List rules

Base URL
https://{kibana_url}
  • GET /api/alerting/v2/rules
Auth

Required privileges

Privileges read_alerting-v2-rules

Query parameters

page integer · min: 1 · max: 10000

The page number to return. Defaults to 1. page * per_page cannot exceed 10000.

per_page integer · min: 1 · max: 1000

The number of rules to return per page. Defaults to 20.

filter string · max length: 4096

The filter to apply to the rules.

sort_field enum

The field to sort rules by.

Values: kind enabled name
sort_order enum

The direction to sort rules.

Values: asc desc

A text string to search across rule fields.

Responses

Returns a paginated list of rules.

application/json
items object[] required

The list of rules.

created_at string required

ISO timestamp when the rule was created.

created_by string required nullable

User who created the rule.

enabled boolean required

Whether the rule is enabled.

id string required

Unique rule identifier.

kind enum required

Whether the rule creates alerts (alert) or only stores matching events (signal).

Values: alert signal
metadata object required
builder_type string · max length: 64

Identifies the rule builder that authored this rule (e.g. "threshold"). Absent for rules authored directly in ES|QL.

description string · max length: 1024

Human-readable description of the rule.

name string · min length: 1 · max length: 256 required

Rule name (must be unique within the space).

owner string · max length: 256

Owner of the rule.

tags string[] · min items: 1 · max items: 20

Tags for categorization, e.g. ["production", "infra"].

version integer · min: 1 · max: 9007199254740991 required

Monotonically increasing integer number representing a rule configuration version, incremented on every change. Used on generated rule events as rule.version.

no_data_strategy enum

How the rule behaves when it finds no data for a group. If you omit this field or set it to none, those runs are ignored. If you set last_known_status or recover, a standalone query (query.format: standalone) must include query.no_data. A composed query (query.format: composed) uses query.base to detect whether data is present. The emit value is not accepted when creating or updating rules.

Values: last_known_status emit recover none
query union oneOf required

Detection query configuration.

One of: (determined by format)
format: composed

Composed query: a shared base with appendable breach and recovery segments.

format enum required
Values: composed
base string · min length: 1 · max length: 10000 required

Base ES|QL query. Time filters are applied automatically via the lookback window.

recovery_strategy enum

The condition that marks an alert recovered. If omitted or set to none, recovery is disabled: the alert stays active even after the breach query stops returning matches, and state_transition.recovering_count / recovering_timeframe are not allowed. Set to no_breach to recover when the breach query stops returning matches. Set to query only when you also provide query.recovery.

Values: no_breach query none
schedule object required

Execution schedule configuration.

every string · max length: 32 required

Execution interval, e.g. 1m, 5m, 1h.

lookback string · max length: 32

Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.

time_field string · min length: 1 · max length: 128 · default: @timestamp

Document field used as the event time when applying the lookback window. Defaults to @timestamp.

updated_at string required

ISO timestamp when the rule was last updated.

updated_by string required nullable

User who last updated the rule.

version string

The saved object version token of the rule, used for optimistic concurrency control.

page number required

The current page number.

per_page number required

The number of rules per page.

total number required

The total number of rules matching the query.

Base URL
https://{kibana_url}