Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Elasticstack Provider
  3. API Docs
  4. KibanaAlertingRule
elasticstack 0.11.15 published on Wednesday, Apr 23, 2025 by elastic
elastic/terraform-provider-elasticstack

elasticstack.KibanaAlertingRule

Explore with Pulumi AI

elasticstack logo
elasticstack 0.11.15 published on Wednesday, Apr 23, 2025 by elastic
elastic/terraform-provider-elasticstack

    Creates or updates a Kibana alerting rule. See https://www.elastic.co/guide/en/kibana/current/create-and-manage-rules.html

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as elasticstack from "@pulumi/elasticstack";

const example = new elasticstack.KibanaAlertingRule("example", {
    consumer: "alerts",
    notifyWhen: "onActiveAlert",
    params: JSON.stringify({
        aggType: "avg",
        groupBy: "top",
        termSize: 10,
        timeWindowSize: 10,
        timeWindowUnit: "s",
        threshold: [10],
        thresholdComparator: ">",
        index: ["test-index"],
        timeField: "@timestamp",
        aggField: "version",
        termField: "name",
    }),
    ruleTypeId: ".index-threshold",
    interval: "1m",
    enabled: true,
});

    import pulumi
import json
import pulumi_elasticstack as elasticstack

example = elasticstack.KibanaAlertingRule("example",
    consumer="alerts",
    notify_when="onActiveAlert",
    params=json.dumps({
        "aggType": "avg",
        "groupBy": "top",
        "termSize": 10,
        "timeWindowSize": 10,
        "timeWindowUnit": "s",
        "threshold": [10],
        "thresholdComparator": ">",
        "index": ["test-index"],
        "timeField": "@timestamp",
        "aggField": "version",
        "termField": "name",
    }),
    rule_type_id=".index-threshold",
    interval="1m",
    enabled=True)

    package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-terraform-provider/sdks/go/elasticstack/elasticstack"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"aggType":        "avg",
			"groupBy":        "top",
			"termSize":       10,
			"timeWindowSize": 10,
			"timeWindowUnit": "s",
			"threshold": []float64{
				10,
			},
			"thresholdComparator": ">",
			"index": []string{
				"test-index",
			},
			"timeField": "@timestamp",
			"aggField":  "version",
			"termField": "name",
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		_, err = elasticstack.NewKibanaAlertingRule(ctx, "example", &elasticstack.KibanaAlertingRuleArgs{
			Consumer:   pulumi.String("alerts"),
			NotifyWhen: pulumi.String("onActiveAlert"),
			Params:     pulumi.String(json0),
			RuleTypeId: pulumi.String(".index-threshold"),
			Interval:   pulumi.String("1m"),
			Enabled:    pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Elasticstack = Pulumi.Elasticstack;

return await Deployment.RunAsync(() => 
{
    var example = new Elasticstack.KibanaAlertingRule("example", new()
    {
        Consumer = "alerts",
        NotifyWhen = "onActiveAlert",
        Params = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["aggType"] = "avg",
            ["groupBy"] = "top",
            ["termSize"] = 10,
            ["timeWindowSize"] = 10,
            ["timeWindowUnit"] = "s",
            ["threshold"] = new[]
            {
                10,
            },
            ["thresholdComparator"] = ">",
            ["index"] = new[]
            {
                "test-index",
            },
            ["timeField"] = "@timestamp",
            ["aggField"] = "version",
            ["termField"] = "name",
        }),
        RuleTypeId = ".index-threshold",
        Interval = "1m",
        Enabled = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.elasticstack.KibanaAlertingRule;
import com.pulumi.elasticstack.KibanaAlertingRuleArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new KibanaAlertingRule("example", KibanaAlertingRuleArgs.builder()
            .consumer("alerts")
            .notifyWhen("onActiveAlert")
            .params(serializeJson(
                jsonObject(
                    jsonProperty("aggType", "avg"),
                    jsonProperty("groupBy", "top"),
                    jsonProperty("termSize", 10),
                    jsonProperty("timeWindowSize", 10),
                    jsonProperty("timeWindowUnit", "s"),
                    jsonProperty("threshold", jsonArray(10)),
                    jsonProperty("thresholdComparator", ">"),
                    jsonProperty("index", jsonArray("test-index")),
                    jsonProperty("timeField", "@timestamp"),
                    jsonProperty("aggField", "version"),
                    jsonProperty("termField", "name")
                )))
            .ruleTypeId(".index-threshold")
            .interval("1m")
            .enabled(true)
            .build());

