AuthThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.AvailabilityGenerally available since 9.5This functionality is generally available and ready for production usage.Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Logical operator applied to the conditions array. "any" expires the snooze when at least one condition is met; "all" requires every condition to be met. When conditions are provided but this field is omitted, defaults to "any".
Values:anyall
conditionsunionanyOf[] · max items: 10
One or more conditions that, when met, automatically expire the snooze. Supported types: field_change, severity_change, severity_equals.
Any of:
Expires the snooze when the value of the specified alert field changes.
typeenumrequired
Values:field_change
fieldstring · max length: 1000required
The alert field to watch, written as a dot-notation path. When the value of the specified alert field changes, the snooze expires
Expires the snooze when the severity of the specified alert changes.
typeenumrequired
Values:severity_change
Expires the snooze when the severity of the specified alert equals a target level.
typeenumrequired
Values:severity_equals
valueenumrequired
The target severity level: critical, major, high, medium, minor, low, warning, or info.
Values:criticalmajorhighmediumminorlowwarninginfo
expires_atstring · max length: 30
The datetime at which the snooze expires, in ISO 8601 format (YYYY-MM-DDTHH:mm:ss.sssZ). When omitted, the snooze persists indefinitely unless manually removed or a defined condition is met.