stack kb alerting-v2 get-alerting-v2-execution-history-action-policies cli command

elastic stack kb alerting-v2 get-alerting-v2-execution-history-action-policies \
  --page <page> \
  --per-page <per-page> \
  --sort-field <sort-field> \
  --sort-order <sort-order> \
  [options]

List action policy executions

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--page number required

Page number (1-indexed). Defaults to 1.

--per-page number required

Number of events per page. Defaults to 20.

--sort-field enum required

Sort field. Defaults to "dispatched_at".

Values: dispatched_at

--sort-order enum required

Sort direction. Defaults to "desc".

Values: asc, desc

--from string

Inclusive ISO datetime lower bound on the event timestamp; overrides the default 24-hour window. Independent of alert_ids — e.g. set it to an alert’s start time to scope results to that alert’s lifetime.

--to string

Inclusive ISO datetime upper bound on the event timestamp.

--alert-ids string[]

Alert filter. Narrows events to those referencing at least one of the provided alert IDs.

Repeatable: pass --alert-ids multiple times to supply more than one value

--search string

Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).

--rule-ids string[]

Explicit rule filter. Narrows events to those referencing at least one of the provided rule IDs. Also unions with the search filter if both are provided.

Repeatable: pass --rule-ids multiple times to supply more than one value

--outcomes string[]

Outcome filter. When omitted matches all outcomes. Pass one or more of "success", "throttled", "failure" to narrow.

Repeatable: pass --outcomes multiple times to supply more than one value

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON