The AggregateAlert datatype for the configuration of an aggregate alert.

This datatype is used by the datatype is used by seven mutation fields: createAggregateAlert(); updateAggregateAlert(); disableAggregateAlertV2(); enableAggregateAlertV2(); addAggregateAlertLabels(); clearErrorOnAggregateAlert(); and removeAggregateAlertLabels();

Table: AggregateAlert

ParameterTypeRequiredDefaultStabilityAvailabilityDescription
actionsActionyes Long-Term List of actions to fire on query result. See Action.
allowedActionsAssetActionyes Short-Term List of actions allowed to fire on query result. See AssetAction .
createdInfoAssetCommitMetadata  Long-Term Metadata related to the creation of the aggregate alert. See AssetCommitMetadata.
descriptionString  Long-Term Description of the aggregate alert.
enabledBooleanyes Long-Term Flag indicating whether the aggregate alert is enabled.
idStringyes Long-Term Unique identifier of of the aggregate alert.
labelsStringyes Long-Term Labels attached to the aggregate alert.
lastErrorString  Long-Term Last error encountered while running the aggregate alert.
lastSuccessfulPollLong  Long-Term Unix timestamp for last successful poll of the aggregate alert query. If this isn't very recent, the alert might have problems.
lastTriggeredLong  Long-Term Unix timestamp for last execution of trigger.
lastWarningsStringyes Long-Term Last warnings encountered while running the aggregate alert.
modifiedInfoModifiedInfoyes Long-Term User or token used to modify the asset. See ModifiedInfo.
nameStringyes Long-Term Name of the aggregate alert.
packagePackageInstallation  Long-Term The package of which the aggregate alert was installed. See PackageInstallation.
packageIdVersionedPackageSpecifier  Long-Term The unique identifier of the package of the aggregate alert template. VersionedPackageSpecifier is a scalar.
queryOwnershipQueryOwnershipyes Long-Term Ownership of the query run by this alert. See QueryOwnership.
queryStringStringyes Long-Term LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-Term Timestamp type to use for a query. See QueryTimestampType and the FAQ: How to handle ingest delays in aggregate alerts and scheduled searches KB article.
resourceStringyes Short-Term The resource identifier for the aggregate alert.
searchIntervalSecondsLongyes Long-Term Search interval in seconds.
throttleFieldString  Deprecateddeprecated in 1.282The field on which to throttle. This can be set only if throttleTimeSeconds is set. Aggregate alerts now support multiple throttle fields. This field will be removed at the earliest in version 1.279. Use instead the throttleFields field.
throttleFieldsStringyes Long-Term The fields on which to throttle. This can be set only if throttleTimeSeconds is set.
throttleTimeSecondsLongyes Long-Term Throttle time in seconds.
triggerModeTriggerModeyes Long-Term Trigger mode used for triggering the alert. See TriggerMode and the FAQ: How to handle ingest delays in aggregate alerts and scheduled searches KB article.
yamlTemplateYAMLyes Long-Term The yaml specification of the aggregate alert. YAML is a scalar.