---
type: api
title: Get the SLO definitions
description: You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.<br/><br/>[Required authorization] Route required privileges: slo_read.
url: https://www.elastic.co/docs/api/doc/kibana/operation/operation-getdefinitionsop
resource: https://www.elastic.co/docs/api/doc/kibana/operation/operation-getdefinitionsop
products:
  - Kibana
---

# Get the SLO definitions

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/observability/slos/_definitions`
- `GET` `/s/{space_id}/api/observability/slos/_definitions`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Description

You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.

## Required privileges

- Privileges: `slo_read`

## Query string parameters

- `search` (string) — optional
  Filters the SLOs by name
- `includeOutdatedOnly` (union enum | boolean) — optional
  Indicates if the API returns only outdated SLO or all SLO definitions
  Values: `true`, `false`
- `includeHealth` (union enum | boolean) — optional
  Indicates if the API returns SLO health data with definitions
  Values: `true`, `false`
- `tags` (string) — optional
  Filters the SLOs by tag
- `page` (string) — optional
  The page to use for pagination, must be greater or equal than 1
- `perPage` (string) — optional
  Number of SLOs returned by page

## Request body

`application/json`

Any of:
- **object**
- **object**

## Responses

#### `200`

Successful request

`application/json`

- `page` (number)
- `perPage` (number)
- `results` (object[])
  - `artifacts` (object)
    Links to related assets for the SLO
    - `dashboards` (object[])
      Array of dashboard references
      - `id` (string)
        Dashboard saved-object id
  - `budgetingMethod` (union anyOf)
    The budgeting method to use when computing the rollup data.
    Values: `occurrences`, `timeslices`
  - `createdAt` (string · format: date-time · max length: 128)
    The creation date
  - `createdBy` (string)
    The user who created the SLO.
  - `description` (string)
    The description of the SLO.
  - `enabled` (boolean)
    Indicate if the SLO is enabled
  - `groupBy` (union anyOf)
    optional group by field or fields to use to generate an SLO per distinct value
    Values: `*`
  - `health` (object)
    - `isProblematic` (boolean)
    - `rollup` (object)
      - `isProblematic` (boolean)
      - `missing` (boolean)
      - `state` (enum)
        Values: `stopped`, `started`, `stopping`, `aborting`, `failed`, `indexing`, `unavailable`
      - `stateMatches` (boolean)
      - `status` (enum)
        Values: `healthy`, `unhealthy`, `unavailable`
    - `summary` (object)
      - `isProblematic` (boolean)
      - `missing` (boolean)
      - `state` (enum)
        Values: `stopped`, `started`, `stopping`, `aborting`, `failed`, `indexing`, `unavailable`
      - `stateMatches` (boolean)
      - `status` (enum)
        Values: `healthy`, `unhealthy`, `unavailable`
  - `id` (string · min length: 8 · max length: 48 · pattern: ^[a-z0-9-_]+$)
    The identifier of the SLO.
  - `indicator` (union oneOf)
    The indicator to use to compute the SLI
    - **type: sli.apm.transactionDuration** (`type: sli.apm.transactionDuration`)
      Defines properties for the APM latency indicator type
      - `type` (enum)
        The type of indicator.
        Values: `sli.apm.transactionDuration`
      - `params` (object)
        An object containing the indicator parameters.
        - `dataViewId` (string)
          The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.
        - `environment` (union enum | string)
          The APM service environment or "*"
          Values: `*`
        - `filter` (union anyOf)
          KQL query used for filtering the data
          - **string**
            the KQL query to filter the documents with.
          - **SLOKqlWithFilters**
            Defines properties for a filter
            - `filters` (object[])
              - `$state` (object)
              - `meta` (object)
                Defines properties for a filter
                - `alias` (string) — nullable
                - `controlledBy` (string)
                - `disabled` (boolean)
                - `field` (string)
                - `group` (string)
                - `index` (string)
                - `isMultiIndex` (boolean)
                - `key` (string)
                - `negate` (boolean)
                - `params` (object)
                - `type` (string)
                - `value` (union anyOf)
                  - **string**
                  - **{ format, from, gt, … }**
                    - `format` (string · max length: 1024)
                    - `from` (union number | string)
                    - `gt` (union number | string)
                    - `gte` (union number | string)
                    - `lt` (union number | string)
                    - `lte` (union number | string)
                    - `to` (union number | string)
                  - **[]string | number | boolean**
              - `query` (map string to object)
            - `kqlQuery` (string)
              the KQL query to filter the documents with.
        - `index` (string)
          The index used by APM metrics
        - `service` (union enum | string)
          The APM service name
          Values: `*`
        - `threshold` (number)
          The latency threshold in milliseconds
        - `transactionName` (union enum | string)
          The APM transaction name or "*"
          Values: `*`
        - `transactionType` (union enum | string)
          The APM transaction type or "*"
          Values: `*`
    - **type: sli.apm.transactionErrorRate** (`type: sli.apm.transactionErrorRate`)
      Defines properties for the APM availability indicator type
      - `type` (enum)
        The type of indicator.
        Values: `sli.apm.transactionErrorRate`
      - `params` (object)
        An object containing the indicator parameters.
        - `dataViewId` (string)
          The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.
        - `environment` (union enum | string)
          The APM service environment or "*"
          Values: `*`
        - `filter` (union anyOf)
          KQL query used for filtering the data
          Same options as `filter` in `params`
        - `index` (string)
          The index used by APM metrics
        - `service` (union enum | string)
          The APM service name
          Values: `*`
        - `transactionName` (union enum | string)
          The APM transaction name or "*"
          Values: `*`
        - `transactionType` (union enum | string)
          The APM transaction type or "*"
          Values: `*`
    - **type: sli.synthetics.availability** (`type: sli.synthetics.availability`)
      Defines properties for a synthetics availability indicator type
      - `type` (enum)
        The type of indicator.
        Values: `sli.synthetics.availability`
      - `params` (object)
        An object containing the indicator parameters.
