Kibana Connectors

# Connectors and Actions in Rules: Design Reference

## Action Structure

Each action in a rule references a connector and has its own `frequency` configuration:

```json
{
  "id": "<connector-id>",
  "group": "query matched",
  "params": { "message": "{{rule.name}} fired: {{context.reason}}" },
  "frequency": {
    "summary": false,
    "notify_when": "onActionGroupChange",
    "throttle": null
  }
}
```

- `group`: The action group (e.g., `"query matched"`, `"threshold met"`, `"Recovered"`). Each rule type defines its
  valid groups. Discover them via `GET /api/alerting/rule_types`.
- `frequency.summary`: `true` for a summary of all alerts; `false` to run per-alert.
- `frequency.notify_when`: `onActionGroupChange` | `onActiveAlert` | `onThrottleInterval`.
- `frequency.throttle`: Minimum interval between repeated notifications (e.g., `"10m"`). Only applies when `notify_when`
  is `onThrottleInterval`.

> **Deprecated:** Do not set `notify_when` or `throttle` at the rule level. These are deprecated in favour of per-action
> `frequency` objects and will be auto-converted if the rule is edited in the Kibana UI.

## Action Variables (Mustache Templates)

Action `params` use [Mustache](https://mustache.github.io/mustache.5.html) syntax to inject rule and alert values at
runtime.

### Common variables (all rule types)

| Variable            | Description                                                   |
| ------------------- | ------------------------------------------------------------- |
| `{{rule.id}}`       | Rule identifier                                               |
| `{{rule.name}}`     | Rule name                                                     |
| `{{rule.tags}}`     | Rule tags                                                     |
| `{{rule.url}}`      | Deep link to rule in Kibana (requires `server.publicBaseUrl`) |
| `{{date}}`          | ISO timestamp when the action was scheduled                   |
| `{{kibanaBaseUrl}}` | Kibana base URL                                               |

### Per-alert variables (`summary: false`)

| Variable                       | Description                                                                  |
| ------------------------------ | ---------------------------------------------------------------------------- |
| `{{alert.id}}`                 | Alert instance ID (e.g., the grouped value like a host name)                 |
| `{{alert.uuid}}`               | Stable UUID for the alert lifecycle                                          |
| `{{alert.actionGroup}}`        | Action group that triggered the action                                       |
| `{{alert.flapping}}`           | Whether the alert is flapping                                                |
| `{{alert.consecutiveMatches}}` | Number of consecutive rule runs that matched                                 |
| `{{context.*}}`                | Rule-type-specific context (e.g., `{{context.reason}}`, `{{context.value}}`) |

### Summary variables (`summary: true`)

| Variable                     | Description                |
| ---------------------------- | -------------------------- |
| `{{alerts.new.count}}`       | Count of new alerts        |
| `{{alerts.ongoing.count}}`   | Count of ongoing alerts    |
| `{{alerts.recovered.count}}` | Count of recovered alerts  |
| `{{alerts.all.count}}`       | Total count                |
| `{{alerts.new.data}}`        | Array of new alert objects |

### Iterating over arrays

For rule types that return multiple hits (e.g., ES Query rules):

```mustache
{{#context.hits}} - {{_source.message}} ({{_source.@timestamp}})
{{/context.hits}}
```

### Debugging templates

Use `{{{.}}}` in any action body to dump the entire variable context as a JSON object. Remove before enabling the rule
in production.

## Mustache Lambdas

Kibana provides built-in lambdas for advanced template rendering:

```mustache
# Round a numeric value
{{#EvalMath}} round(context.value, 2) {{/EvalMath