Elastic Stack

Elastic Stack (ELK Stack) Alerting API

Alerting enables you to define rules, which detect complex conditions within your data. When a condition is met, the rule tracks it as an alert and runs the actions that are defined in the rule. Actions typically involve the use of connectors to interact with Kibana services or third party integrations.

GitHub OpenAPI

Operations 23

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /api/alerting/_health Check alerting framework health · Get the alerting framework health #
Ask an LLM
“Is the Kibana alerting framework healthy and able to run rules?”
“Can I check whether alerting has the prerequisites it needs, like encryption keys?”
Tell an agent
Check the health of the alerting framework.
Report whether rule execution is healthy right now.
GET /api/alerting/rule_types List available rule types · Get the rule types #
Ask an LLM
“Which kinds of alerting rules can I create with my privileges?”
“What rule types are registered and which action groups do they support?”
Tell an agent
List the rule types I can use.
Show every registered rule type with its action groups.
DELETE /api/alerting/rule/{id} Delete a rule · Delete a rule #
Ask an LLM
“How do I permanently delete an alerting rule?”
“Can I remove a rule I no longer need?”
Tell an agent destructive · confirm first
Delete rule {id}.
Permanently remove alerting rule {id}.
GET /api/alerting/rule/{id} Get a rule's details · Get rule details #
Ask an LLM
“What schedule, params and actions does a particular rule have?”
“Can I retrieve a single rule by its identifier?”
Tell an agent
Get the details of rule {id}.
Show me how rule {id} is configured.
POST /api/alerting/rule/{id} Create a rule · Create a rule #
Ask an LLM
“How do I create a new alerting rule under an ID I pick?”
“Can I create a rule and let Kibana generate its identifier?”
Tell an agent
Create a new rule with ID {id}.
Set up a brand new alerting rule stored as {id}.
PUT /api/alerting/rule/{id} Update an existing rule · Update a rule #
Ask an LLM
“How do I change the name, schedule or actions on an existing rule?”
“Can I adjust a rule's alert delay or flapping settings after it was created?”
Tell an agent
Update rule {id} with name {name} and schedule {schedule}.
Edit rule {id}: keep name {name}, run every {schedule}, and tag it {tags}.
POST /api/alerting/rule/{id}/_disable Disable a rule · Disable a rule #
Ask an LLM
“How do I turn off a rule without deleting it?”
“When I disable a rule, can its active alerts be untracked too?”
Tell an agent
Disable rule {id}.
Disable rule {id} and set untrack to {untrack} for its alerts.
POST /api/alerting/rule/{id}/_enable Enable a rule · Enable a rule #
Ask an LLM
“How do I turn a disabled rule back on?”
“Can I re-enable a rule so its checks start running again?”
Tell an agent
Enable rule {id}.
Turn rule {id} back on.
POST /api/alerting/rule/{id}/_mute_all Mute all alerts for a rule · Mute all alerts #
Ask an LLM
“Can I silence every alert a rule produces while it keeps running?”
“What mutes all of a rule's alerts at once?”
Tell an agent
Mute all alerts for rule {id}.
Stop every alert from rule {id} from triggering actions.
POST /api/alerting/rule/{id}/_unmute_all Unmute all alerts for a rule · Unmute all alerts #
Ask an LLM
“How do I undo muting all of a rule's alerts?”
“Can a rule whose alerts are all muted start notifying again?”
Tell an agent
Unmute all alerts for rule {id}.
Let every alert from rule {id} trigger actions again.
POST /api/alerting/rule/{id}/_update_api_key Refresh the API key a rule runs with · Update the API key for a rule #
Ask an LLM
“How do I regenerate the API key an alerting rule uses?”
“Can a rule's credentials be switched to mine after the original owner left?”
Tell an agent
Update the API key for rule {id}.
Regenerate the credentials rule {id} runs with.
GET /api/alerting/rule/{id}/query_inspector Inspect the Elasticsearch query a rule runs · Get the Elasticsearch query for a rule #
Ask an LLM
“What Elasticsearch query does my rule actually execute?”
“Can I run a rule's query and see the response for a specific alert's time range?”
Tell an agent
Show the Elasticsearch query behind rule {id}.
Execute rule {id}'s query in mode {mode} using the time range of alert {alert_id}.