        - `dataViewId` (string)
          The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.
        - `filter` (union anyOf)
          the KQL query to filter the documents with.
          Same options as `filter` in `params`
        - `index` (string)
          The index or index pattern to use
        - `monitorIds` (object[])
          The monitors to create the SLO from
          - `label` (union enum | string)
            Values: `*`
          - `value` (union enum | string)
            Values: `*`
        - `projects` (object[])
          The projects to filter the monitors by
          - `label` (union enum | string)
            Values: `*`
          - `value` (union enum | string)
            Values: `*`
        - `tags` (object[])
          The tags to filter the monitors by
          - `label` (union enum | string)
            Values: `*`
          - `value` (union enum | string)
            Values: `*`
    - **type: sli.kql.custom** (`type: sli.kql.custom`)
      Defines properties for a custom query indicator type
      - `type` (enum)
        The type of indicator.
        Values: `sli.kql.custom`
      - `params` (object)
        An object containing the indicator parameters.
        - `dataViewId` (string)
          The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.
        - `filter` (union anyOf)
          the KQL query to filter the documents with.
          Same options as `filter` in `params`
        - `good` (union anyOf)
          the KQL query used to define the good events, or an object defining the KQL query and filters.
          Same options as `filter` in `params`
        - `index` (string)
          The index or index pattern to use
        - `timestampField` (string)
          The timestamp field used in the source indice.
        - `total` (union anyOf)
          the KQL query used to define all events, or an object defining the KQL query and filters.
          Same options as `filter` in `params`
    - **type: sli.metric.custom** (`type: sli.metric.custom`)
      Defines properties for a custom metric indicator type
      - `type` (enum)
        The type of indicator.
        Values: `sli.metric.custom`
      - `params` (object)
        An object containing the indicator parameters.
        - `dataViewId` (string)
          The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.
        - `filter` (union anyOf)
          the KQL query to filter the documents with.
          Same options as `filter` in `params`
        - `good` (object)
          An object defining the "good" metrics and equation
          - `equation` (string)
            The equation to calculate the metric.
          - `metrics` (union anyOf[])
            List of metrics with their name, aggregation type, and field.
            - **aggregation: sum**
              - `aggregation` (enum)
                The aggregation type of the metric.
                Values: `sum`
              - `field` (string)
                The field of the metric.
              - `filter` (union anyOf)
                The filter to apply to the metric.
                Same options as `filter` in `params`
              - `name` (string)
                The name of the metric. Only valid options are A-Z
            - **aggregation: doc_count**
              - `aggregation` (enum)
                The aggregation type of the metric.
                Values: `doc_count`
              - `filter` (union anyOf)
                The filter to apply to the metric.
                Same options as `filter` in `params`
              - `name` (string)
                The name of the metric. Only valid options are A-Z
        - `index` (string)
          The index or index pattern to use
        - `timestampField` (string)
          The timestamp field used in the source indice.
        - `total` (object)
          An object defining the "total" metrics and equation
          - `equation` (string)
            The equation to calculate the metric.
          - `metrics` (union anyOf[])
            List of metrics with their name, aggregation type, and field.
            - **aggregation: sum**
              - `aggregation` (enum)
                The aggregation type of the metric.
                Values: `sum`
              - `field` (string)
                The field of the metric.
              - `filter` (union anyOf)
                The filter to apply to the metric.
                Same options as `filter` in `params`
              - `name` (string)
                The name of the metric. Only valid options are A-Z
            - **aggregation: doc_count**
              - `aggregation` (enum)
                The aggregation type of the metric.
                Values: `doc_count`
              - `filter` (union anyOf)
                The filter to apply to the metric.
                Same options as `filter` in `params`
              - `name` (string)
                The name of the metric. Only valid options are A-Z
    - **type: sli.metric.timeslice** (`type: sli.metric.timeslice`)
      Defines properties for a timeslice metric indicator type
      - `type` (enum)
        The type of indicator.
        Values: `sli.metric.timeslice`
      - `params` (object)
        An object containing the indicator parameters.
        - `dataViewId` (string)
          The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.
        - `filter` (union anyOf)
          the KQL query to filter the documents with.
          Same options as `filter` in `params`
        - `index` (string)
          The index or index pattern to use
        - `metric` (object)
          An object defining the metrics, equation, and threshold to determine if it's a good slice or not
          - `comparator` (enum)
            The comparator to use to compare the equation to the threshold.
            Values: `GT`, `GTE`, `LT`, `LTE`
          - `equation` (string)
            The equation to calculate the metric.
          - `metrics` (union anyOf[])
            List of metrics with their name, aggregation type, and field.
            - **SLOTimesliceMetricBasicMetricWithField**
              - `aggregation` (enum)
                The aggregation type of the metric.
                Values: `avg`, `max`, `min`, `sum`, `cardinality`, `last_value`, `std_deviation`
              - `field` (string)
                The field of the metric.
              - `filter` (union anyOf)
                The filter to apply to the metric.
                Same options as `filter` in `params`
              - `name` (string)
                The name of the metric. Only valid options are A-Z
            - **aggregation: doc_count**
              - `aggregation` (enum)
                The aggregation type of the metric. Only valid option is "doc_count"
                Values: `doc_count`
              - `filter` (union anyOf)
                The filter to apply to the metric.
                Same options as `filter` in `params`
