API reference

The Alerting plugin exposes a REST API under the /_plugins/_alerting/ base path. This page summarizes the available endpoints. For full request/response schemas, see the OpenSearch Alerting API documentation.

Sections

• Monitors
• Workflows
• Alerts
• Findings
• Comments
• Destinations (legacy)
• Statistics and remote indices
• Examples

Endpoint summary

Monitors

Workflows

There is no separate workflow search endpoint. Workflows are returned by /_plugins/_alerting/monitors/_search.

Alerts

Findings

Only stored findings are returned, and findings are stored only when plugins.alerting.alert_finding_enabled is true (off by default). See Configuration.

Comments

Comments are disabled by default: every comments endpoint returns 403 Forbidden until plugins.alerting.comments_enabled is set to true. See Configuration.

Destinations (legacy)

Note: Destination management has been migrated to the Notifications plugin. Use the Notifications API (/_plugins/_notifications/) for creating and managing notification channels.

Statistics and remote indices

Examples

Create a query-level monitor

This example creates a monitor that checks every 5 minutes whether the number of error-level events (log.level is error) in the last hour exceeds 100:

curl -sk -u admin:$WAZUH_INDEXER_ADMIN_PASSWORD -X POST \
  "https://127.0.0.1:9200/_plugins/_alerting/monitors" \
  -H 'Content-Type: application/json' \
  -d '{
    "type": "monitor",
    "name": "High error rate",
    "monitor_type": "query_level_monitor",
    "enabled": true,
    "schedule": {
      "period": {
        "interval": 5,
        "unit": "MINUTES"
      }
    },
    "inputs": [
      {
        "search": {
          "indices": ["wazuh-events-v5-*"],
          "query": {
            "size": 0,
            "query": {
              "bool": {
                "filter": [
                  { "range": { "@timestamp": { "gte": "now-1h" } } },
                  { "term": { "log.level": "error" } }
                ]
              }
            },
            "aggs": {
              "error_count": {
                "value_count": { "field": "@timestamp" }
              }
            }
          }
        }
      }
    ],
    "triggers": [
      {
        "query_level_trigger": {
          "name": "Error threshold exceeded",
          "severity": "1",
          "condition": {
            "script": {
              "source": "ctx.results[0].aggregations.error_count.value > 100",
              "lang": "painless"
            }
          },
          "actions": []
        }
      }
    ]
  }'

To test a monitor definition without saving it, send the same request body to POST /_plugins/_alerting/monitors/_execute?dryrun=true. The response shows the query results and whether each trigger fired.

Acknowledge alerts

curl -sk -u admin:$WAZUH_INDEXER_ADMIN_PASSWORD -X POST \
  "https://127.0.0.1:9200/_plugins/_alerting/monitors/{monitorId}/_acknowledge/alerts" \
  -H 'Content-Type: application/json' \
  -d '{
    "alerts": ["alert-id-1", "alert-id-2"]
  }'

Execute a monitor on-demand

curl -sk -u admin:$WAZUH_INDEXER_ADMIN_PASSWORD -X POST \
  "https://127.0.0.1:9200/_plugins/_alerting/monitors/{monitorId}/_execute"