stack kb alerting put-alerting-rule-id cli command

elastic stack kb alerting put-alerting-rule-id \
  --id <id> \
  --name <name> \
  --schedule <schedule> \
  [options]

Update a rule

Behaviour flags:

--dry-run — validate all inputs and exit without performing any action

--id string required

The identifier for the rule.

--name string required

The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.

--schedule string required

--actions string[]

Repeatable: pass --actions multiple times to supply more than one value

--alert-delay string

Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.

--artifacts string

--flapping string

--notify-when enum

Indicates how frequently rule actions are triggered. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify notify_when at both the rule and action level. The recommended approach is to set it for each action individually. If you set notify_when at the rule level and then edit the rule, it will automatically be converted to action-specific values.

Values: onActionGroupChange, onActiveAlert, onThrottleInterval

--params string

The parameters for the rule.

--tags string[]

Repeatable: pass --tags multiple times to supply more than one value

--throttle string

Use the throttle property in the action frequency object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.

--input-file string

path to a JSON file to use as command input

--dry-run

validate all inputs and exit without performing any action (preview changes without applying them)

--no-validate

skip input validation and send the request as-is

--output-fields string

comma-separated list of fields to include in output (dot-notation supported)

--output-template string

Mustache-like template for custom text output (e.g. "{{id}}: {{name}}")

--json

output as JSON