Get the SLO definitions

GET /s/{spaceId}/internal/observability/slos/_definitions

You must have the read privileges for the SLOs feature in the Observability section of the Kibana feature privileges.

Headers

kbn-xsrf string Required

Cross-site request forgery protection

Path parameters

spaceId string Required

An identifier for the space. If /s/ and the identifier are omitted from the path, the default space is used.

Query parameters

includeOutdatedOnly boolean

Indicates if the API returns only outdated SLO or all SLO definitions
tags string

Filters the SLOs by tag
search string

Filters the SLOs by name
page number

The page to use for pagination, must be greater or equal than 1
perPage integer

Number of SLOs returned by page

Maximum value is 1000. Default value is 100.

Responses

200 application/json

Successful request
A paginated response of SLO definitions matching the query.
One of:
object-1 object object-2 object
Hide attributes Show attributes

page number

perPage number

results array[object]

Hide results attributes Show results attributes object

budgetingMethod string Required

The budgeting method to use when computing the rollup data.

Values are occurrences or timeslices.

createdAt string Required

The creation date

description string Required

The description of the SLO.

enabled boolean Required

Indicate if the SLO is enabled

groupBy string | array[string] Required

optional group by field or fields to use to generate an SLO per distinct value

One of:
string-1 string array-2 array[string]

id string Required

The identifier of the SLO.

indicator object Required

One of:
SLOs_indicator_properties_custom_kql object SLOs_indicator_properties_apm_availability object SLOs_indicator_properties_apm_latency object SLOs_indicator_properties_custom_metric object SLOs_indicator_properties_histogram object SLOs_indicator_properties_timeslice_metric object

Defines properties for a custom query indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

dataViewId string

The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.

filter string | object

Defines properties for a filter

One of:
string-1 string object-2 object

the KQL query to filter the documents with.

Hide attributes Show attributes

filters array[object]

Defines properties for a filter

Hide filters attributes Show filters attributes object

meta object

Defines properties for a filter

Hide meta attributes Show meta attributes object

alias string | null

controlledBy string

disabled boolean

field string

group string

index string

isMultiIndex boolean

key string

negate boolean

params object

type string

value string

query object

kqlQuery string

good string | object Required

The KQL query used to define the good events.

One of:
string-1 string object-2 object

the KQL query to filter the documents with.

Hide attributes Show attributes

filters array[object]

Defines properties for a filter

Hide filters attributes Show filters attributes object

meta object

Defines properties for a filter

Hide meta attributes Show meta attributes object

alias string | null

controlledBy string

disabled boolean

field string

group string

index string

isMultiIndex boolean

key string

negate boolean

params object

type string

value string

query object

kqlQuery string

index string Required

The index or index pattern to use

timestampField string Required

The timestamp field used in the source indice.

total string | object Required

The KQL query used to define all events.

One of:
string-1 string object-2 object

the KQL query to filter the documents with.

Hide attributes Show attributes

filters array[object]

Defines properties for a filter

Hide filters attributes Show filters attributes object

meta object

Defines properties for a filter

Hide meta attributes Show meta attributes object

alias string | null

controlledBy string

disabled boolean

field string

group string

index string

isMultiIndex boolean

key string

negate boolean

params object

type string

value string

query object

kqlQuery string

type string Required Discriminator

The type of indicator.

Value is sli.kql.custom.

Defines properties for the APM availability indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

environment string Required

The APM service environment or "*"

filter string

KQL query used for filtering the data

index string Required

The index used by APM metrics

service string Required

The APM service name

transactionName string Required

The APM transaction name or "*"

transactionType string Required

The APM transaction type or "*"

type string Required Discriminator

The type of indicator.

Value is sli.apm.transactionErrorRate.

Defines properties for the APM latency indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

environment string Required

The APM service environment or "*"

filter string

KQL query used for filtering the data

index string Required

The index used by APM metrics

service string Required

The APM service name

threshold number Required

The latency threshold in milliseconds

transactionName string Required

The APM transaction name or "*"

transactionType string Required

The APM transaction type or "*"

type string Required Discriminator

The type of indicator.