    }
}

    resources:
  example:
    type: elasticstack:KibanaAlertingRule
    properties:
      consumer: alerts
      notifyWhen: onActiveAlert
      params:
        fn::toJSON:
          aggType: avg
          groupBy: top
          termSize: 10
          timeWindowSize: 10
          timeWindowUnit: s
          threshold:
            - 10
          thresholdComparator: '>'
          index:
            - test-index
          timeField: '@timestamp'
          aggField: version
          termField: name
      ruleTypeId: .index-threshold
      interval: 1m
      enabled: true

    NOTE: api_key authentication is only supported for alerting rule resources from version 8.8.0 of the Elastic stack. Using an api_key will result in an error message like:

    Could not create API key - Unsupported scheme "ApiKey" for granting API Key

    Create KibanaAlertingRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new KibanaAlertingRule(name: string, args: KibanaAlertingRuleArgs, opts?: CustomResourceOptions);
    @overload
def KibanaAlertingRule(resource_name: str,
                       args: KibanaAlertingRuleArgs,
                       opts: Optional[ResourceOptions] = None)

@overload
def KibanaAlertingRule(resource_name: str,
                       opts: Optional[ResourceOptions] = None,
                       interval: Optional[str] = None,
                       rule_type_id: Optional[str] = None,
                       consumer: Optional[str] = None,
                       params: Optional[str] = None,
                       name: Optional[str] = None,
                       kibana_alerting_rule_id: Optional[str] = None,
                       actions: Optional[Sequence[KibanaAlertingRuleActionArgs]] = None,
                       notify_when: Optional[str] = None,
                       enabled: Optional[bool] = None,
                       rule_id: Optional[str] = None,
                       alert_delay: Optional[float] = None,
                       space_id: Optional[str] = None,
                       tags: Optional[Sequence[str]] = None,
                       throttle: Optional[str] = None)
    func NewKibanaAlertingRule(ctx *Context, name string, args KibanaAlertingRuleArgs, opts ...ResourceOption) (*KibanaAlertingRule, error)
    public KibanaAlertingRule(string name, KibanaAlertingRuleArgs args, CustomResourceOptions? opts = null)
    public KibanaAlertingRule(String name, KibanaAlertingRuleArgs args)
public KibanaAlertingRule(String name, KibanaAlertingRuleArgs args, CustomResourceOptions options)

    type: elasticstack:KibanaAlertingRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args KibanaAlertingRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args KibanaAlertingRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args KibanaAlertingRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args KibanaAlertingRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args KibanaAlertingRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var kibanaAlertingRuleResource = new Elasticstack.KibanaAlertingRule("kibanaAlertingRuleResource", new()
{
    Interval = "string",
    RuleTypeId = "string",
    Consumer = "string",
    Params = "string",
    Name = "string",
    KibanaAlertingRuleId = "string",
    Actions = new[]
    {
        new Elasticstack.Inputs.KibanaAlertingRuleActionArgs
        {
            Id = "string",
            Params = "string",
            AlertsFilter = new Elasticstack.Inputs.KibanaAlertingRuleActionAlertsFilterArgs
            {
                Kql = "string",
                Timeframe = new Elasticstack.Inputs.KibanaAlertingRuleActionAlertsFilterTimeframeArgs
                {
                    Days = new[]
                    {
                        0,
                    },
                    HoursEnd = "string",
                    HoursStart = "string",
                    Timezone = "string",
                },
            },
            Frequency = new Elasticstack.Inputs.KibanaAlertingRuleActionFrequencyArgs
            {
                NotifyWhen = "string",
                Summary = false,
                Throttle = "string",
            },
            Group = "string",
        },
    },
    NotifyWhen = "string",
    Enabled = false,
    RuleId = "string",
    AlertDelay = 0,
    SpaceId = "string",
    Tags = new[]
    {
        "string",
    },
    Throttle = "string",
});

