kibana-alerting-rules

A reference for creating and managing Kibana alerting rules through both the REST API and Terraform, covering the full rule lifecycle and rules-as-code workflows. It frames a rule as three parts: conditions (what to detect), a schedule (how often to check), and actions (what happens when conditions are met), where met conditions create alerts that trigger actions through connectors. Authentication requires API key or Basic auth, and every mutating request must include the kbn-xsrf: true header; required privileges are all for the relevant Kibana feature (Stack Rules, Observability, or Security) plus read for Actions and Connectors. An API table maps operations to endpoints under <kibana_url>/api/alerting (or /s/<space_id>/... for non-default spaces): create (POST rule/{id}), update (PUT), get, delete, find (rules/_find), list rule types, enable, disable, mute and unmute all, mute and unmute a specific alert, update API key, create and delete snooze schedules, and health check. Rule creation documents required fields (name, rule_type_id such as .es-query or .index-threshold, consumer such as alerts, apm, logs, metrics, securitySolution, or stackAlerts, params, and schedule like {"interval":"5m"}) plus optional fields including actions, tags, enabled, notify_when, alert_delay (for example {"active":3}), and flapping. A full curl example builds an Elasticsearch query rule with an index, timeField, esQuery, threshold and comparator, time window, and a Slack-connector action, and it notes that GET rule_types reveals params schemas. Updating sends the complete body (rule_type_id and consumer are immutable) and can return 409 Conflict for concurrent edits, prompting a re-fetch and retry. Finding rules supports pagination, search, sorting, and KQL filter parameters. Lifecycle operations for enable, disable, mute, and delete are shown, and a Terraform section uses the elasticstack provider's elasticstack_kibana_alerting_rule resource. Useful for alert automation and rules-as-code across Kibana spaces.