Value is sli.apm.transactionDuration.

Defines properties for a custom metric indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

dataViewId string

The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.

filter string

the KQL query to filter the documents with.

good object Required

An object defining the "good" metrics and equation

Hide good attributes Show good attributes object

equation string Required

The equation to calculate the "good" metric.

metrics array[object] Required

List of metrics with their name, aggregation type, and field.

One of:
object-1 object object-2 object

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric.

Value is sum.

field string Required

The field of the metric.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric.

Value is doc_count.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

index string Required

The index or index pattern to use

timestampField string Required

The timestamp field used in the source indice.

total object Required

An object defining the "total" metrics and equation

Hide total attributes Show total attributes object

equation string Required

The equation to calculate the "total" metric.

metrics array[object] Required

List of metrics with their name, aggregation type, and field.

One of:
object-1 object object-2 object

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric.

Value is sum.

field string Required

The field of the metric.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric.

Value is doc_count.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

type string Required Discriminator

The type of indicator.

Value is sli.metric.custom.

Defines properties for a histogram indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

dataViewId string

The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.

filter string

the KQL query to filter the documents with.

good object Required

An object defining the "good" events

Hide good attributes Show good attributes object

aggregation string Required

The type of aggregation to use.

Values are value_count or range.

field string Required

The field use to aggregate the good events.

filter string

The filter for good events.

from number

The starting value of the range. Only required for "range" aggregations.

to number

The ending value of the range. Only required for "range" aggregations.

index string Required

The index or index pattern to use

timestampField string Required

The timestamp field used in the source indice.

total object Required

An object defining the "total" events

Hide total attributes Show total attributes object

aggregation string Required

The type of aggregation to use.

Values are value_count or range.

field string Required

The field use to aggregate the good events.

filter string

The filter for total events.

from number

The starting value of the range. Only required for "range" aggregations.

to number

The ending value of the range. Only required for "range" aggregations.

type string Required Discriminator

The type of indicator.

Value is sli.histogram.custom.

Defines properties for a timeslice metric indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

dataViewId string

The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.

filter string

the KQL query to filter the documents with.

index string Required

The index or index pattern to use

metric object Required

An object defining the metrics, equation, and threshold to determine if it's a good slice or not

Hide metric attributes Show metric attributes object

comparator string Required

The comparator to use to compare the equation to the threshold.

Values are GT, GTE, LT, or LTE.

equation string Required

The equation to calculate the metric.

metrics array[object] Required

List of metrics with their name, aggregation type, and field.

Any of:
SLOs_timeslice_metric_basic_metric_with_field object SLOs_timeslice_metric_percentile_metric object SLOs_timeslice_metric_doc_count_metric object

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric.

Values are sum, avg, min, max, std_deviation, last_value, or cardinality.

field string Required

The field of the metric.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric. Only valid option is "percentile"

Value is percentile.

field string Required

The field of the metric.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

percentile number Required

The percentile value.

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric. Only valid option is "doc_count"

Value is doc_count.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

threshold number Required

The threshold used to determine if the metric is a good slice or not.

timestampField string Required

The timestamp field used in the source indice.

type string Required Discriminator

The type of indicator.

Value is sli.metric.timeslice.

instanceId string Required

the value derived from the groupBy field, if present, otherwise '*'

name string Required

The name of the SLO.

objective object Required

Defines properties for the SLO objective

Hide objective attributes Show objective attributes object

target number Required

the target objective between 0 and 1 excluded

Minimum value is 0, maximum value is 100.

timesliceTarget number

the target objective for each slice when using a timeslices budgeting method

Minimum value is 0, maximum value is 100.

timesliceWindow string

the duration of each slice when using a timeslices budgeting method, as {duraton}{unit}

revision number Required

The SLO revision

settings object Required

Defines properties for SLO settings.

