diff --git a/docs/api/alerts/find.asciidoc b/docs/api/alerts/find.asciidoc index ebd1c7841206c..5af01efbc7787 100644 --- a/docs/api/alerts/find.asciidoc +++ b/docs/api/alerts/find.asciidoc @@ -6,6 +6,9 @@ Retrieve a paginated set of alerts based on condition. +NOTE: As alerts change in {kib}, the results on each page of the response also +change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data. + [[alerts-api-find-request]] ==== Request @@ -14,6 +17,8 @@ Retrieve a paginated set of alerts based on condition. [[alerts-api-find-query-params]] ==== Query Parameters +NOTE: Alert `params` are stored as a {ref}/flattened.html[flattened field type] and analyzed as keywords. + `per_page`:: (Optional, number) The number of alerts to return per page. @@ -46,11 +51,6 @@ Retrieve a paginated set of alerts based on condition. It should look like savedObjectType.attributes.title: "myTitle". However, If you used a direct attribute of a saved object, such as `updatedAt`, you will have to define your filter, for example, savedObjectType.updatedAt > 2018-12-22. -NOTE: As alerts change in {kib}, the results on each page of the response also -change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data. - -NOTE: Alert `params` are stored as {ref}/flattened.html[flattened] and analyzed as `keyword`. - [[alerts-api-find-request-codes]] ==== Response code