--- title: "Create an SLO" method: POST path: "/s/{spaceId}/api/observability/slos" tags: ["slo"] --- # Create an SLO `POST /s/{spaceId}/api/observability/slos` You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. ## Path parameters - `spaceId` string, required ## Headers - `kbn-xsrf` string, required ## Request body - SLOsCreateSloRequest — The create SLO API request body varies depending on the type of indicator, time window and budgeting method. - `artifacts` SLOsArtifacts — Links to related assets for the SLO - `dashboards` object[] — Array of dashboard references - `id` string, required — Dashboard saved-object id - `budgetingMethod` 'occurrences' | 'timeslices', required — The budgeting method to use when computing the rollup data. - `description` string, required — A description for the SLO. - `groupBy` union — optional group by field or fields to use to generate an SLO per distinct value - string - string[] - `id` string — A optional and unique identifier for the SLO. Must be between 8 and 48 chars - `indicator` union, required - SLOsIndicatorPropertiesCustomKql — Defines properties for a custom query indicator type - `params` object, required — An object containing the indicator parameters. - `dataViewId` string — The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries. - `filter` union — Defines properties for a filter - string — the KQL query to filter the documents with. - object - `filters` SLOsFilter[] - … - `kqlQuery` string - `good` union, required — The KQL query used to define the good events. - string — the KQL query to filter the documents with. - object - `filters` SLOsFilter[] - … - `kqlQuery` string - `index` string, required — The index or index pattern to use - `timestampField` string, required — The timestamp field used in the source indice. - `total` union, required — The KQL query used to define all events. - string — the KQL query to filter the documents with. - object - `filters` SLOsFilter[] - … - `kqlQuery` string - `type` string, required — The type of indicator. - SLOsIndicatorPropertiesApmAvailability — Defines properties for the APM availability indicator type - `params` object, required — An object containing the indicator parameters. - `environment` string, required — The APM service environment or "*" - `filter` string — KQL query used for filtering the data - `index` string, required — The index used by APM metrics - `service` string, required — The APM service name - `transactionName` string, required — The APM transaction name or "*" - `transactionType` string, required — The APM transaction type or "*" - `type` string, required — The type of indicator. - SLOsIndicatorPropertiesApmLatency — Defines properties for the APM latency indicator type - `params` object, required — An object containing the indicator parameters. - `environment` string, required — The APM service environment or "*" - `filter` string — KQL query used for filtering the data - `index` string, required — The index used by APM metrics - `service` string, required — The APM service name - `threshold` number, required — The latency threshold in milliseconds - `transactionName` string, required — The APM transaction name or "*" - `transactionType` string, required — The APM transaction type or "*" - `type` string, required — The type of indicator. - SLOsIndicatorPropertiesCustomMetric — Defines properties for a custom metric indicator type - `params` object, required — An object containing the indicator parameters. - `dataViewId` string — The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries. - `filter` string — the KQL query to filter the documents with. - `good` object, required — An object defining the "good" metrics and equation - `equation` string, required — The equation to calculate the "good" metric. - `metrics` union[], required — List of metrics with their name, aggregation type, and field. - union - … - `index` string, required — The index or index pattern to use - `timestampField` string, required — The timestamp field used in the source indice. - `total` object, required — An object defining the "total" metrics and equation - `equation` string, required — The equation to calculate the "total" metric. - `metrics` union[], required — List of metrics with their name, aggregation type, and field. - union - … - `type` string, required — The type of indicator. - SLOsIndicatorPropertiesHistogram — Defines properties for a histogram indicator type - `params` object, required — An object containing the indicator parameters. - `dataViewId` string — The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries. - `filter` string — the KQL query to filter the documents with. - `good` object, required — An object defining the "good" events - `aggregation` 'value_count' | 'range', required — The type of aggregation to use. - `field` string, required — The field use to aggregate the good events. - `filter` string — The filter for good events. - `from` number — The starting value of the range. Only required for "range" aggregations. - `to` number — The ending value of the range. Only required for "range" aggregations. - `index` string, required — The index or index pattern to use - `timestampField` string, required — The timestamp field used in the source indice. - `total` object, required — An object defining the "total" events - `aggregation` 'value_count' | 'range', required — The type of aggregation to use. - `field` string, required — The field use to aggregate the good events. - `filter` string — The filter for total events. - `from` number — The starting value of the range. Only required for "range" aggregations. - `to` number — The ending value of the range. Only required for "range" aggregations. - `type` string, required — The type of indicator. - SLOsIndicatorPropertiesTimesliceMetric — Defines properties for a timeslice metric indicator type - `params` object, required — An object containing the indicator parameters. - `dataViewId` string — The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries. - `filter` string — the KQL query to filter the documents with. - `index` string, required — The index or index pattern to use - `metric` object, required — An object defining the metrics, equation, and threshold to determine if it's a good slice or not - `comparator` 'GT' | 'GTE' | 'LT' | 'LTE', required — The comparator to use to compare the equation to the threshold. - `equation` string, required — The equation to calculate the metric. - `metrics` union[], required — List of metrics with their name, aggregation type, and field. - union - … - `threshold` number, required — The threshold used to determine if the metric is a good slice or not. - `timestampField` string, required — The timestamp field used in the source indice. - `type` string, required — The type of indicator. - `name` string, required — A name for the SLO. - `objective` SLOsObjective, required — Defines properties for the SLO objective - `target` number, required — the target objective between 0 and 1 excluded - `timesliceTarget` number — the target objective for each slice when using a timeslices budgeting method - `timesliceWindow` string — the duration of each slice when using a timeslices budgeting method, as {duraton}{unit} - `settings` SLOsSettings — Defines properties for SLO settings. - `frequency` string — The interval between checks for changes in the source data. The minimum value is 1m and the maximum is 59m. The default value is 1 minute. - `preventCrossProjectSearch` boolean — Pin the L1 rollup transform to the local/origin project only, preventing flat-world (cross-linked-project) reads. Only applies on serverless. Default is false (flat-world). - `preventInitialBackfill` boolean — Start aggregating data from the time the SLO is created, instead of backfilling data from the beginning of the time window. - `syncDelay` string — The time delay in minutes between the current time and the latest source data time. Increasing the value will delay any alerting. The default value is 1 minute. The minimum value is 1m and the maximum is 359m. It should always be greater then source index refresh interval. - `syncField` string — The date field that is used to identify new documents in the source. It is strongly recommended to use a field that contains the ingest timestamp. If you use a different field, you might need to set the delay such that it accounts for data transmission delays. When unspecified, we use the indicator timestamp field. - `tags` string[] — List of tags - `timeWindow` SLOsTimeWindow, required — Defines properties for the SLO time window - `duration` string, required — the duration formatted as {duration}{unit}. Accepted values for rolling: 7d, 30d, 90d. Accepted values for calendar aligned: 1w (weekly) or 1M (monthly) - `type` 'rolling' | 'calendarAligned', required — Indicates weither the time window is a rolling or a calendar aligned time window. ## Response `200` Successful request - SLOsCreateSloResponse - `id` string, required ## Other responses - `400` — Bad request - `401` — Unauthorized response - `403` — Forbidden response - `409` — Conflict - The SLO id already exists --- [API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)