POST /api/alerting/rule/{id}/snooze_schedule Schedule a snooze for a rule · Schedule a snooze for the rule #
Ask an LLM
“Can I schedule a recurring snooze so a rule stays quiet during maintenance?”
“If a rule is snoozed, does it still run its checks?”
Tell an agent
Schedule a snooze for rule {id} using {schedule}.
Add a recurring quiet period {schedule} to rule {id}.
POST /api/alerting/rule/{rule_id}/alert/{alert_id}/_mute Mute one alert of a rule · Mute an alert #
Ask an LLM
“Can I mute a single alert instance without muting the whole rule?”
“How do I silence one noisy host's alert on a rule?”
Tell an agent
Mute alert {alert_id} on rule {rule_id}.
Mute alert {alert_id} of rule {rule_id}, checking it exists first ({validate_alerts_existence}).
POST /api/alerting/rule/{rule_id}/alert/{alert_id}/_snooze Snooze one alert of a rule · Snooze an alert #
Ask an LLM
“Can I snooze a single alert until a time or until a condition is met?”
“Is snoozing one alert different from muting it?”
Tell an agent
Snooze alert {alert_id} on rule {rule_id} until {expires_at}.
Snooze alert {alert_id} of rule {rule_id} until conditions {conditions} are met.
POST /api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute Unmute one alert of a rule · Unmute an alert #
Ask an LLM
“How do I unmute a single alert I muted earlier?”
“Can one muted alert instance trigger actions again?”
Tell an agent
Unmute alert {alert_id} on rule {rule_id}.
Let alert {alert_id} from rule {rule_id} notify again after muting.
POST /api/alerting/rule/{rule_id}/alert/{alert_id}/_unsnooze Unsnooze one alert of a rule · Unsnooze an alert #
Ask an LLM
“How do I end the snooze on one alert before it expires?”
“Can I cancel a single alert's snooze condition?”
Tell an agent
Unsnooze alert {alert_id} on rule {rule_id}.
Cancel the snooze on alert {alert_id} of rule {rule_id} early.
DELETE /api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId} Delete a rule's snooze schedule · Delete a snooze schedule for a rule #
Ask an LLM
“How do I remove a scheduled snooze from a rule?”
“Can I cancel one recurring snooze window on a rule?”
Tell an agent destructive · confirm first
Delete snooze schedule {scheduleId} from rule {ruleId}.
Remove the scheduled quiet period {scheduleId} on rule {ruleId}.
GET /api/alerting/rules/_find Search and list rules · Get information about rules #
Ask an LLM
“Which rules match a search term or KQL filter?”
“Can I page through rules and return only certain fields?”
Tell an agent
Find rules matching {search}.
List rules filtered by {filter}, sorted by {sort_field} {sort_order}.
POST /api/alerting/rules/backfill/_find Find rule backfills · Find backfills for rules #
Ask an LLM
“Which backfill runs are scheduled or running for my rules?”
“Can I filter backfills by rule and by time window?”
Tell an agent
Find backfills for rules {rule_ids}.
List backfills that cover {start} to {end}, sorted by {sort_field}.
POST /api/alerting/rules/backfill/_schedule Schedule a rule backfill · Schedule a backfill for rules #
Ask an LLM
“Can I rerun a rule over a past time range to catch missed alerts?”
“What call schedules a backfill for one or more rules?”
Tell an agent
Schedule a backfill for my rules, sending kbn-xsrf header {kbn_xsrf}.
Queue a historical backfill run for the rules I choose.
DELETE /api/alerting/rules/backfill/{id} Delete a backfill · Delete a backfill by ID #
Ask an LLM
“How do I cancel a backfill I no longer want?”
“Can I delete one scheduled backfill by its ID?”
Tell an agent destructive · confirm first
Delete backfill {id}.
Cancel and remove the backfill {id}.
GET /api/alerting/rules/backfill/{id} Get a backfill · Get a backfill by ID #
Ask an LLM
“What is the status of a specific backfill I scheduled?”
“Can I look up one backfill by its ID?”
Tell an agent
Get backfill {id}.
Show the progress of backfill {id}.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-alerting-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-alerting-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-alerting-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana Alerting API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:


# --- truncated at 32 KB (390 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-alerting-api-openapi.yml