API and or Query to Poll for latest Alerts

Elastic Stack Kibana
1

Have a customer with a mature Elastic/Kibana environment with a large number of alerts defined. As such I am not wanting them to have to add additional actions/make changes to these alerts with regards to my request below.

I am looking to poll the environment via API/Query etc... to retrieve any new (active) alerts that have been created since the last poll cycle. Can someone point me at the relevant docs on this/article perhaps/or an example query that could accomplish this please.

Would be much appreciated.

2

There is a "history" of alerting activity available in a set of indices we refer to as the "event log". For more info on it, see: kibana/x-pack/plugins/event_log at master · elastic/kibana · GitHub

Note that by default these indices are NOT accessible to normal users. The reason is that we store the history of ALL of the alerting activity there, and don't have a great way of preventing access to alerts that users SHOULD NOT have access to. Any user given read/query privileges to these indices will be able to see some info about ALL of the alerts across the entire cluster.

The link ^^^ will hopefully provide enough information about how you can query to see alert activity over time over the entire cluster. Ping back here if you need more info, or have suggestions for improving this - we are actively working on making this kind of data more accessible to all users in a secure fashion.

3

This would be an internal system to system integration/polling via the RESTful API with creds kept securely in a vault, so that should negate the security concerns you highlighted Patrick if allowing end users access to this.

Thanks for the info, you have definitely helped answer my question.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.