Request API to obtain active alerts

Hello everyone,

On the Kibana interface I have a rule called "No logs from docker", this is a "Log threshold" rule which should tell me when I have not received a log containing the "event.dataset" with value "docker.container_logs" for more than an hour. I group by "agent.name" to determine which agent is no longer sending me logs.

The rule works, and when I consult it I can see several agents whose alert is "active" and who do not return logs. For some it's normal and so I "mute" them, for others I have to check why they don't send logs, but it's not the object of my current issue.

I configured the alerts to notify me on a "Slack" connector, it works perfectly.

However, I would like to be able to consult these alerts by an API request.

I have already tried a large number of requests. I can indeed see that the rule has active alerts, but impossible to know which alert precisely is active and what it is the agent concerned.

For example, one of my agents on alert is called: "dromao".
I see it as active in alerts when I click on the rule.
But in the response to my API request, there is never anywhere specified "dromao".

Could you please help me to know how to fetch this via API request?

Thank you so much

Sorry, we do not currently have a supported HTTP endpoint to return data about alerts.

There IS an undocumented, unsupported HTTP endpoint that returns some information about alerts. Pretty much guarantee it will change in the future, and likely has slightly changed release-to-release in previous releases.

So, be prepared for whatever code you are using this with, to break when you upgrade your stack.

GET /internal/alerting/rule/<rule-id>/_alert_summary

1 Like

Wanted to let you know we've started planning to get a public API to list alerts into the product, in a future release. LMK if you want an issue to track, not sure where it is right now ...

1 Like

Thanks, yes, I'm very interested in tracking this feature. This would allow us to automate some tasks in our infrastructure.

Sorry for the delay. The current issue to track this is [ResponseOps] add supported API to return list of alerts · Issue #152345 · elastic/kibana · GitHub

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.