Type to search.

List action policy executions

Base URL
https://{kibana_url}
  • GET /api/alerting/v2/execution_history/action_policies
  • GET /s/{space_id}/api/alerting/v2/execution_history/action_policies
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Get a paginated list of dispatcher summary events for action policies in the current space.

Required privileges

Privileges read_alerting-v2-execution-history

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

page integer · min: 1 · max: 10000 · default: 1 required

Page number (1-indexed). Defaults to 1.

per_page integer · min: 1 · max: 100 · default: 20 required

Number of events per page. Defaults to 20.

from string · format: date-time · max length: 64

Inclusive ISO datetime lower bound on the event timestamp. Defaults to 24 hours before to, or before the request when to is omitted. Independent of alert_ids — e.g. set it to an alert’s start time to scope results to that alert’s lifetime.

to string · format: date-time · max length: 64

Inclusive ISO datetime upper bound on the event timestamp.

alert_ids string[] · min items: 1 · max items: 50

Alert filter. Narrows events to those referencing at least one of the provided alert IDs.

sort_field enum · default: dispatched_at required

Sort field. Defaults to "dispatched_at".

Values: dispatched_at
sort_order enum · default: desc required

Sort direction. Defaults to "desc".

Values: asc desc

Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).

rule_ids string[] · min items: 1 · max items: 50

Explicit rule filter. Narrows events to those referencing at least one of the provided rule IDs. Also unions with the search filter if both are provided.

outcomes enum[] · min items: 1 · max items: 3

Outcome filter. When omitted matches all outcomes. Pass one or more of "success", "throttled", "failure" to narrow.

Values: success throttled failure

Responses

Returns a paginated list of execution history events.

application/json
items object[] required
action_group_count number required
alert_count number required
alerts object[] · max items: 50 required

Alert IDs referenced by this event, bounded to 50. Empty when the event references no alerts. Use alert_count for the true total.

id string required
dispatched_at string · format: date-time · max length: 64 required
failure_reason enum
Values: missing_api_key workflow_not_found workflow_disabled schedule_error license_not_supported
outcome enum required
Values: success throttled failure
policy object required
id string required
name string

Omitted when the referenced resource could not be resolved.

rule_count number required

Number of rules referenced by this event after search or rule-filter narrowing. Unlike total on a list response, this is an exact count and it can exceed rules.length when the embedded array is truncated to the cap.

rules object[] · max items: 20 required

Rules referenced by this event, bounded to 20. When a search or rule filter narrows the match, this array is intersected with the matched subset server-side. Use rule_count for the full count.

id string required
name string

Omitted when the referenced resource could not be resolved.

workflows object[] · max items: 100 required
id string required
name string

Omitted when the referenced resource could not be resolved.

page integer · min: 1 · max: 9007199254740991 required
per_page integer · min: 1 · max: 9007199254740991 required
total integer · min: 0 · max: 9007199254740991 required

The number of action policy events matching the query. This count is an estimate: results above 10,000 may be reported as 10,000.