Sign in
latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-217311,8115.6 MB

34c3066fc261

alerting-v2

Delete rules matching a query (dry-run by default)

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_delete_by_query</span></div>

Refer to Spaces for more information.

[Required authorization] Route required privileges: manage_alerting-v2-rules.

post/api/alerting/v2/rules/_delete_by_query

Headers

kbn-xsrfstring required
Example:true

A required header to protect against CSRF attacks

Request body

filterstring

KQL filter string to match target resources. At most 10000 matching resources are processed per request. Cannot be empty; to target every resource use match_all: true.

forceboolean

When true, executes the operation. When false (default), returns a dry-run preview with match_count and a sample of matching resource IDs so the client can verify before committing.

match_alltrue

When true, targets every resource. Requires an explicit opt-in. Omitted by default.

searchstring

Free-text search string matched against the resource-defined searchable fields. Cannot be empty; to target every resource use match_all: true.

Response

Returns a dry-run preview by default, or the executed operation when force is true.

OR