},{"type":47,"value":3193}," header.",{"type":47,"value":3195}," All POST, PUT, DELETE requests require ",{"type":42,"tag":116,"props":3197,"children":3199},{"className":3198},[],[3200],{"type":47,"value":1083},{"type":47,"value":3202}," or any truthy value. Omitting\nit returns a 400 error.",{"type":42,"tag":156,"props":3204,"children":3205},{},[3206,3218,3220,3226,3228,3233,3235,3240],{"type":42,"tag":63,"props":3207,"children":3208},{},[3209,3211,3216],{"type":47,"value":3210},"Wrong ",{"type":42,"tag":116,"props":3212,"children":3214},{"className":3213},[],[3215],{"type":47,"value":685},{"type":47,"value":3217}," value.",{"type":47,"value":3219}," Using an invalid consumer (e.g., ",{"type":42,"tag":116,"props":3221,"children":3223},{"className":3222},[],[3224],{"type":47,"value":3225},"observability",{"type":47,"value":3227}," instead of ",{"type":42,"tag":116,"props":3229,"children":3231},{"className":3230},[],[3232],{"type":47,"value":720},{"type":47,"value":3234},") causes a\n400 error. Check the rule type's supported consumers via ",{"type":42,"tag":116,"props":3236,"children":3238},{"className":3237},[],[3239],{"type":47,"value":1465},{"type":47,"value":103},{"type":42,"tag":156,"props":3242,"children":3243},{},[3244,3249,3251,3256,3258,3263],{"type":42,"tag":63,"props":3245,"children":3246},{},[3247],{"type":47,"value":3248},"Immutable fields on update.",{"type":47,"value":3250}," You cannot change ",{"type":42,"tag":116,"props":3252,"children":3254},{"className":3253},[],[3255],{"type":47,"value":648},{"type":47,"value":3257}," or ",{"type":42,"tag":116,"props":3259,"children":3261},{"className":3260},[],[3262],{"type":47,"value":685},{"type":47,"value":3264}," with PUT. You must delete and recreate\nthe rule.",{"type":42,"tag":156,"props":3266,"children":3267},{},[3268,3286,3288,3293],{"type":42,"tag":63,"props":3269,"children":3270},{},[3271,3273,3278,3279,3284],{"type":47,"value":3272},"Rule-level ",{"type":42,"tag":116,"props":3274,"children":3276},{"className":3275},[],[3277],{"type":47,"value":929},{"type":47,"value":1491},{"type":42,"tag":116,"props":3280,"children":3282},{"className":3281},[],[3283],{"type":47,"value":2938},{"type":47,"value":3285}," are deprecated.",{"type":47,"value":3287}," Setting these at the rule level still works but conflicts\nwith action-level frequency settings. Always use ",{"type":42,"tag":116,"props":3289,"children":3291},{"className":3290},[],[3292],{"type":47,"value":2707},{"type":47,"value":3294}," inside each action object.",{"type":42,"tag":156,"props":3296,"children":3297},{},[3298,3303,3305,3310],{"type":42,"tag":63,"props":3299,"children":3300},{},[3301],{"type":47,"value":3302},"Rule ID conflicts.",{"type":47,"value":3304}," POST to ",{"type":42,"tag":116,"props":3306,"children":3308},{"className":3307},[],[3309],{"type":47,"value":259},{"type":47,"value":3311}," with an existing ID returns 409. Either omit the ID to\nauto-generate, or check existence first.",{"type":42,"tag":156,"props":3313,"children":3314},{},[3315,3320,3322,3328],{"type":42,"tag":63,"props":3316,"children":3317},{},[3318],{"type":47,"value":3319},"API key ownership.",{"type":47,"value":3321}," Rules run using the API key of the user who created or last updated them. If that user's\npermissions change or the user is deleted, the rule may fail silently. Use ",{"type":42,"tag":116,"props":3323,"children":3325},{"className":3324},[],[3326],{"type":47,"value":3327},"_update_api_key",{"type":47,"value":3329}," to