              - `name` (string)
                The name of the metric. Only valid options are A-Z
            - **aggregation: percentile**
              - `aggregation` (enum)
                The aggregation type of the metric. Only valid option is "percentile"
                Values: `percentile`
              - `field` (string)
                The field of the metric.
              - `filter` (union anyOf)
                The filter to apply to the metric.
                Same options as `filter` in `params`
              - `name` (string)
                The name of the metric. Only valid options are A-Z
              - `percentile` (number)
                The percentile value.
          - `threshold` (number)
            The threshold used to determine if the metric is a good slice or not.
        - `timestampField` (string)
          The timestamp field used in the source indice.
    - **type: sli.histogram.custom** (`type: sli.histogram.custom`)
      Defines properties for a histogram indicator type
      - `type` (enum)
        The type of indicator.
        Values: `sli.histogram.custom`
      - `params` (object)
        An object containing the indicator parameters.
        - `dataViewId` (string)
          The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.
        - `filter` (union anyOf)
          the KQL query to filter the documents with.
          Same options as `filter` in `params`
        - `good` (union anyOf)
          An object defining the "good" events
          - **aggregation: value_count**
            - `aggregation` (enum)
              The type of aggregation to use.
              Values: `value_count`
            - `field` (string)
              The field use to aggregate the good events.
            - `filter` (union anyOf)
              The filter for events.
              Same options as `filter` in `params`
          - **aggregation: range**
            - `aggregation` (enum)
              The type of aggregation to use.
              Values: `range`
            - `field` (string)
              The field use to aggregate the good events.
            - `filter` (union anyOf)
              The filter for events.
              Same options as `filter` in `params`
            - `from` (number)
              The starting value of the range. Only required for "range" aggregations.
            - `to` (number)
              The ending value of the range. Only required for "range" aggregations.
        - `index` (string)
          The index or index pattern to use
        - `timestampField` (string)
          The timestamp field used in the source indice.
        - `total` (union anyOf)
          An object defining the "total" events
          - **aggregation: value_count**
            - `aggregation` (enum)
              The type of aggregation to use.
              Values: `value_count`
            - `field` (string)
              The field use to aggregate the good events.
            - `filter` (union anyOf)
              The filter for events.
              Same options as `filter` in `params`
          - **aggregation: range**
            - `aggregation` (enum)
              The type of aggregation to use.
              Values: `range`
            - `field` (string)
              The field use to aggregate the good events.
            - `filter` (union anyOf)
              The filter for events.
              Same options as `filter` in `params`
            - `from` (number)
              The starting value of the range. Only required for "range" aggregations.
            - `to` (number)
              The ending value of the range. Only required for "range" aggregations.
  - `name` (string)
    The name of the SLO.
  - `objective` (object)
    Defines properties for the SLO objective
    - `target` (number · > 0 · < 1)
      the target objective between 0 and 1 excluded
    - `timesliceTarget` (number · min: 0 · max: 1)
      the target objective for each slice when using a timeslices budgeting method
    - `timesliceWindow` (string · max length: 16)
      the duration of each slice when using a timeslices budgeting method, as {duraton}{unit}
  - `revision` (number)
    The SLO revision
  - `settings` (object)
    Defines properties for SLO settings.
    - `frequency` (string · max length: 16)
      The interval between checks for changes in the source data. The minimum value is 1m and the maximum is 59m. The default value is 1 minute.
    - `preventCrossProjectSearch` (boolean) — deprecated
      Pin the L1 rollup transform to the local/origin project only, preventing flat-world (cross-linked-project) reads. Only applies on serverless. Default is false, meaning rollup transforms target all linked projects.
    - `preventInitialBackfill` (boolean)
      Start aggregating data from the time the SLO is created, instead of backfilling data from the beginning of the time window.
    - `projectRoutings` (string · max length: 8192) — nullable
      ES ProjectRouting expression controlling which linked projects the L1 rollup reads. When set (including null), overrides preventCrossProjectSearch. null and `_alias:_origin` mean origin only; `_alias:*` means all linked projects. Subset example `_id:p1 AND _id:p2`.
    - `syncDelay` (string · max length: 16)
      The time delay in minutes between the current time and the latest source data time. Increasing the value will delay any alerting. The default value is 1 minute. The minimum value is 1m and the maximum is 359m. It should always be greater then source index refresh interval.
    - `syncField` (string) — nullable
      The date field that is used to identify new documents in the source. It is strongly recommended to use a field that contains the ingest timestamp. If you use a different field, you might need to set the delay such that it accounts for data transmission delays. When unspecified, we use the indicator timestamp field.
  - `tags` (string[])
    List of tags
  - `timeWindow` (union oneOf)
    Defines properties for the SLO time window
    - **type: rolling** (`type: rolling`)
      - `type` (enum)
        Indicates weither the time window is a rolling or a calendar aligned time window.
        Values: `rolling`
      - `duration` (string · max length: 16)
        the duration formatted as {duration}{unit}. Accepted values for rolling: 7d, 30d, 90d
    - **type: calendarAligned** (`type: calendarAligned`)
      - `type` (enum)
        Indicates weither the time window is a rolling or a calendar aligned time window.
        Values: `calendarAligned`
      - `duration` (string · max length: 16)
        the duration formatted as {duration}{unit}. Accepted values for calendar aligned: 1w (weekly) or 1M (monthly)
  - `updatedAt` (string · format: date-time · max length: 128)
    The last update date
  - `updatedBy` (string)
    The user who last updated the SLO.
  - `version` (number)
    The internal SLO version
- `total` (number)
#### `400`