Hide settings attributes Show settings attributes object

frequency string

The interval between checks for changes in the source data. The minimum value is 1m and the maximum is 59m. The default value is 1 minute.

Default value is 1m.

preventInitialBackfill boolean

Start aggregating data from the time the SLO is created, instead of backfilling data from the beginning of the time window.

Default value is false.

syncDelay string

The time delay in minutes between the current time and the latest source data time. Increasing the value will delay any alerting. The default value is 1 minute. The minimum value is 1m and the maximum is 359m. It should always be greater then source index refresh interval.

Default value is 1m.

syncField string

The date field that is used to identify new documents in the source. It is strongly recommended to use a field that contains the ingest timestamp. If you use a different field, you might need to set the delay such that it accounts for data transmission delays. When unspecified, we use the indicator timestamp field.

summary object Required

The SLO computed data

Hide summary attributes Show summary attributes object

errorBudget object Required

Hide errorBudget attributes Show errorBudget attributes object

consumed number Required

The error budget consummed, as a percentage of the initial value.

initial number Required

The initial error budget, as 1 - objective

isEstimated boolean Required

Only for SLO defined with occurrences budgeting method and calendar aligned time window.

remaining number Required

The error budget remaining, as a percentage of the initial value.

sliValue number Required

status string Required

Values are NO_DATA, HEALTHY, DEGRADING, or VIOLATED.

tags array[string] Required

List of tags

timeWindow object Required

Defines properties for the SLO time window

Hide timeWindow attributes Show timeWindow attributes object

duration string Required

the duration formatted as {duration}{unit}. Accepted values for rolling: 7d, 30d, 90d. Accepted values for calendar aligned: 1w (weekly) or 1M (monthly)

type string Required

Indicates weither the time window is a rolling or a calendar aligned time window.

Values are rolling or calendarAligned.

updatedAt string Required

The last update date

version number Required

The internal SLO version

total number
Hide attributes Show attributes

page number

for backward compability

Default value is 1.

perPage number

for backward compability

results array[object]

Hide results attributes Show results attributes object

budgetingMethod string Required

The budgeting method to use when computing the rollup data.

Values are occurrences or timeslices.

createdAt string Required

The creation date

description string Required

The description of the SLO.

enabled boolean Required

Indicate if the SLO is enabled

groupBy string | array[string] Required

optional group by field or fields to use to generate an SLO per distinct value

One of:
string-1 string array-2 array[string]

id string Required

The identifier of the SLO.

indicator object Required

One of:
SLOs_indicator_properties_custom_kql object SLOs_indicator_properties_apm_availability object SLOs_indicator_properties_apm_latency object SLOs_indicator_properties_custom_metric object SLOs_indicator_properties_histogram object SLOs_indicator_properties_timeslice_metric object

Defines properties for a custom query indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

dataViewId string

The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.

filter string | object

Defines properties for a filter

One of:
string-1 string object-2 object

the KQL query to filter the documents with.

Hide attributes Show attributes

filters array[object]

Defines properties for a filter

Hide filters attributes Show filters attributes object

meta object

Defines properties for a filter

Hide meta attributes Show meta attributes object

alias string | null

controlledBy string

disabled boolean

field string

group string

index string

isMultiIndex boolean

key string

negate boolean

params object

type string

value string

query object

kqlQuery string

good string | object Required

The KQL query used to define the good events.

One of:
string-1 string object-2 object

the KQL query to filter the documents with.

Hide attributes Show attributes

filters array[object]

Defines properties for a filter

Hide filters attributes Show filters attributes object

meta object

Defines properties for a filter

Hide meta attributes Show meta attributes object

alias string | null

controlledBy string

disabled boolean

field string

group string

index string

isMultiIndex boolean

key string

negate boolean

params object

type string

value string

query object

kqlQuery string

index string Required

The index or index pattern to use

timestampField string Required

The timestamp field used in the source indice.

total string | object Required

The KQL query used to define all events.

One of:
string-1 string object-2 object

the KQL query to filter the documents with.

