Kibana Alerting Rules

This handles Kibana alerting rules through both REST API and Terraform, covering the full lifecycle from creation to muting and snoozing. You get the complete API reference with endpoints for every operation, plus working examples for common rule types like Elasticsearch queries with thresholds and actions. The Terraform provider integration is included but the source cuts off mid-example. Authentication requires API keys or Basic auth, and you'll need appropriate Kibana feature privileges plus read access to Actions and Connectors. Honestly most valuable if you're building rules-as-code workflows or need programmatic control over alert management at scale rather than clicking through the Kibana UI.

skills.sh installs: 4.3K
GitHub stars: 604
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add elastic/agent-skills --skill kibana-alerting-rules --agent claude-code

Installs into .claude/skills of the current project.

Files

Kibana Alerting Rules

Create, inspect, update, and manage Kibana alerting rules: choose the right rule type, encode threshold and grouping semantics, attach actions only when requested, and list or filter rules read-only when the user asks to discover existing coverage.

Environment Configuration

This skill executes Elasticsearch operations through the elastic CLI. If the elastic CLI is not installed, tell the user what it is needed for. Do not guess credentials, call the HTTP API directly, or attempt other workarounds.

This skill references operations in HTTP-shorthand form (e.g., GET /, GET /_cat/indices, GET /{index}/_mapping, GET /{index}/_settings/index.mode, POST /_query). The Operations table at the end of this document maps each shorthand to the equivalent elastic CLI command — always use the CLI rather than calling the HTTP API directly.