UpdateAlert is used to input data to update an alert.

Table: UpdateAlert

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Mar 28, 2025
actions[string]yes Long-TermList of unique identifiers for actions to fire on query result.
descriptionstring  Long-TermA description of the alert.
enabledbooleanyes Long-TermA flag indicating whether the alert is enabled.
idstringyes Long-TermThe unique identifier of the alert.
labels[string]yes Long-TermLabels attached to the alert.
namestringyes Long-TermThe name of the alert.
queryOwnershipTypeQueryOwnershipTypeyesUserLong-TermThe ownership of the query run by this alert. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStartstringyes Long-TermThe start of the relative time interval for the query.
queryStringstringyes Long-TermThe LogScale query to execute.
runAsUserIdstring  Long-TermThe alert will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the alert will run with the permissions of the calling user. It requires the ChangeTriggersToRunAsOtherUsers permission to set this field to a user identifier different from the calling user.
throttleFieldstring  Long-TermThe field on which to throttle.
throttleTimeMillislongyes Long-TermThrottle time in milliseconds.
viewNamestringyes Long-TermThe name of the view of the alert.