Bad request

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (number)
#### `401`

Unauthorized response

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (number)
#### `403`

Forbidden response

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (number)
## Code examples

#### Console

```console
GET kbn:/api/observability/slos/_definitions
{}
```

#### curl

```curl
curl -X GET "${KIBANA_URL}/api/observability/slos/_definitions" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{}'
```

## Response examples

#### A paginated list of SLO definitions

`application/json`

```json
{
  "page": 1,
  "perPage": 25,
  "results": [
    {
      "budgetingMethod": "occurrences",
      "createdAt": "2025-01-12T10:03:19.000Z",
      "description": "Availability of my web service",
      "enabled": true,
      "groupBy": "*",
      "id": "8853df00-ae2e-11ed-90af-09bb6422b258",
      "indicator": {
        "params": {
          "filter": "field.environment : \u0022production\u0022 and service.name : \u0022my-service\u0022",
          "good": "request.status_code : \u00222xx\u0022",
          "index": "logs-*",
          "timestampField": "@timestamp",
          "total": "request.status_code : *"
        },
        "type": "sli.kql.custom"
      },
      "name": "My Service Availability",
      "objective": {
        "target": 0.99
      },
      "revision": 1,
      "settings": {
        "frequency": "5m",
        "preventInitialBackfill": false,
        "syncDelay": "5m"
      },
      "tags": [
        "production"
      ],
      "timeWindow": {
        "duration": "30d",
        "type": "rolling"
      },
      "updatedAt": "2025-01-12T10:03:19.000Z",
      "version": 2
    }
  ],
  "total": 1
}
```

#### Bad request

`application/json`

```json
{
  "error": "Bad Request",
  "message": "Invalid value \u0027foo\u0027 supplied to: includeOutdatedOnly",
  "statusCode": 400
}
```

#### Unauthorized

`application/json`

```json
{
  "error": "Unauthorized",
  "message": "security_exception: unable to authenticate user for REST request [/api/observability/slos/_definitions]",
  "statusCode": 401
}
```

#### Forbidden

`application/json`

```json
{
  "error": "Forbidden",
  "message": "security_exception: action [slo_read] is unauthorized for user",
  "statusCode": 403
}
```