Disable rules matching a query (dry-run by default)
Base URL
https://{kibana_url}
POST/api/alerting/v2/rules/_disable_by_query
AuthThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.AvailabilityExperimental since 9.5This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply.Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
KQL filter string to match target resources. At most 10000 matching resources are processed per request. Cannot be empty; to target every resource use match_all: true.
forceboolean · default: false
When true, executes the operation. When false (default), returns a dry-run preview with match_count and a sample of matching resource IDs so the client can verify before committing.
match_allenum
When true, targets every resource. Requires an explicit opt-in. Omitted by default.
Values:true
searchstring · min length: 1 · max length: 256
Free-text search string matched against the resource-defined searchable fields. Cannot be empty; to target every resource use match_all: true.
Total number of resources matching the query. A dry run never fails on size, but if this exceeds 10000, re-sending the same query with force: true is rejected with BULK_QUERY_MATCH_LIMIT_EXCEEDED; narrow the query before executing.
samplestring[] · max items: 100required
Sample of matching resource IDs (up to 100) for spot-checking before executing.
Number of resources the operation successfully touched.
errorsobject[]required
Errors encountered during the operation.
errorobjectrequired
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.
idstringrequired
The identifier of the resource that failed.
Indicates an invalid schema or parameters.
application/json
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
errorstringrequired
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the request was not authenticated.
application/json
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
errorstringrequired
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the user does not have the required privileges to perform the request.
application/json
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
errorstringrequired
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates an unexpected server-side error.
application/json
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
errorstringrequired
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.
application/json
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
errorstringrequired
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.