An object containing desired status and explicit alert ids or a query to select alerts
One of:
signal_idsstring[] · format: nonempty · min items: 1required
List of alert ids. Use field _id on alert document or kibana.alert.uuid. Note: signals are a deprecated term for alerts.
statusenumrequired
Values:openclosedacknowledgedin-progress
conflictsenum · default: abort
Values:abortproceed
queryobjectrequired
runtime_fieldsmapstring to enum · max properties: 100
Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from _source[fieldName] and included in the query as runtime_mappings. Use this to reference fields stored on the alert _source that are not part of the alerts index mapping, for example, custom fields added via data view runtime fields. The combined number of unique field names across runtime_fields and runtime_mappings must not exceed 100.
<string>enum
Values:keywordlongdoubledateipbooleangeo_point
runtime_mappingsmapstring to object · max properties: 100
Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script. The combined number of unique field names across runtime_fields and runtime_mappings must not exceed 100.
<string>object
formatstring · max length: 100
Format string for date runtime fields, for example strict_date_optional_time.
scriptobject
Inline Painless script that Elasticsearch evaluates for each alert. Only source is accepted. Stored scripts, parameterized scripts (params), and non-default lang values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.
sourcestring · max length: 10000required
Painless script source to execute.
typeenumrequired
The data type for the runtime field type. Determines how the field value is indexed and queried.