Type to search.

List rule executions

Base URL
https://{kibana_url}
  • GET /api/alerting/v2/execution_history/rules
  • GET /s/{space_id}/api/alerting/v2/execution_history/rules
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Planned We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Get a paginated list of rule execution events.

Required privileges

Privileges read_alerting-v2-execution-history

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

rule_ids string[] · min items: 1 · max items: 50

Rule id filter.

Free-text search. Matches rule name, description or rule ID (case-insensitive). Combined with rule_ids using AND.

outcomes enum[] · min items: 1 · max items: 2

Outcome filter.

Values: success failure
from string · format: date-time · max length: 64

Inclusive ISO datetime lower bound on event.start. Defaults to 24 hours before to, or before the request when to is omitted. Set it to see older executions.

to string · format: date-time · max length: 64

Inclusive ISO datetime upper bound on event.start.

sort_field enum · default: started_at required

Sort field. Defaults to started_at.

Values: started_at duration_ms
sort_order enum · default: desc required

Sort direction.

Values: asc desc
page integer · min: 1 · max: 10000 · default: 1 required

Page number.

per_page integer · min: 1 · max: 100 · default: 20 required

Number of results per page.

Responses

Returns a paginated list of rule execution events.

application/json
items object[] required
ended_at string · format: date-time · max length: 64 required
id string required
outcome enum required
Values: success failure
reason string

Why the run ended the way it did. Omitted when the source recorded no reason.

rule object required
id string required
version integer · min: -9007199254740991 · max: 9007199254740991

The rule version this run executed. Omitted until the rule executor emits its own event; the task-run event does not carry one.

started_at string · format: date-time · max length: 64 required
timings object required
duration_ms integer · min: 0 · max: 9007199254740991 required

Wall-clock duration of the run, in milliseconds.

scheduled_delay_ms integer · min: -9007199254740991 · max: 9007199254740991 required

Delay between the scheduled run time and the actual start, in milliseconds. Negative when the run started ahead of its scheduled time.

page integer · min: 1 · max: 9007199254740991 required
per_page integer · min: 1 · max: 9007199254740991 required
total integer · min: 0 · max: 9007199254740991 required

The number of rule executions matching the query. This count is an estimate: results above 10,000 may be reported as 10,000.