    example, err := elasticstack.NewKibanaAlertingRule(ctx, "kibanaAlertingRuleResource", &elasticstack.KibanaAlertingRuleArgs{
	Interval:             pulumi.String("string"),
	RuleTypeId:           pulumi.String("string"),
	Consumer:             pulumi.String("string"),
	Params:               pulumi.String("string"),
	Name:                 pulumi.String("string"),
	KibanaAlertingRuleId: pulumi.String("string"),
	Actions: elasticstack.KibanaAlertingRuleActionArray{
		&elasticstack.KibanaAlertingRuleActionArgs{
			Id:     pulumi.String("string"),
			Params: pulumi.String("string"),
			AlertsFilter: &elasticstack.KibanaAlertingRuleActionAlertsFilterArgs{
				Kql: pulumi.String("string"),
				Timeframe: &elasticstack.KibanaAlertingRuleActionAlertsFilterTimeframeArgs{
					Days: pulumi.Float64Array{
						pulumi.Float64(0),
					},
					HoursEnd:   pulumi.String("string"),
					HoursStart: pulumi.String("string"),
					Timezone:   pulumi.String("string"),
				},
			},
			Frequency: &elasticstack.KibanaAlertingRuleActionFrequencyArgs{
				NotifyWhen: pulumi.String("string"),
				Summary:    pulumi.Bool(false),
				Throttle:   pulumi.String("string"),
			},
			Group: pulumi.String("string"),
		},
	},
	NotifyWhen: pulumi.String("string"),
	Enabled:    pulumi.Bool(false),
	RuleId:     pulumi.String("string"),
	AlertDelay: pulumi.Float64(0),
	SpaceId:    pulumi.String("string"),
	Tags: pulumi.StringArray{
		pulumi.String("string"),
	},
	Throttle: pulumi.String("string"),
})

    var kibanaAlertingRuleResource = new KibanaAlertingRule("kibanaAlertingRuleResource", KibanaAlertingRuleArgs.builder()
    .interval("string")
    .ruleTypeId("string")
    .consumer("string")
    .params("string")
    .name("string")
    .kibanaAlertingRuleId("string")
    .actions(KibanaAlertingRuleActionArgs.builder()
        .id("string")
        .params("string")
        .alertsFilter(KibanaAlertingRuleActionAlertsFilterArgs.builder()
            .kql("string")
            .timeframe(KibanaAlertingRuleActionAlertsFilterTimeframeArgs.builder()
                .days(0)
                .hoursEnd("string")
                .hoursStart("string")
                .timezone("string")
                .build())
            .build())
        .frequency(KibanaAlertingRuleActionFrequencyArgs.builder()
            .notifyWhen("string")
            .summary(false)
            .throttle("string")
            .build())
        .group("string")
        .build())
    .notifyWhen("string")
    .enabled(false)
    .ruleId("string")
    .alertDelay(0)
    .spaceId("string")
    .tags("string")
    .throttle("string")
    .build());

    kibana_alerting_rule_resource = elasticstack.KibanaAlertingRule("kibanaAlertingRuleResource",
    interval="string",
    rule_type_id="string",
    consumer="string",
    params="string",
    name="string",
    kibana_alerting_rule_id="string",
    actions=[{
        "id": "string",
        "params": "string",
        "alerts_filter": {
            "kql": "string",
            "timeframe": {
                "days": [0],
                "hours_end": "string",
                "hours_start": "string",
                "timezone": "string",
            },
        },
        "frequency": {
            "notify_when": "string",
            "summary": False,
            "throttle": "string",
        },
        "group": "string",
    }],
    notify_when="string",
    enabled=False,
    rule_id="string",
    alert_delay=0,
    space_id="string",
    tags=["string"],
    throttle="string")

    const kibanaAlertingRuleResource = new elasticstack.KibanaAlertingRule("kibanaAlertingRuleResource", {
    interval: "string",
    ruleTypeId: "string",
    consumer: "string",
    params: "string",
    name: "string",
    kibanaAlertingRuleId: "string",
    actions: [{
        id: "string",
        params: "string",
        alertsFilter: {
            kql: "string",
            timeframe: {
                days: [0],
                hoursEnd: "string",
                hoursStart: "string",
                timezone: "string",
            },
        },
        frequency: {
            notifyWhen: "string",
            summary: false,
            throttle: "string",
        },
        group: "string",
    }],
    notifyWhen: "string",
    enabled: false,
    ruleId: "string",
    alertDelay: 0,
    spaceId: "string",
    tags: ["string"],
    throttle: "string",
});

    type: elasticstack:KibanaAlertingRule
properties:
    actions:
        - alertsFilter:
            kql: string
            timeframe:
                days:
                    - 0
                hoursEnd: string
                hoursStart: string
                timezone: string
          frequency:
            notifyWhen: string
            summary: false
            throttle: string
          group: string
          id: string
          params: string
    alertDelay: 0
    consumer: string
    enabled: false
    interval: string
    kibanaAlertingRuleId: string
    name: string
    notifyWhen: string
    params: string
    ruleId: string
    ruleTypeId: string
    spaceId: string
    tags:
        - string
    throttle: string

    KibanaAlertingRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The KibanaAlertingRule resource accepts the following input properties:

    Consumer string
    The name of the application or feature that owns the rule.
    Interval string
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    Params string
    The rule parameters, which differ for each rule type.
    RuleTypeId string
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    Actions List<KibanaAlertingRuleAction>
    An action that runs under defined conditions.
    AlertDelay double
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    Enabled bool
    Indicates if you want to run the rule on an interval basis.
    KibanaAlertingRuleId string
    The ID of this resource.
    Name string
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    NotifyWhen string
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    RuleId string
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags List<string>
    A list of tag names that are applied to the rule.
    Throttle string
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    Consumer string
    The name of the application or feature that owns the rule.
    Interval string
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    Params string
    The rule parameters, which differ for each rule type.
    RuleTypeId string
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    Actions []KibanaAlertingRuleActionArgs
    An action that runs under defined conditions.
    AlertDelay float64
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    Enabled bool
    Indicates if you want to run the rule on an interval basis.
    KibanaAlertingRuleId string
    The ID of this resource.
    Name string
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    NotifyWhen string
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    RuleId string
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags []string
    A list of tag names that are applied to the rule.
    Throttle string
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    consumer String
    The name of the application or feature that owns the rule.
    interval String
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    params String
    The rule parameters, which differ for each rule type.
    ruleTypeId String
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    actions List<KibanaAlertingRuleAction>
    An action that runs under defined conditions.
    alertDelay Double
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    enabled Boolean
    Indicates if you want to run the rule on an interval basis.
    kibanaAlertingRuleId String
    The ID of this resource.
    name String
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    notifyWhen String
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    ruleId String
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    A list of tag names that are applied to the rule.
    throttle String
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    consumer string
    The name of the application or feature that owns the rule.
    interval string
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    params string
    The rule parameters, which differ for each rule type.
    ruleTypeId string
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    actions KibanaAlertingRuleAction[]
    An action that runs under defined conditions.
    alertDelay number
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    enabled boolean
    Indicates if you want to run the rule on an interval basis.
    kibanaAlertingRuleId string
    The ID of this resource.
    name string
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    notifyWhen string
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    ruleId string
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    tags string[]
    A list of tag names that are applied to the rule.
    throttle string
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    consumer str
    The name of the application or feature that owns the rule.
    interval str
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    params str
    The rule parameters, which differ for each rule type.
    rule_type_id str
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    actions Sequence[KibanaAlertingRuleActionArgs]
    An action that runs under defined conditions.
    alert_delay float
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    enabled bool
    Indicates if you want to run the rule on an interval basis.
    kibana_alerting_rule_id str
    The ID of this resource.
    name str
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    notify_when str
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    rule_id str
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    tags Sequence[str]
    A list of tag names that are applied to the rule.
    throttle str
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    consumer String
    The name of the application or feature that owns the rule.
    interval String
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    params String
    The rule parameters, which differ for each rule type.
    ruleTypeId String
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    actions List<Property Map>
    An action that runs under defined conditions.
    alertDelay Number
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    enabled Boolean
    Indicates if you want to run the rule on an interval basis.
    kibanaAlertingRuleId String
    The ID of this resource.
    name String
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    notifyWhen String
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    ruleId String
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    A list of tag names that are applied to the rule.
    throttle String
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the KibanaAlertingRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    LastExecutionDate string
    Date of the last execution of this rule.
    LastExecutionStatus string
    Status of the last execution of this rule.
    ScheduledTaskId string
    ID of the scheduled task that will execute the alert.
    Id string
    The provider-assigned unique ID for this managed resource.
    LastExecutionDate string
    Date of the last execution of this rule.
    LastExecutionStatus string
    Status of the last execution of this rule.
    ScheduledTaskId string
    ID of the scheduled task that will execute the alert.
    id String
    The provider-assigned unique ID for this managed resource.
    lastExecutionDate String
    Date of the last execution of this rule.
    lastExecutionStatus String
    Status of the last execution of this rule.
    scheduledTaskId String
    ID of the scheduled task that will execute the alert.
    id string
    The provider-assigned unique ID for this managed resource.
    lastExecutionDate string
    Date of the last execution of this rule.
    lastExecutionStatus string
    Status of the last execution of this rule.
    scheduledTaskId string
    ID of the scheduled task that will execute the alert.
    id str
    The provider-assigned unique ID for this managed resource.
    last_execution_date str
    Date of the last execution of this rule.
    last_execution_status str
    Status of the last execution of this rule.
    scheduled_task_id str
    ID of the scheduled task that will execute the alert.
    id String
    The provider-assigned unique ID for this managed resource.
    lastExecutionDate String
    Date of the last execution of this rule.
    lastExecutionStatus String
    Status of the last execution of this rule.
    scheduledTaskId String
    ID of the scheduled task that will execute the alert.

