---
title: "Get matcher data fields suggestions"
method: GET
path: "/api/alerting/v2/suggestions/rule_event_fields"
tags: ["alerting-v2"]
---

# Get matcher data fields suggestions

`GET /api/alerting/v2/suggestions/rule_event_fields`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/suggestions/rule_event_fields</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Get suggestions for matcher data fields.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-alerts.

## Query parameters

- `matcher` string

## Response `200`

Returns the available matcher data field names.

- string[] — The list of available matcher data field names.

## Other responses

- `400` — Indicates an invalid schema or parameters.
- `401` — Indicates the request was not authenticated.
- `403` — Indicates the user does not have the required privileges to perform the request.
- `500` — Indicates an unexpected server-side error.
- `503` — Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/revisions/cb1b8cff3a4d/schema)