0

I am learning to use the ELK stack. Both kibana and elasticsearch are installed on my localhost. I just learnt how to install metricbeat and how to set up alerts. When setting up the alerts, I used the index connector, and called my index testconnector.

I see the alerts showing up in my web browser when i go to http://localhost:5601/app/observability/alerts.

Is there a way for me to get the same information via REST API? i tried all these endpoints but they all say "no handler found for uri"

curl -X GET -k -u elasticuser:elasticpass "http://localhost:9200/api/index_management/indices"
curl -X GET -k -u elasticuser:elasticpass "http://localhost:9200/api/alert"
curl -X GET -k -u elasticuser:elasticpass "http://localhost:9200/api/alert/_search"
curl -X GET -k -u elasticuser:elasticpass "http://localhost:9200/api/alert/_find"
curl -X GET -k -u elasticuser:elasticpass "http://localhost:9200/alert/_search"
curl -X GET -k -u elasticuser:elasticpass "http://localhost:9200/alert/_find"
curl -X GET -k -u elasticuser:elasticpass "http://localhost:9200/kibana/api/alerting"
curl -X GET -k -u elasticuser:elasticpass "http://localhost:9200/testconnector/_search"

If anyone can tell me how to get the alerts (not the rules) through a REST API, that will be great!

1 Answer 1

0

I figured it out. First, you can get a list of all the rules from kibana api (as opposed to elastic api) like this:

curl -X GET -k -u elasticuser:elasticpass "http://localhost:5601/api/alerting/rules/_find"

The list of rules also contains some execution status of each rule. Meaning some are active, some are ok, some are recovered etc... So right off the bat, I have what I need related to the alerts associated with each rule.

If I need more details, I can grab the rule id and get more details with this curl

curl -X GET -k -u elasticuser:elasticpass "http://localhost:5601/api/alerting/rule/<rule id>"

All the API endpoints for rule and alert management can be found here: https://www.elastic.co/guide/en/kibana/current/alerting-apis.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.