Type to search.

Create rules in bulk

Base URL
https://{kibana_url}
  • POST /api/alerting/v2/rules/_bulk_create
  • POST /s/{space_id}/api/alerting/v2/rules/_bulk_create
Auth

Creates up to 100 rules in a single request. Each item can include a client-supplied id. Kibana generates an identifier when id is omitted. The request succeeds with HTTP 200 even when some rules fail. Created rules are returned in items. Failures are returned in errors. Check errors before treating the request as fully successful. To create a single rule, use POST /api/alerting/v2/rules.

Required privileges

Privileges manage_alerting-v2-rules

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

items object[] · min items: 1 · max items: 100 required

The rules to create. Must contain between 1 and 100 rules.

enabled boolean · default: true

If true (default), the rule runs on its schedule after creation. If false, the rule is saved but does not run until you enable it.

id string · min length: 1 · max length: 150 · pattern: ^[a-zA-Z0-9_-]+$

Optional rule ID. If omitted, Kibana generates one. IDs in the request must be unique.

kind enum required

Whether the rule creates alerts (alert) or only stores matching events (signal).

Values: alert signal
metadata object required

Rule metadata.

description string · min length: 1 · max length: 1024

Human-readable description of the rule. Omit to leave it unset; send null on PATCH to clear it. An empty string is rejected.

name string · min length: 1 · max length: 256 required

Rule name.

routing_tags string[] · min items: 1 · max items: 20

Routing tags that link alerts from this rule to action policies. An action policy applies when its matcher.tags contains at least one of these tags. Only allowed when kind is "alert".

tags string[] · min items: 1 · max items: 20

Tags for categorization, e.g. ["production", "infra"].

no_data union oneOf

What the rule does when a group has no data. Required when kind is alert. Not allowed when kind is signal. Any strategy other than ignore requires either query.breach or no_data.query, so that a group with no data can be told apart from one that stopped breaching.

One of: (determined by strategy)
strategy: ignore

Does not check whether a group still has data. Missing groups do not produce no_data events.

strategy enum required
Values: ignore
query object required

ES|QL query the rule evaluates. base is required. breach is an optional clause appended to it.

base string · min length: 1 · max length: 10000 required

ES|QL query that specifies the data to evaluate. Must include a FROM clause. Kibana applies the time filter from schedule.lookback using time_field.

recovery union oneOf

When an alert recovers. Required when kind is alert. Not allowed when kind is signal.

One of: (determined by strategy)
strategy: no_breach

Recovers the alert when its group no longer appears in the breach results.

strategy enum required
Values: no_breach
schedule object required

Execution schedule configuration.

every string · max length: 32 required

Execution interval, e.g. 1m, 5m, 1h.

lookback string · max length: 32

Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.

time_field string · min length: 1 · max length: 256 · default: @timestamp

Document field Kibana uses with schedule.lookback to time-filter query.base.

Responses

Created rules are returned in items. Failures are returned in errors.

application/json
errors object[] required

Errors for rules that could not be created. Each entry carries the index of the item in the request, its id when one was supplied, and the error. Empty when every requested rule was created.

error object required
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

id string

The client-supplied id of the failed item. Omitted when the item had none.

index integer · min: 0 · max: 9007199254740991 required

Zero-based position of the failed item in the request items.

items object[] required

Rules that were created. Rules listed in errors are not included.

created_at string · format: date-time · max length: 64 required

ISO timestamp when the rule was created.

created_by object required

Actor who created the rule.

profile_uid string required nullable

User profile ID of the actor, or null when it cannot be resolved.

enabled boolean required

Whether the rule is enabled.

id string required

Unique rule identifier.

kind enum required

Whether the rule creates alerts (alert) or only stores matching events (signal).

Values: alert signal
metadata object required

Rule metadata.

description string · min length: 1 · max length: 1024

Human-readable description of the rule. Omit to leave it unset; send null on PATCH to clear it. An empty string is rejected.

name string · min length: 1 · max length: 256 required

Rule name.

routing_tags string[] · min items: 1 · max items: 20

Routing tags that link alerts from this rule to action policies. An action policy applies when its matcher.tags contains at least one of these tags. Only allowed when kind is "alert".

tags string[] · min items: 1 · max items: 20

Tags for categorization, e.g. ["production", "infra"].

no_data union oneOf

What the rule does when a group has no data. Required when kind is alert. Not allowed when kind is signal. Any strategy other than ignore requires either query.breach or no_data.query, so that a group with no data can be told apart from one that stopped breaching.

One of: (determined by strategy)
strategy: ignore

Does not check whether a group still has data. Missing groups do not produce no_data events.

strategy enum required
Values: ignore
query object required

ES|QL query the rule evaluates. base is required. breach is an optional clause appended to it.

base string · min length: 1 · max length: 10000 required

ES|QL query that specifies the data to evaluate. Must include a FROM clause. Kibana applies the time filter from schedule.lookback using time_field.

recovery union oneOf

When an alert recovers. Required when kind is alert. Not allowed when kind is signal.

One of: (determined by strategy)
strategy: no_breach

Recovers the alert when its group no longer appears in the breach results.

strategy enum required
Values: no_breach
schedule object required

Execution schedule configuration.

every string · max length: 32 required

Execution interval, e.g. 1m, 5m, 1h.

lookback string · max length: 32

Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.

time_field string · min length: 1 · max length: 256 · default: @timestamp

Document field Kibana uses with schedule.lookback to time-filter query.base.

updated_at string · format: date-time · max length: 64 required

ISO timestamp when the rule was last updated.

updated_by object required

Actor who last updated the rule.

profile_uid string required nullable

User profile ID of the actor, or null when it cannot be resolved.

version integer · min: 1 · max: 9007199254740991 required

Monotonically increasing integer number representing a rule configuration version, incremented on every change. Used on generated rule events as rule.version.