re-associate.",{"type":42,"tag":156,"props":3331,"children":3332},{},[3333,3338,3340,3346],{"type":42,"tag":63,"props":3334,"children":3335},{},[3336],{"type":47,"value":3337},"Too many actions per rule.",{"type":47,"value":3339}," Rules generating thousands of alerts with multiple actions can clog Task Manager. The\nserver setting ",{"type":42,"tag":116,"props":3341,"children":3343},{"className":3342},[],[3344],{"type":47,"value":3345},"xpack.alerting.rules.run.actions.max",{"type":47,"value":3347}," (default varies) limits actions per run. Design rules to use\nalert summaries or limit term sizes.",{"type":42,"tag":156,"props":3349,"children":3350},{},[3351,3356,3358,3364,3366,3372],{"type":42,"tag":63,"props":3352,"children":3353},{},[3354],{"type":47,"value":3355},"Long-running rules.",{"type":47,"value":3357}," Rules that run expensive queries are cancelled after ",{"type":42,"tag":116,"props":3359,"children":3361},{"className":3360},[],[3362],{"type":47,"value":3363},"xpack.alerting.rules.run.timeout",{"type":47,"value":3365},"\n(default ",{"type":42,"tag":116,"props":3367,"children":3369},{"className":3368},[],[3370],{"type":47,"value":3371},"5m",{"type":47,"value":3373},"). When cancelled, all alerts and actions from that run are discarded. Optimize queries or increase the\ntimeout for specific rule types.",{"type":42,"tag":156,"props":3375,"children":3376},{},[3377,3382],{"type":42,"tag":63,"props":3378,"children":3379},{},[3380],{"type":47,"value":3381},"Concurrent update conflicts.",{"type":47,"value":3383}," PUT returns 409 if the rule was modified by another user since you last read it.\nAlways GET the latest version before updating.",{"type":42,"tag":156,"props":3385,"children":3386},{},[3387,3392],{"type":42,"tag":63,"props":3388,"children":3389},{},[3390],{"type":47,"value":3391},"Import\u002Fexport loses secrets.",{"type":47,"value":3393}," Rules exported via Saved Objects are disabled on import. Connectors lose their\nsecrets and must be re-configured.",{"type":42,"tag":50,"props":3395,"children":3397},{"id":3396},"examples",[3398],{"type":47,"value":3399},"Examples",{"type":42,"tag":57,"props":3401,"children":3402},{},[3403,3408,3410,3416,3417,3423,3424,3430,3432,3438,3440,3446,3448,3453],{"type":42,"tag":63,"props":3404,"children":3405},{},[3406],{"type":47,"value":3407},"Create a threshold alert:",{"type":47,"value":3409}," \"Alert me when CPU exceeds 90% on any host for 5 minutes.\" Use\n",{"type":42,"tag":116,"props":3411,"children":3413},{"className":3412},[],[3414],{"type":47,"value":3415},"rule_type_id: \".index-threshold\"",{"type":47,"value":665},{"type":42,"tag":116,"props":3418,"children":3420},{"className":3419},[],[3421],{"type":47,"value":3422},"aggField: \"system.cpu.total.pct\"",{"type":47,"value":665},{"type":42,"tag":116,"props":3425,"children":3427},{"className":3426},[],[3428],{"type":47,"value":3429},"threshold: [0.9]",{"type":47,"value":3431},", and ",{"type":42,"tag":116,"props":3433,"children":3435},{"className":3434},[],[3436],{"type":47,"value":3437},"timeWindowSize: 5",{"type":47,"value":3439},".\nAttach a PagerDuty action on ",{"type":42,"tag":116,"props":3441,"children":3443},{"className":3442},[],[3444],{"type":47,"value":3445},"\"threshold met\"",{"type":47,"value":3447}," and a matching ",{"type":42,"tag":116,"props":3449,"children":3451},{"className":3450},[],[3452],{"type":47,"value":3003},{"type":47,"value":3454}," action to auto-close incidents.",{"type":42,"tag":57,"props":3456,"children":3457},{},[3458,3463,3465,3471,3473,3479,3480,3486],{"type":42,"tag":63,"props":3459,"children":3460},{},[3461],{"type":47,"value":3462},"Find rules by tag:",{"type":47,"value":3464}," \"Show all production alerting rules.