    Look up Existing KibanaAlertingRule Resource

    Get an existing KibanaAlertingRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: KibanaAlertingRuleState, opts?: CustomResourceOptions): KibanaAlertingRule
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        actions: Optional[Sequence[KibanaAlertingRuleActionArgs]] = None,
        alert_delay: Optional[float] = None,
        consumer: Optional[str] = None,
        enabled: Optional[bool] = None,
        interval: Optional[str] = None,
        kibana_alerting_rule_id: Optional[str] = None,
        last_execution_date: Optional[str] = None,
        last_execution_status: Optional[str] = None,
        name: Optional[str] = None,
        notify_when: Optional[str] = None,
        params: Optional[str] = None,
        rule_id: Optional[str] = None,
        rule_type_id: Optional[str] = None,
        scheduled_task_id: Optional[str] = None,
        space_id: Optional[str] = None,
        tags: Optional[Sequence[str]] = None,
        throttle: Optional[str] = None) -> KibanaAlertingRule
    func GetKibanaAlertingRule(ctx *Context, name string, id IDInput, state *KibanaAlertingRuleState, opts ...ResourceOption) (*KibanaAlertingRule, error)
    public static KibanaAlertingRule Get(string name, Input<string> id, KibanaAlertingRuleState? state, CustomResourceOptions? opts = null)
    public static KibanaAlertingRule get(String name, Output<String> id, KibanaAlertingRuleState state, CustomResourceOptions options)
    resources:  _:    type: elasticstack:KibanaAlertingRule    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Actions List<KibanaAlertingRuleAction>
    An action that runs under defined conditions.
    AlertDelay double
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    Consumer string
    The name of the application or feature that owns the rule.
    Enabled bool
    Indicates if you want to run the rule on an interval basis.
    Interval string
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    KibanaAlertingRuleId string
    The ID of this resource.
    LastExecutionDate string
    Date of the last execution of this rule.
    LastExecutionStatus string
    Status of the last execution of this rule.
    Name string
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    NotifyWhen string
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    Params string
    The rule parameters, which differ for each rule type.
    RuleId string
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    RuleTypeId string
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    ScheduledTaskId string
    ID of the scheduled task that will execute the alert.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags List<string>
    A list of tag names that are applied to the rule.
    Throttle string
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    Actions []KibanaAlertingRuleActionArgs
    An action that runs under defined conditions.
    AlertDelay float64
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    Consumer string
    The name of the application or feature that owns the rule.
    Enabled bool
    Indicates if you want to run the rule on an interval basis.
    Interval string
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    KibanaAlertingRuleId string
    The ID of this resource.
    LastExecutionDate string
    Date of the last execution of this rule.
    LastExecutionStatus string
    Status of the last execution of this rule.
    Name string
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    NotifyWhen string
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    Params string
    The rule parameters, which differ for each rule type.
    RuleId string
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    RuleTypeId string
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    ScheduledTaskId string
    ID of the scheduled task that will execute the alert.
    SpaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    Tags []string
    A list of tag names that are applied to the rule.
    Throttle string
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    actions List<KibanaAlertingRuleAction>
    An action that runs under defined conditions.
    alertDelay Double
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    consumer String
    The name of the application or feature that owns the rule.
    enabled Boolean
    Indicates if you want to run the rule on an interval basis.
    interval String
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    kibanaAlertingRuleId String
    The ID of this resource.
    lastExecutionDate String
    Date of the last execution of this rule.
    lastExecutionStatus String
    Status of the last execution of this rule.
    name String
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    notifyWhen String
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    params String
    The rule parameters, which differ for each rule type.
