Search Unified Alert Events

POST /v2/unified-alerts/events/search

Search for events related to unified alerts.

Notice: There is a limit of 10,000 results per source type (metric/log).

Request

application/json

Body

required

filter object

How filters work: Filters are optional. We match all selected categories (AND), but will include results for any value selected within a single category (OR).

alertIds string[]

Filter by alert IDs

searchTerm string

Searches term in alert name field

source string

Possible values: [LOG_ALERT, METRIC_ALERT]

Filter by alert source type

states string[]

Possible values: [TRIGGERED, RESOLVED, PENDING, NO_DATA]

Filter by alert event states

severities string[]

Possible values: [INFO, LOW, MEDIUM, HIGH, SEVERE]

Filter by alert severities

tags string[]

Filter by alert tags

timeframe object

Filter events within the timeframe, based on the event lastTriggeredAt.

from int64

Start time in seconds since Unix epoch.

to int64

End time in seconds since Unix epoch.

dashboardIds string[]

Filter by dashboard IDs

muted boolean

Filter by muted/unmuted alert events.

An alert is marked as muted within the suppress notifications timeframe.

Notice: Muting is only applicable to log alerts. Metric alerts are alway muted: false.

sort object[]

Sort criteria for the search results. By field and sort direction.

Array [

field string

Possible values: [name, groups, severity, state, tags, lastTriggeredAt, reason, isMuted]

direction string

Possible values: [ASC, DESC]

]

pagination object

Default pagination is a page of 25 results. Look for the total field in the response for the number of available results overall, and use the pagination function to page through the results.

pageNumber int32

Default value: 1

If you overshoot the page number, it will return empty with no results, but it won't fail the request.

pageSize int32

Default value: 25

Controls the number of results per page.

Responses

A list of unified alert events matching the search criteria.

application/json

Schema
Example (from schema)

Schema

total int32

results object[]

Array [

alertEventId string

The unique identifier of the alert event.

sourceType string

Possible values: [LOG_ALERT, METRIC_ALERT]

The type of the alert source, either a log-based or metric-based alert.

name string

The name of the alert event.

groups object

Key-value pairs representing the groups associated with the alert event.

property name* string

severity string

Possible values: [INFO, LOW, MEDIUM, HIGH, SEVERE]

The severity level for this alert. This can be used to prioritize alerts and can be used in alert filtering.

state string

Possible values: [TRIGGERED, RESOLVED, PENDING, NO_DATA]

The state of the alert event.

reason string

The reason or explanation for the alert event state.

tags string[]

A list of tags associated with the alert event.

lastTriggeredAt int64

The timestamp (in seconds since Unix epoch) when the alert was last triggered.

alertId string

The ID of the alert that generated this event.

linkedPanel object

Represents the Unified Dashboards panel linked to this alert.

This provides a direct reference to the visualization source of the alert, enabling navigation from alert → panel for context and troubleshooting.

The panel is included in the notification for quick access and used by the AI Agent to run an RCA when enabled.

folderId string

The folder ID where the dashboard is located.

dashboardId string

The dashboard ID where he panel is located.

panelId string

The panel ID associated to this alert.

rca boolean

Indicates whether Root Cause Analysis (RCA) is enabled for the alert event.

runbook string

A link or reference to the runbook associated with the alert event.

rcaNotificationEndpointIds int32[]

A list of notification endpoint IDs for Root Cause Analysis (RCA).