\" ",{"type":42,"tag":116,"props":3466,"children":3468},{"className":3467},[],[3469],{"type":47,"value":3470},"GET \u002Fapi\u002Falerting\u002Frules\u002F_find",{"type":47,"value":3472}," with\n",{"type":42,"tag":116,"props":3474,"children":3476},{"className":3475},[],[3477],{"type":47,"value":3478},"filter=alert.attributes.tags:\"production\"",{"type":47,"value":1491},{"type":42,"tag":116,"props":3481,"children":3483},{"className":3482},[],[3484],{"type":47,"value":3485},"sort_field=name",{"type":47,"value":3487}," to page through results.",{"type":42,"tag":57,"props":3489,"children":3490},{},[3491,3496,3498,3504,3506,3512],{"type":42,"tag":63,"props":3492,"children":3493},{},[3494],{"type":47,"value":3495},"Pause a rule temporarily:",{"type":47,"value":3497}," \"Disable rule abc123 until next Monday.\" ",{"type":42,"tag":116,"props":3499,"children":3501},{"className":3500},[],[3502],{"type":47,"value":3503},"POST \u002Fapi\u002Falerting\u002Frule\u002Fabc123\u002F_disable",{"type":47,"value":3505},".\nRe-enable with ",{"type":42,"tag":116,"props":3507,"children":3509},{"className":3508},[],[3510],{"type":47,"value":3511},"_enable",{"type":47,"value":3513}," when ready; the rule retains all configuration while disabled.",{"type":42,"tag":50,"props":3515,"children":3517},{"id":3516},"guidelines",[3518],{"type":47,"value":3519},"Guidelines",{"type":42,"tag":152,"props":3521,"children":3522},{},[3523,3535,3559,3575,3588,3600,3619],{"type":42,"tag":156,"props":3524,"children":3525},{},[3526,3528,3533],{"type":47,"value":3527},"Include ",{"type":42,"tag":116,"props":3529,"children":3531},{"className":3530},[],[3532],{"type":47,"value":1083},{"type":47,"value":3534}," on every POST, PUT, and DELETE; omitting it returns 400.",{"type":42,"tag":156,"props":3536,"children":3537},{},[3538,3540,3545,3547,3552,3553,3558],{"type":47,"value":3539},"Set ",{"type":42,"tag":116,"props":3541,"children":3543},{"className":3542},[],[3544],{"type":47,"value":2707},{"type":47,"value":3546}," inside each action object — rule-level ",{"type":42,"tag":116,"props":3548,"children":3550},{"className":3549},[],[3551],{"type":47,"value":929},{"type":47,"value":1491},{"type":42,"tag":116,"props":3554,"children":3556},{"className":3555},[],[3557],{"type":47,"value":2938},{"type":47,"value":3285},{"type":42,"tag":156,"props":3560,"children":3561},{},[3562,3567,3568,3573],{"type":42,"tag":116,"props":3563,"children":3565},{"className":3564},[],[3566],{"type":47,"value":648},{"type":47,"value":1491},{"type":42,"tag":116,"props":3569,"children":3571},{"className":3570},[],[3572],{"type":47,"value":685},{"type":47,"value":3574}," are immutable after creation; delete and recreate the rule to change them.",{"type":42,"tag":156,"props":3576,"children":3577},{},[3578,3580,3586],{"type":47,"value":3579},"Prefix paths with ",{"type":42,"tag":116,"props":3581,"children":3583},{"className":3582},[],[3584],{"type":47,"value":3585},"\u002Fs\u002F\u003Cspace_id>\u002Fapi\u002Falerting\u002F",{"type":47,"value":3587}," for non-default Kibana Spaces.",{"type":42,"tag":156,"props":3589,"children":3590},{},[3591,3593,3598],{"type":47,"value":3592},"Always pair an active action with a ",{"type":42,"tag":116,"props":3594,"children":3596},{"className":3595},[],[3597],{"type":47,"value":3003},{"type":47,"value":3599}," action to auto-close