stack kb alerting get-alerting-rules-find cli command

elastic stack kb alerting get-alerting-rules-find [options]

Get information about rules

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--per-page number

The number of rules to return per page.

--page number

The page number to return.

--search string

An Elasticsearch simple_query_string query that filters the objects in the response.

--default-search-operator enum

The default operator to use for the simple_query_string.

Values: OR, AND

--search-fields string[]

The fields to perform the simple_query_string parsed query against.

Repeatable: pass --search-fields multiple times to supply more than one value

--sort-field string

Determines which field is used to sort the results. The field must exist in the attributes key of the response.

--sort-order enum

Determines the sort order.

Values: asc, desc

--has-reference string

Filters the rules that have a relation with the reference objects with a specific type and identifier.

--fields string[]

The fields to return in the attributes key of the response.

Repeatable: pass --fields multiple times to supply more than one value

--filter string

A KQL string that you filter with an attribute from your saved object. It should look like savedObjectType.attributes.title: "myTitle". However, if you used a direct attribute of a saved object, such as updatedAt, you must define your filter, for example, savedObjectType.updatedAt > 2018-12-22.

--filter-consumers string[]

Filters the returned rules by the consumer (Kibana application) that owns them, for example: siem, apm, infrastructure.

Repeatable: pass --filter-consumers multiple times to supply more than one value

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON