Type to search.

Snooze an alert

Base URL
https://{kibana_url}
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.5 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

rule_id string · max length: 256 required

The identifier for the rule.

alert_id string · max length: 1000 required

The identifier for the alert.

Query parameters

validate_alerts_existence boolean

Set to true to validate that the specified alert exists. If a 400 error is returned, the specified alert does not exist. Defaults to true.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

condition_operator enum

Logical operator applied to the conditions array. "any" expires the snooze when at least one condition is met; "all" requires every condition to be met. When conditions are provided but this field is omitted, defaults to "any".

Values: any all
conditions union anyOf[] · max items: 10

One or more conditions that, when met, automatically expire the snooze. Supported types: field_change, severity_change, severity_equals.

Any of:

Expires the snooze when the value of the specified alert field changes.

type enum required
Values: field_change
field string · max length: 1000 required

The alert field to watch, written as a dot-notation path. When the value of the specified alert field changes, the snooze expires

expires_at string · max length: 30

The datetime at which the snooze expires, in ISO 8601 format (YYYY-MM-DDTHH:mm:ss.sssZ). When omitted, the snooze persists indefinitely unless manually removed or a defined condition is met.

Responses

204

Indicates a successful call.

400

Indicates an invalid schema or parameters.

403

Indicates that this call is forbidden.

404

Indicates the specified rule or alert doesn't exist.