PagerDuty, Jira, and ServiceNow incidents.",{"type":42,"tag":156,"props":3601,"children":3602},{},[3603,3605,3610,3612,3617],{"type":47,"value":3604},"Run ",{"type":42,"tag":116,"props":3606,"children":3608},{"className":3607},[],[3609],{"type":47,"value":1465},{"type":47,"value":3611}," first to discover valid ",{"type":42,"tag":116,"props":3613,"children":3615},{"className":3614},[],[3616],{"type":47,"value":685},{"type":47,"value":3618}," values and action group names.",{"type":42,"tag":156,"props":3620,"children":3621},{},[3622,3623,3628,3630,3635],{"type":47,"value":2348},{"type":42,"tag":116,"props":3624,"children":3626},{"className":3625},[],[3627],{"type":47,"value":971},{"type":47,"value":3629}," to suppress transient spikes; use the ",{"type":42,"tag":116,"props":3631,"children":3633},{"className":3632},[],[3634],{"type":47,"value":998},{"type":47,"value":3636}," object to reduce noise from unstable conditions.",{"type":42,"tag":50,"props":3638,"children":3640},{"id":3639},"additional-resources",[3641],{"type":47,"value":3642},"Additional Resources",{"type":42,"tag":152,"props":3644,"children":3645},{},[3646,3658,3668,3678,3688,3698,3708],{"type":42,"tag":156,"props":3647,"children":3648},{},[3649],{"type":42,"tag":3650,"props":3651,"children":3655},"a",{"href":3652,"rel":3653},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fapi\u002Fdoc\u002Fkibana\u002Fgroup\u002Fendpoint-alerting",[3654],"nofollow",[3656],{"type":47,"value":3657},"Kibana Alerting API Reference",{"type":42,"tag":156,"props":3659,"children":3660},{},[3661],{"type":42,"tag":3650,"props":3662,"children":3665},{"href":3663,"rel":3664},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fexplore-analyze\u002Falerting\u002Falerts",[3654],[3666],{"type":47,"value":3667},"Alerting Concepts",{"type":42,"tag":156,"props":3669,"children":3670},{},[3671],{"type":42,"tag":3650,"props":3672,"children":3675},{"href":3673,"rel":3674},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fexplore-analyze\u002Falerting\u002Falerts\u002Fcreate-manage-rules",[3654],[3676],{"type":47,"value":3677},"Create and Manage Rules (UI)",{"type":42,"tag":156,"props":3679,"children":3680},{},[3681],{"type":42,"tag":3650,"props":3682,"children":3685},{"href":3683,"rel":3684},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fexplore-analyze\u002Falerting\u002Falerts\u002Frule-action-variables",[3654],[3686],{"type":47,"value":3687},"Rule Action Variables",{"type":42,"tag":156,"props":3689,"children":3690},{},[3691],{"type":42,"tag":3650,"props":3692,"children":3695},{"href":3693,"rel":3694},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fdeploy-manage\u002Fproduction-guidance\u002Fkibana-alerting-production-considerations",[3654],[3696],{"type":47,"value":3697},"Alerting Production Considerations",{"type":42,"tag":156,"props":3699,"children":3700},{},[3701],{"type":42,"tag":3650,"props":3702,"children":3705},{"href":3703,"rel":3704},"https:\u002F\u002Fregistry.terraform.io\u002Fproviders\u002Felastic\u002Felasticstack\u002Flatest\u002Fdocs\u002Fresources\u002Fkibana_alerting_rule",[3654],[3706],{"type":47,"value":3707},"Terraform: elasticstack_kibana_alerting_rule",{"type":42,"tag":156,"props":3709,"children":3710},{},[3711],{"type":42,"tag":3650,"props":3712,"children":3715},{"href":3713,"rel":3714},"https:\u002F\u002Fregistry.terraform.io\u002Fproviders\u002Felastic\u002Felasticstack\u002Flatest\u002Fdocs\u002Fguides\u002Felasticstack-kibana-rule",[3654],[3716],{"type":47,"value":3717},"Terraform: Managing