# Kibana Alerts from API

**URL:** <https://discuss.elastic.co/t/kibana-alerts-from-api/245168>\
**Category:** Kibana\
**Tags:** elastic-stack-alerting\
**Created:** [August 16, 2020, 11:14pm UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168 "2020-08-16T23:14:15Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![PaulMess](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulmess/32/65628_2.png) [@PaulMess](https://discuss.elastic.co/u/PaulMess)\
**Post date:** [August 16, 2020, 11:14pm UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168/1 "2020-08-16T23:14:15Z")

</div>

Can I create an alert using the kibana API?

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [August 16, 2020, 11:34pm UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168/2 "2020-08-16T23:34:57Z")

</div>

What kind of alert are you looking to do?

A watcher could work for you and you can create them via an API.

[https://www.elastic.co/guide/en/elasticsearch/reference/current/watch-cluster-status.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/watch-cluster-status.html)

---

<div class="post-metadata">

**Author:** ![PaulMess](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulmess/32/65628_2.png) [@PaulMess](https://discuss.elastic.co/u/PaulMess)\
**Post date:** [August 17, 2020, 12:54am UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168/3 "2020-08-17T00:54:06Z")

</div>

> [@aaron-nimocks](#):
>
> A watcher could work for you and you can create them via an API.

Yes, In deed.  
but watcher is a Gold (and superior) subscription feature 😉

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [August 17, 2020, 1:29am UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168/4 "2020-08-17T01:29:49Z")

</div>

I went in and created one using the UI and just recorded the API calls.

```auto
POST /api/alert

```

```auto
{"params": {
 "numTimes":5,
 "timerangeUnit":"m",
 "timerangeCount":15
 },
 "consumer":"alerting",
 "alertTypeId":"xpack.uptime.alerts.monitorStatus",
 "schedule": {"interval":"1m"},
 "actions":[],
 "tags":["tags1"],
 "name":"Test Alert"
}

```

So yes, there is an API to create alerts. Now depending on where you want to call this API from is a different question on whether it will work or not and I couldn't find anything to tell you one way or another.

---

<div class="post-metadata">

**Author:** ![PaulMess](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulmess/32/65628_2.png) [@PaulMess](https://discuss.elastic.co/u/PaulMess)\
**Post date:** [August 17, 2020, 8:48pm UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168/5 "2020-08-17T20:48:53Z")

</div>

Sounds great! but, how you do that?

I am trying:

```
curl -s -u myuser:mypass -XPOST "http://mykibanahost:5601/api/alert" \
  -H 'Content-Type: application/json' \
  -H 'kbn-xsrf: true' \
-d'{
 "params": {
 "numTimes":5,
 "timerangeUnit":"m",
 "timerangeCount":15
 },
 "consumer":"alerting",
 "alertTypeId":"xpack.uptime.alerts.monitorStatus",
 "schedule": {"interval":"1m"},
 "actions":[],
 "tags":["tags1"],
 "name":"Test Alert"
}'

```

but I am getting:

```
{"statusCode":400,"error":"Bad Request","message":"params invalid: [timerange.from]: expected value of type [string] but got [undefined]"}
```

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [August 17, 2020, 8:53pm UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168/6 "2020-08-17T20:53:32Z")

</div>

Looks like it wants a timerange.from parameter also. Maybe you are using a different version than I tested.

I am not sure you can even do this. I tested this by just adding a new alert and looked at the network API call in browser tools.

I could not find any documentation that actually let's you do this.

---

<div class="post-metadata">

**Author:** ![PaulMess](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulmess/32/65628_2.png) [@PaulMess](https://discuss.elastic.co/u/PaulMess)\
**Post date:** [August 17, 2020, 8:57pm UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168/7 "2020-08-17T20:57:23Z")

</div>

Oh, sorry I forget mention the version.  
I am using a docker image from [docker.elastic.co/kibana/kibana:7.7.0](http://docker.elastic.co/kibana/kibana:7.7.0)

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [August 17, 2020, 9:02pm UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168/8 "2020-08-17T21:02:24Z")

</div>

In Kibana go to Alerts and Actions. Click Create Alert.

Open the dev tools in your browser. Typically F12.  
Go to the Network tab.

Now fill in your alert you want to create for a test. When you save it you will see a new entry in the developer tool. I think it's called alert. If you click on that you can see the API call that was made to create that alert.

Without official documentation and support of this API I can't really steer you in any other direction.

---

<div class="post-metadata">

**Author:** ![PaulMess](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/paulmess/32/65628_2.png) [@PaulMess](https://discuss.elastic.co/u/PaulMess)\
**Post date:** [August 17, 2020, 11:48pm UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168/9 "2020-08-17T23:48:48Z")

</div>

Thanks Aaron!  
I got it now.

I was able to create a conector

```auto
    curl -s -u myuser:mypass -XPOST "http://mykibanahost:5601/api/action" \
    -H 'Content-Type: application/json' \
    -H 'kbn-xsrf: true' \
    -d'{"actionTypeId":".index","config":{"index":"alerts","executionTimeField":null},"secrets":{},"name":"default"}'

```

and an Alert

```auto
    curl -s -u myuser:mypass -XPOST "http://mykibanahost:5601/api/alert" \
      -H 'Content-Type: application/json' \
      -H 'kbn-xsrf: true' \
    -d'{"params":{"aggType":"count","termSize":5,"thresholdComparator":">","timeWindowSize":5,"timeWindowUnit":"m","groupBy":"all","threshold":[5000],"index":["st
    "consumer":"alerting","alertTypeId":".index-threshold","schedule":{"interval":"5m"},"actions":[{"id":"ed380f8a-cb95-4c0c-971b-32bbc3c93a95","actionTypeId":".i
    [{"alertId":"{{alertId}}","alertName":"{{alertName}}","date":"{{context.date}}","value":"{{context.value}}"}]}}],"tags":[],"name":"alert01","throttle":"10m"}'

```

Rest Regards, Paul

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [August 18, 2020, 12:02am UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168/10 "2020-08-18T00:02:12Z")

</div>

Very nice. Well done! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 15, 2020, 12:02am UTC](https://discuss.elastic.co/t/kibana-alerts-from-api/245168/11 "2020-09-15T00:02:20Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.