Skip to content

[Rule based auto tagging] Update 'Create workload group rules' #10148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 8, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -29,16 +29,16 @@ POST /_rules/{feature_type}
Use the following endpoint to modify an existing rule by specifying both the feature type and rule ID in the path parameters:

```json
PUT /_rules/{feature_type}/{_id}
POST /_rules/{feature_type}/{_id}
PUT /_rules/{feature_type}/{id}
POST /_rules/{feature_type}/{id}
```

### Get a rule

Use the following endpoint to retrieve either a specific rule by ID or list all rules for a feature type:

```json
GET /_rules/{feature_type}/{_id}
GET /_rules/{feature_type}/{id}
GET /_rules/{feature_type}
```

Expand All @@ -47,17 +47,17 @@ GET /_rules/{feature_type}
Use the following endpoint to remove a rule by specifying both the feature type and rule ID:

```json
DELETE /_rules/{feature_type}/{_id}
DELETE /_rules/{feature_type}/{id}
```

## Path parameters

The following table lists the available path parameters.

| Parameter | Data type | Description |
| :--- | :--- | :--- |
| Parameter | Data type | Description |
|:---------------| :--- | :--- |
| `feature_type` | String | The category of the rule that defines the type of feature, such as `workload_group`. |
| `_id` | String | The unique identifier for the rule. Required for `UPDATE`, `GET`, and `DELETE` operations. |
| `id` | String | The unique identifier for the rule. Required for `UPDATE`, `GET`, and `DELETE` operations. |

## Query parameters

Expand Down Expand Up @@ -119,7 +119,7 @@ You can't change the `feature_type`. Fields that are not updated can be omitted.
The following request retrieves a rule by ID:

```json
GET /_rules/{feature_type}/{_id}
GET /_rules/{feature_type}/{id}
```
{% include copy-curl.html %}

Expand Down Expand Up @@ -157,7 +157,7 @@ The following example continues the search for all rules of the `workload_group`

```json
{
"_id": "wi6VApYBoX5wstmtU_8l",
"id": "wi6VApYBoX5wstmtU_8l",
"description": "description for rule",
"index_pattern": ["log*", "event*"],
"workload_group": "EITBzjFkQ6CA-semNWGtRQ",
Expand All @@ -178,7 +178,7 @@ The following example continues the search for all rules of the `workload_group`
{
"rules": [
{
"_id": "z1MJApUB0zgMcDmz-UQq",
"id": "z1MJApUB0zgMcDmz-UQq",
"description": "Rule for tagging workload_group_id to index123",
"index_pattern": ["index123"],
"workload_group": "workload_group_id",
Expand All @@ -198,11 +198,11 @@ To retrieve the next page, include the `search_after` value in the next `GET` re

## Response body fields

| Field | Data type | Description |
| :--- | :--- | :--- |
| `_id` | String | The unique identifier for the rule. |
| `description` | String | The explanation or purpose of the rule. |
| `updated_at` | String | The timestamp of the most recent update to the rule in UTC format. |
| Field | Data type | Description |
|:------------------| :--- | :--- |
| `id` | String | The unique identifier for the rule. |
| `description` | String | The explanation or purpose of the rule. |
| `updated_at` | String | The timestamp of the most recent update to the rule in UTC format. |
| `<attribute_key>` | Array | The attribute values used to match incoming queries. |
| `<feature_type>` | String | The value assigned to the feature type if the rule matches. |
| `search_after` | Array | The token for paginating additional results. Present only if more results exist. |
| `<feature_type>` | String | The value assigned to the feature type if the rule matches. |
| `search_after` | Array | The token for paginating additional results. Present only if more results exist. |
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ You can retrieve rules created using the Create Workload Group Rules API by rule
The following request retrieves a rule by ID for the `workload_group` feature type:

```json
GET /_rules/workload_group/{_id}
GET /_rules/workload_group/{id}
```
{% include copy-curl.html %}

Expand Down Expand Up @@ -90,6 +90,15 @@ The following request provides the next page of rules from the same workload gro
```
{% include copy-curl.html %}

### Delete a rule

The following request deletes a rule using the rule's ID:

```json
DELETE /_rules/workload_group/{id}
```
{% include copy-curl.html %}

## Example responses

<details open markdown="block">
Expand All @@ -100,7 +109,7 @@ The following request provides the next page of rules from the same workload gro

```json
{
"_id": "wi6VApYBoX5wstmtU_8l",
"id": "wi6VApYBoX5wstmtU_8l",
"description": "description for rule",
"index_pattern": ["log*", "event*"],
"workload_group": "EITBzjFkQ6CA-semNWGtRQ",
Expand All @@ -121,7 +130,7 @@ The following request provides the next page of rules from the same workload gro
{
"rules": [
{
"_id": "z1MJApUB0zgMcDmz-UQq",
"id": "z1MJApUB0zgMcDmz-UQq",
"description": "Rule for tagging workload_group_id to index123",
"index_pattern": ["index123"],
"workload_group": "workload_group_id",
Expand All @@ -137,3 +146,17 @@ If the `search_after` field is present in the response, more results are availab
To retrieve the next page, include the `search_after` value in the next `GET` request as a query parameter, such as `GET /_rules/{feature_type}?search_after=z1MJApUB0zgMcDmz-UQq`.

</details>


<details markdown="block">
<summary>
Response: Delete rules
</summary>
{: .text-delta }

```json
{ "acknowledged": true }
```

</details>

Loading