Kibana Rule and Connector Resources",{"type":42,"tag":3719,"props":3720,"children":3721},"style",{},[3722],{"type":47,"value":3723},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3725,"total":3892},[3726,3745,3762,3777,3794,3806,3816,3831,3841,3855,3866,3879],{"slug":3727,"name":3727,"fn":3728,"description":3729,"org":3730,"tags":3731,"stars":3742,"repoUrl":3743,"updatedAt":3744},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3732,3735,3738,3739],{"name":3733,"slug":3734,"type":15},"Analytics","analytics",{"name":3736,"slug":3737,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":3740,"slug":3741,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":3746,"name":3746,"fn":3747,"description":3748,"org":3749,"tags":3750,"stars":3742,"repoUrl":3743,"updatedAt":3761},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3751,3754,3755,3758],{"name":3752,"slug":3753,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":3756,"slug":3757,"type":15},"Engineering","engineering",{"name":3759,"slug":3760,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":3763,"name":3763,"fn":3764,"description":3765,"org":3766,"tags":3767,"stars":3742,"repoUrl":3743,"updatedAt":3776},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3768,3769,3772,3773],{"name":9,"slug":8,"type":15},{"name":3770,"slug":3771,"type":15},"Elasticsearch","elasticsearch",{"name":3740,"slug":3741,"type":15},{"name":3774,"slug":3775,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":3778,"name":3778,"fn":3779,"description":3780,"org":3781,"tags":3782,"stars":23,"repoUrl":24,"updatedAt":3793},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3783,3786,3787,3790],{"name":3784,"slug":3785,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":3788,"slug":3789,"type":15},"Operations","operations",{"name":3791,"slug":3792,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":3795,"name":3795,"fn":3796,"description":3797,"org":3798,"tags":3799,"stars":23,"repoUrl":24,"updatedAt":3805},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3800,3801,3804],{"name":3784,"slug":3785,"type":15},{"name":3802,"slug":3803,"type":15},"Deployment","deployment",{"name":3770,"slug":3771,"type":15},"2026-07-12T07:46:42.353362",{"slug":3807,"name":3807,"fn":3808,"description":3809,"org":3810,"tags":3811,"stars":23,"repoUrl":24,"updatedAt":3815},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3812,3813,3814],{"name":3784,"slug":3785,"type":15},{"name":3770,"slug":3771,"type":15},{"name":3788,"slug":3789,"type":15},"2026-07-12T07:46:41.097412",{"slug":3817,"name":3817,"fn":3818,"description":3819,"org":3820,"tags":3821,"stars":23,"repoUrl":24,"updatedAt":3830},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3822,3823,3824,3827],{"name":3784,"slug":3785,"type":15},{"name":3770,"slug":3771,"type":15},{"name":3825,"slug":3826,"type":15},"Networking","networking",{"name":3828,"slug":3829,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":3832,"name":3832,"fn":3833,"description":3834,"org":3835,"tags":3836,"stars":23,"repoUrl":24,"updatedAt":3840},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3837,3838,3839],{"name":109,"slug":106,"type":15},{"name":3784,"slug":3785,"type":15},{"name":3770,"slug":3771,"type":15},"2026-07-12T07:46:39.783105",{"slug":3842,"name":3842,"fn":3843,"description":3844,"org":3845,"tags":3846,"stars":23,"repoUrl":24,"updatedAt":3854},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3847,3850,3851,3853],{"name":3848,"slug":3849,"type":15},"Audit","audit",{"name":3770,"