# Alerting API. Where can I find alert\_id?

**URL:** <https://discuss.elastic.co/t/alerting-api-where-can-i-find-alert-id/310730>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [July 27, 2022, 9:17am UTC](https://discuss.elastic.co/t/alerting-api-where-can-i-find-alert-id/310730 "2022-07-27T09:17:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![oandreiev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oandreiev/32/106503_2.png) [@oandreiev](https://discuss.elastic.co/u/oandreiev)\
**Post date:** [July 27, 2022, 9:17am UTC](https://discuss.elastic.co/t/alerting-api-where-can-i-find-alert-id/310730/1 "2022-07-27T09:17:35Z")

</div>

Hello,

I'm trying to use Kibana's alerting api for muting an alert. It looks like this:  
`POST <kibana host>:<port>/api/alerting/rule/<rule_id>/alert/<alert_id>/_mute`

Where I can find the **alert\_id**?  
I've thought that I can grab it from the received alert document, but it seems instead of alert.id it provides '\*' in case of no grouping and group field's value in case of grouping:

```auto
          "date" : "2022-07-27T08:58:30.524Z",
          "alert" : """{"id":"*","actionGroup":"metrics.threshold.fired","actionGroupName":"Alert"}""",
          "context" : """{"group":"*","alertState":"ALERT","reason":"container.cpu.usage is 0.04102938622236252 in the last 25 secs for all hosts. Alert when > 0.04.","viewInAppUrl":"https://kb:5601/app/metrics/explorer","timestamp":"2022-07-27T08:58:05.514Z","value":{"condition0":0.04102938622236252},"threshold":{"condition0":[0.04]},"metric":{"condition0":"container.cpu.usage"}}""",
          "rule" : """{"id":"af981d9e-3fc9-43cd-877b-e9fdc6590902","name":"cpu-dpls-main","type":"metrics.alert.threshold","spaceId":"default","tags":[]}"""
        }

```

The only way I see for now is grabbing it from the .internal.alerts-observability.\* index. But it is not very convenient.

What is the correct way for the alert.id receiving?

Thank you!

---

<div class="post-metadata">

**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\
**Post date:** [July 27, 2022, 12:43pm UTC](https://discuss.elastic.co/t/alerting-api-where-can-i-find-alert-id/310730/2 "2022-07-27T12:43:32Z")

</div>

Alert id's are strings generated by alerting rules, and are typically specific to the rule, and often how the rule does grouping. For instance, some rules may provide a service/service name as the alert id.

It seems like in this case, `*` IS the alert id, given the document you provided. Did you generate the document from an index action attached to the alerting rule? Could you provide the body used for that action, I'm curious if something may have happened between the alert being generated and the document being written. If not generated from an index action, how did you get that data?

---

<div class="post-metadata">

**Author:** ![oandreiev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oandreiev/32/106503_2.png) [@oandreiev](https://discuss.elastic.co/u/oandreiev)\
**Post date:** [July 28, 2022, 8:15am UTC](https://discuss.elastic.co/t/alerting-api-where-can-i-find-alert-id/310730/3 "2022-07-28T08:15:09Z")

</div>

Thank you for your feedback, Patrick!

Yes, I figured out that `*` works as id.

But it's really confusing. In an example [here](https://www.elastic.co/guide/en/kibana/current/mute-alert-api.html) UUID string is used.  
Probably it worth to mention this information there.

It seems like the problem is resolved how, thanks!

---

<div class="post-metadata">

**Author:** ![Patrick\_Mueller](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/patrick_mueller/32/109425_2.png) [@Patrick\_Mueller](https://discuss.elastic.co/u/Patrick_Mueller)\
**Post date:** [July 28, 2022, 1:17pm UTC](https://discuss.elastic.co/t/alerting-api-where-can-i-find-alert-id/310730/4 "2022-07-28T13:17:01Z")

</div>

> Probably it worth to mention this information there.

Good point! I'll open an issue to update the docs for the mute/unmute instance in that regard.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 25, 2022, 1:17pm UTC](https://discuss.elastic.co/t/alerting-api-where-can-i-find-alert-id/310730/5 "2022-08-25T13:17:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.