    ruleId String
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    ruleTypeId String
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    scheduledTaskId String
    ID of the scheduled task that will execute the alert.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    A list of tag names that are applied to the rule.
    throttle String
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    actions KibanaAlertingRuleAction[]
    An action that runs under defined conditions.
    alertDelay number
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    consumer string
    The name of the application or feature that owns the rule.
    enabled boolean
    Indicates if you want to run the rule on an interval basis.
    interval string
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    kibanaAlertingRuleId string
    The ID of this resource.
    lastExecutionDate string
    Date of the last execution of this rule.
    lastExecutionStatus string
    Status of the last execution of this rule.
    name string
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    notifyWhen string
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    params string
    The rule parameters, which differ for each rule type.
    ruleId string
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    ruleTypeId string
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    scheduledTaskId string
    ID of the scheduled task that will execute the alert.
    spaceId string
    An identifier for the space. If space_id is not provided, the default space is used.
    tags string[]
    A list of tag names that are applied to the rule.
    throttle string
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    actions Sequence[KibanaAlertingRuleActionArgs]
    An action that runs under defined conditions.
    alert_delay float
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    consumer str
    The name of the application or feature that owns the rule.
    enabled bool
    Indicates if you want to run the rule on an interval basis.
    interval str
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    kibana_alerting_rule_id str
    The ID of this resource.
    last_execution_date str
    Date of the last execution of this rule.
    last_execution_status str
    Status of the last execution of this rule.
    name str
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    notify_when str
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    params str
    The rule parameters, which differ for each rule type.
    rule_id str
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    rule_type_id str
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    scheduled_task_id str
    ID of the scheduled task that will execute the alert.
    space_id str
    An identifier for the space. If space_id is not provided, the default space is used.
    tags Sequence[str]
    A list of tag names that are applied to the rule.
    throttle str
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    actions List<Property Map>
    An action that runs under defined conditions.
    alertDelay Number
    A number that indicates how many consecutive runs need to meet the rule conditions for an alert to occur.
    consumer String
    The name of the application or feature that owns the rule.
    enabled Boolean
    Indicates if you want to run the rule on an interval basis.
    interval String
    The check interval, which specifies how frequently the rule conditions are checked. The interval must be specified in seconds, minutes, hours or days.
    kibanaAlertingRuleId String
    The ID of this resource.
    lastExecutionDate String
    Date of the last execution of this rule.
    lastExecutionStatus String
    Status of the last execution of this rule.
    name String
    The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
    notifyWhen String
    Required until v8.6.0. Deprecated in v8.13.0. Use the notify_when property in the action frequency object instead. Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    params String
    The rule parameters, which differ for each rule type.
    ruleId String
    The identifier for the rule. Until Kibana version 8.17.0 this should be a UUID v1 or v4, for later versions any format can be used. If it is omitted, an ID is randomly generated.
    ruleTypeId String
    The ID of the rule type that you want to call when the rule is scheduled to run. For more information about the valid values, list the rule types using Get rule types API or refer to the Rule types documentation.
    scheduledTaskId String
    ID of the scheduled task that will execute the alert.
    spaceId String
    An identifier for the space. If space_id is not provided, the default space is used.
    tags List<String>
    A list of tag names that are applied to the rule.
    throttle String
    Deprecated in 8.13.0. Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.