slug":3771,"type":15},{"name":3852,"slug":727,"type":15},"Logs",{"name":3828,"slug":3829,"type":15},"2026-07-12T07:47:35.092599",{"slug":3856,"name":3856,"fn":3857,"description":3858,"org":3859,"tags":3860,"stars":23,"repoUrl":24,"updatedAt":3865},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3861,3862,3863,3864],{"name":109,"slug":106,"type":15},{"name":9,"slug":8,"type":15},{"name":3770,"slug":3771,"type":15},{"name":3828,"slug":3829,"type":15},"2026-07-12T07:47:41.474547",{"slug":3867,"name":3867,"fn":3868,"description":3869,"org":3870,"tags":3871,"stars":23,"repoUrl":24,"updatedAt":3878},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3872,3873,3874,3877],{"name":9,"slug":8,"type":15},{"name":3770,"slug":3771,"type":15},{"name":3875,"slug":3876,"type":15},"RBAC","rbac",{"name":3828,"slug":3829,"type":15},"2026-07-12T07:47:36.394177",{"slug":3880,"name":3880,"fn":3881,"description":3882,"org":3883,"tags":3884,"stars":23,"repoUrl":24,"updatedAt":3891},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3885,3886,3887,3888],{"name":3733,"slug":3734,"type":15},{"name":3736,"slug":3737,"type":15},{"name":3770,"slug":3771,"type":15},{"name":3889,"slug":3890,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86,{"items":3894,"total":2285},[3895,3902,3908,3914,3921,3927,3934],{"slug":3778,"name":3778,"fn":3779,"description":3780,"org":3896,"tags":3897,"stars":23,"repoUrl":24,"updatedAt":3793},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3898,3899,3900,3901],{"name":3784,"slug":3785,"type":15},{"name":9,"slug":8,"type":15},{"name":3788,"slug":3789,"type":15},{"name":3791,"slug":3792,"type":15},{"slug":3795,"name":3795,"fn":3796,"description":3797,"org":3903,"tags":3904,"stars":23,"repoUrl":24,"updatedAt":3805},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3905,3906,3907],{"name":3784,"slug":3785,"type":15},{"name":3802,"slug":3803,"type":15},{"name":3770,"slug":3771,"type":15},{"slug":3807,"name":3807,"fn":3808,"description":3809,"org":3909,"tags":3910,"stars":23,"repoUrl":24,"updatedAt":3815},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3911,3912,3913],{"name":3784,"slug":3785,"type":15},{"name":3770,"slug":3771,"type":15},{"name":3788,"slug":3789,"type":15},{"slug":3817,"name":3817,"fn":3818,"description":3819,"org":3915,"tags":3916,"stars":23,"repoUrl":24,"updatedAt":3830},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3917,3918,3919,3920],{"name":3784,"slug":3785,"type":15},{"name":3770,"slug":3771,"type":15},{"name":3825,"slug":3826,"type":15},{"name":3828,"slug":3829,"type":15},{"slug":3832,"name":3832,"fn":3833,"description":3834,"org":3922,"tags":3923,"stars":23,"repoUrl":24,"updatedAt":3840},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3924,3925,3926],{"name":109,"slug":106,"type":15},{"name":3784,"slug":3785,"type":15},{"name":3770,"slug":3771,"type":15},{"slug":3842,"name":3842,"fn":3843,"description":3844,"org":3928,"tags":3929,"stars":23,"repoUrl":24,"updatedAt":3854},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3930,3931,3932,3933],{"name":3848,"slug":3849,"type":15},{"name":3770,"slug":3771,"type":15},{"name":3852,"slug":727,"type":15},{"name":3828,"slug":3829,"type":15},{"slug":3856,"name":3856,"fn":3857,"description":3858,"org":3935,"tags":3936,"stars":23,"repoUrl":24,"updatedAt":3865},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[3937,3938,3939,3940],{"name":109,"slug":106,"type":15},{"name":9,"slug":8,"type":15},{"name":3770,"slug":3771,"type":15},{"name":3828,"slug":3829,"type":15}]