Hide attributes Show attributes

filters array[object]

Defines properties for a filter

Hide filters attributes Show filters attributes object

meta object

Defines properties for a filter

Hide meta attributes Show meta attributes object

alias string | null

controlledBy string

disabled boolean

field string

group string

index string

isMultiIndex boolean

key string

negate boolean

params object

type string

value string

query object

kqlQuery string

type string Required Discriminator

The type of indicator.

Value is sli.kql.custom.

Defines properties for the APM availability indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

environment string Required

The APM service environment or "*"

filter string

KQL query used for filtering the data

index string Required

The index used by APM metrics

service string Required

The APM service name

transactionName string Required

The APM transaction name or "*"

transactionType string Required

The APM transaction type or "*"

type string Required Discriminator

The type of indicator.

Value is sli.apm.transactionErrorRate.

Defines properties for the APM latency indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

environment string Required

The APM service environment or "*"

filter string

KQL query used for filtering the data

index string Required

The index used by APM metrics

service string Required

The APM service name

threshold number Required

The latency threshold in milliseconds

transactionName string Required

The APM transaction name or "*"

transactionType string Required

The APM transaction type or "*"

type string Required Discriminator

The type of indicator.

Value is sli.apm.transactionDuration.

Defines properties for a custom metric indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

dataViewId string

The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.

filter string

the KQL query to filter the documents with.

good object Required

An object defining the "good" metrics and equation

Hide good attributes Show good attributes object

equation string Required

The equation to calculate the "good" metric.

metrics array[object] Required

List of metrics with their name, aggregation type, and field.

One of:
object-1 object object-2 object

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric.

Value is sum.

field string Required

The field of the metric.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric.

Value is doc_count.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

index string Required

The index or index pattern to use

timestampField string Required

The timestamp field used in the source indice.

total object Required

An object defining the "total" metrics and equation

Hide total attributes Show total attributes object

equation string Required

The equation to calculate the "total" metric.

metrics array[object] Required

List of metrics with their name, aggregation type, and field.

One of:
object-1 object object-2 object

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric.

Value is sum.

field string Required

The field of the metric.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric.

Value is doc_count.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

type string Required Discriminator

The type of indicator.

Value is sli.metric.custom.

Defines properties for a histogram indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

dataViewId string

The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.

filter string

the KQL query to filter the documents with.

good object Required

An object defining the "good" events

Hide good attributes Show good attributes object

aggregation string Required

The type of aggregation to use.

Values are value_count or range.

field string Required

The field use to aggregate the good events.

filter string

The filter for good events.

from number

The starting value of the range. Only required for "range" aggregations.

to number

The ending value of the range. Only required for "range" aggregations.

index string Required

The index or index pattern to use

timestampField string Required

The timestamp field used in the source indice.

total object Required

An object defining the "total" events

Hide total attributes Show total attributes object

aggregation string Required

The type of aggregation to use.

Values are value_count or range.

field string Required

The field use to aggregate the good events.

filter string

The filter for total events.

from number

The starting value of the range. Only required for "range" aggregations.

to number

The ending value of the range. Only required for "range" aggregations.

type string Required Discriminator

The type of indicator.

Value is sli.histogram.custom.

Defines properties for a timeslice metric indicator type

Hide attributes Show attributes

params object Required

An object containing the indicator parameters.

Hide params attributes Show params attributes object

dataViewId string

The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.

filter string

the KQL query to filter the documents with.

index string Required

The index or index pattern to use

metric object Required

An object defining the metrics, equation, and threshold to determine if it's a good slice or not

Hide metric attributes Show metric attributes object

comparator string Required

The comparator to use to compare the equation to the threshold.

Values are GT, GTE, LT, or LTE.

equation string Required

The equation to calculate the metric.

metrics array[object] Required

List of metrics with their name, aggregation type, and field.

Any of:
SLOs_timeslice_metric_basic_metric_with_field object SLOs_timeslice_metric_percentile_metric object SLOs_timeslice_metric_doc_count_metric object

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric.

Values are sum, avg, min, max, std_deviation, last_value, or cardinality.

field string Required

The field of the metric.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric. Only valid option is "percentile"

Value is percentile.

field string Required

The field of the metric.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

percentile number Required

The percentile value.

Hide attributes Show attributes

aggregation string Required

The aggregation type of the metric. Only valid option is "doc_count"

Value is doc_count.

filter string

The filter to apply to the metric.

name string Required

The name of the metric. Only valid options are A-Z

Format should match the following pattern: ^[A-Z]$.

threshold number Required

The threshold used to determine if the metric is a good slice or not.

timestampField string Required

The timestamp field used in the source indice.

type string Required Discriminator

The type of indicator.

Value is sli.metric.timeslice.

instanceId string Required

the value derived from the groupBy field, if present, otherwise '*'

name string Required

The name of the SLO.

objective object Required

Defines properties for the SLO objective

Hide objective attributes Show objective attributes object

target number Required

the target objective between 0 and 1 excluded

Minimum value is 0, maximum value is 100.

timesliceTarget number

the target objective for each slice when using a timeslices budgeting method

Minimum value is 0, maximum value is 100.

timesliceWindow string

the duration of each slice when using a timeslices budgeting method, as {duraton}{unit}

revision number Required

The SLO revision

settings object Required

Defines properties for SLO settings.

Hide settings attributes Show settings attributes object

frequency string

The interval between checks for changes in the source data. The minimum value is 1m and the maximum is 59m. The default value is 1 minute.

Default value is 1m.

preventInitialBackfill boolean

Start aggregating data from the time the SLO is created, instead of backfilling data from the beginning of the time window.

Default value is false.

syncDelay string

The time delay in minutes between the current time and the latest source data time. Increasing the value will delay any alerting. The default value is 1 minute. The minimum value is 1m and the maximum is 359m. It should always be greater then source index refresh interval.

Default value is 1m.

syncField string

The date field that is used to identify new documents in the source. It is strongly recommended to use a field that contains the ingest timestamp. If you use a different field, you might need to set the delay such that it accounts for data transmission delays. When unspecified, we use the indicator timestamp field.

summary object Required

The SLO computed data

Hide summary attributes Show summary attributes object

errorBudget object Required

Hide errorBudget attributes Show errorBudget attributes object

consumed number Required

The error budget consummed, as a percentage of the initial value.

initial number Required

The initial error budget, as 1 - objective

isEstimated boolean Required

Only for SLO defined with occurrences budgeting method and calendar aligned time window.

remaining number Required

The error budget remaining, as a percentage of the initial value.

sliValue number Required

status string Required

Values are NO_DATA, HEALTHY, DEGRADING, or VIOLATED.

tags array[string] Required

List of tags

timeWindow object Required

Defines properties for the SLO time window

Hide timeWindow attributes Show timeWindow attributes object

duration string Required

the duration formatted as {duration}{unit}. Accepted values for rolling: 7d, 30d, 90d. Accepted values for calendar aligned: 1w (weekly) or 1M (monthly)

type string Required

Indicates weither the time window is a rolling or a calendar aligned time window.

Values are rolling or calendarAligned.

updatedAt string Required

The last update date

version number Required

The internal SLO version

searchAfter array[string]

the cursor to provide to get the next paged results

size number

total number
400 application/json

Bad request
Hide response attributes Show response attributes object
- error string Required
- message string Required
- statusCode number Required
401 application/json

Unauthorized response
Hide response attributes Show response attributes object
- error string Required
- message string Required
- statusCode number Required
403 application/json

Unauthorized response
Hide response attributes Show response attributes object
- error string Required
- message string Required
- statusCode number Required

GET /s/{spaceId}/internal/observability/slos/_definitions

curl \
 --request GET 'http://localhost:5601/s/default/internal/observability/slos/_definitions' \
 --header "Authorization: $API_KEY" \
 --header "kbn-xsrf: string"