    Supporting Types

    KibanaAlertingRuleAction, KibanaAlertingRuleActionArgs

    Id string
    The identifier for the connector saved object.
    Params string
    The parameters for the action, which are sent to the connector.
    AlertsFilter KibanaAlertingRuleActionAlertsFilter
    Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.
    Frequency KibanaAlertingRuleActionFrequency
    The properties that affect how often actions are generated. If the rule type supports setting summary to true, the action can be a summary of alerts at the specified notification interval. Otherwise, an action runs for each alert at the specified notification interval. NOTE: You cannot specify these parameters when notify_when or throttle are defined at the rule level.
    Group string
    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names.
    Id string
    The identifier for the connector saved object.
    Params string
    The parameters for the action, which are sent to the connector.
    AlertsFilter KibanaAlertingRuleActionAlertsFilter
    Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.
    Frequency KibanaAlertingRuleActionFrequency
    The properties that affect how often actions are generated. If the rule type supports setting summary to true, the action can be a summary of alerts at the specified notification interval. Otherwise, an action runs for each alert at the specified notification interval. NOTE: You cannot specify these parameters when notify_when or throttle are defined at the rule level.
    Group string
    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names.
    id String
    The identifier for the connector saved object.
    params String
    The parameters for the action, which are sent to the connector.
    alertsFilter KibanaAlertingRuleActionAlertsFilter
    Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.
    frequency KibanaAlertingRuleActionFrequency
    The properties that affect how often actions are generated. If the rule type supports setting summary to true, the action can be a summary of alerts at the specified notification interval. Otherwise, an action runs for each alert at the specified notification interval. NOTE: You cannot specify these parameters when notify_when or throttle are defined at the rule level.
    group String
    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names.
    id string
    The identifier for the connector saved object.
    params string
    The parameters for the action, which are sent to the connector.
    alertsFilter KibanaAlertingRuleActionAlertsFilter
    Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.
    frequency KibanaAlertingRuleActionFrequency
    The properties that affect how often actions are generated. If the rule type supports setting summary to true, the action can be a summary of alerts at the specified notification interval. Otherwise, an action runs for each alert at the specified notification interval. NOTE: You cannot specify these parameters when notify_when or throttle are defined at the rule level.
    group string
    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names.
    id str
    The identifier for the connector saved object.
    params str
    The parameters for the action, which are sent to the connector.
    alerts_filter KibanaAlertingRuleActionAlertsFilter
    Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.
    frequency KibanaAlertingRuleActionFrequency
    The properties that affect how often actions are generated. If the rule type supports setting summary to true, the action can be a summary of alerts at the specified notification interval. Otherwise, an action runs for each alert at the specified notification interval. NOTE: You cannot specify these parameters when notify_when or throttle are defined at the rule level.
    group str
    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names.
    id String
    The identifier for the connector saved object.
    params String
    The parameters for the action, which are sent to the connector.
    alertsFilter Property Map
    Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.
    frequency Property Map
    The properties that affect how often actions are generated. If the rule type supports setting summary to true, the action can be a summary of alerts at the specified notification interval. Otherwise, an action runs for each alert at the specified notification interval. NOTE: You cannot specify these parameters when notify_when or throttle are defined at the rule level.
    group String
    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names.

    KibanaAlertingRuleActionAlertsFilter, KibanaAlertingRuleActionAlertsFilterArgs

    Kql string
    Defines a query filter that determines whether the action runs. Written in Kibana Query Language (KQL).
    Timeframe KibanaAlertingRuleActionAlertsFilterTimeframe
    Defines a period that limits whether the action runs.
    Kql string
    Defines a query filter that determines whether the action runs. Written in Kibana Query Language (KQL).
    Timeframe KibanaAlertingRuleActionAlertsFilterTimeframe
    Defines a period that limits whether the action runs.
    kql String
    Defines a query filter that determines whether the action runs. Written in Kibana Query Language (KQL).
    timeframe KibanaAlertingRuleActionAlertsFilterTimeframe
    Defines a period that limits whether the action runs.
    kql string
    Defines a query filter that determines whether the action runs. Written in Kibana Query Language (KQL).
    timeframe KibanaAlertingRuleActionAlertsFilterTimeframe
    Defines a period that limits whether the action runs.
    kql str
    Defines a query filter that determines whether the action runs. Written in Kibana Query Language (KQL).
    timeframe KibanaAlertingRuleActionAlertsFilterTimeframe
    Defines a period that limits whether the action runs.
    kql String
    Defines a query filter that determines whether the action runs. Written in Kibana Query Language (KQL).
    timeframe Property Map
    Defines a period that limits whether the action runs.

    KibanaAlertingRuleActionAlertsFilterTimeframe, KibanaAlertingRuleActionAlertsFilterTimeframeArgs

    Days List<double>
    Defines the days of the week that the action can run, represented as an array of numbers. For example, 1 represents Monday. An empty array is equivalent to specifying all the days of the week.
    HoursEnd string
    Defines the range of time in a day that the action can run. The end of the time frame in 24-hour notation (hh:mm).
    HoursStart string
    Defines the range of time in a day that the action can run. The start of the time frame in 24-hour notation (hh:mm).
    Timezone string
    The ISO time zone for the hours values. Values such as UTC and UTC+1 also work but lack built-in daylight savings time support and are not recommended.
    Days []float64
    Defines the days of the week that the action can run, represented as an array of numbers. For example, 1 represents Monday. An empty array is equivalent to specifying all the days of the week.
    HoursEnd string
    Defines the range of time in a day that the action can run. The end of the time frame in 24-hour notation (hh:mm).
    HoursStart string
    Defines the range of time in a day that the action can run. The start of the time frame in 24-hour notation (hh:mm).
    Timezone string
    The ISO time zone for the hours values. Values such as UTC and UTC+1 also work but lack built-in daylight savings time support and are not recommended.
    days List<Double>
    Defines the days of the week that the action can run, represented as an array of numbers. For example, 1 represents Monday. An empty array is equivalent to specifying all the days of the week.
    hoursEnd String
    Defines the range of time in a day that the action can run. The end of the time frame in 24-hour notation (hh:mm).
    hoursStart String
    Defines the range of time in a day that the action can run. The start of the time frame in 24-hour notation (hh:mm).
    timezone String
    The ISO time zone for the hours values. Values such as UTC and UTC+1 also work but lack built-in daylight savings time support and are not recommended.
    days number[]
    Defines the days of the week that the action can run, represented as an array of numbers. For example, 1 represents Monday. An empty array is equivalent to specifying all the days of the week.
    hoursEnd string
    Defines the range of time in a day that the action can run. The end of the time frame in 24-hour notation (hh:mm).
    hoursStart string
    Defines the range of time in a day that the action can run. The start of the time frame in 24-hour notation (hh:mm).
    timezone string
    The ISO time zone for the hours values. Values such as UTC and UTC+1 also work but lack built-in daylight savings time support and are not recommended.
    days Sequence[float]
    Defines the days of the week that the action can run, represented as an array of numbers. For example, 1 represents Monday. An empty array is equivalent to specifying all the days of the week.
    hours_end str
    Defines the range of time in a day that the action can run. The end of the time frame in 24-hour notation (hh:mm).
    hours_start str
    Defines the range of time in a day that the action can run. The start of the time frame in 24-hour notation (hh:mm).
    timezone str
    The ISO time zone for the hours values. Values such as UTC and UTC+1 also work but lack built-in daylight savings time support and are not recommended.
    days List<Number>
    Defines the days of the week that the action can run, represented as an array of numbers. For example, 1 represents Monday. An empty array is equivalent to specifying all the days of the week.
    hoursEnd String
    Defines the range of time in a day that the action can run. The end of the time frame in 24-hour notation (hh:mm).
    hoursStart String
    Defines the range of time in a day that the action can run. The start of the time frame in 24-hour notation (hh:mm).
    timezone String
    The ISO time zone for the hours values. Values such as UTC and UTC+1 also work but lack built-in daylight savings time support and are not recommended.

    KibanaAlertingRuleActionFrequency, KibanaAlertingRuleActionFrequencyArgs

    NotifyWhen string
    Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    Summary bool
    Indicates whether the action is a summary.
    Throttle string
    Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    NotifyWhen string
    Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    Summary bool
    Indicates whether the action is a summary.
    Throttle string
    Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    notifyWhen String
    Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    summary Boolean
    Indicates whether the action is a summary.
    throttle String
    Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    notifyWhen string
    Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    summary boolean
    Indicates whether the action is a summary.
    throttle string
    Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    notify_when str
    Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    summary bool
    Indicates whether the action is a summary.
    throttle str
    Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.
    notifyWhen String
    Defines how often alerts generate actions. Valid values include: onActionGroupChange: Actions run when the alert status changes; onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific notify_when values.
    summary Boolean
    Indicates whether the action is a summary.
    throttle String
    Defines how often an alert generates repeated actions. This custom action interval must be specified in seconds, minutes, hours, or days. For example, 10m or 1h. This property is applicable only if notify_when is onThrottleInterval. NOTE: This is a rule level property; if you update the rule in Kibana, it is automatically changed to use action-specific throttle values.

    Import

    $ pulumi import elasticstack:index/kibanaAlertingRule:KibanaAlertingRule my_rule <space id>/<rule id>

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    elasticstack elastic/terraform-provider-elasticstack
    License
    Notes
    This Pulumi package is based on the elasticstack Terraform Provider.
    elasticstack logo
    elasticstack 0.11.15 published on Wednesday, Apr 23, 2025 by elastic
    elastic/terraform-provider-elasticstack