Module model 

The rule, exception-list, and exception-item representations.

A measured create response has 36 fields, which vary by rule type and Elastic version. A JSON map preserves unknown fields; a fixed struct would break round trips.

Structs

ExceptionItem

ExceptionList

ExceptionRef

The {id, list_id, type, namespace_type} reference a rule carries.

ExportSummary

The trailer Kibana appends to an NDJSON export. It is the entire body for a zero-rule export, so it must not be parsed as a rule.

ListKey

Rule

Constants

COMMENT_VOLATILE_FIELDS

Server-minted fields on an exception item comment. id, created_at, and created_by are measured; updated_at and updated_by were absent on a freshly created comment but name the same class on every other object in this API, and removing an absent key costs nothing.

ITEM_VOLATILE_FIELDS

Server-owned exception-item fields excluded from comparison. This is the container set less version: a measured item carries _version but no version.

LIST_VOLATILE_FIELDS

Server-owned exception-list fields excluded from comparison to avoid false drift.

VOLATILE_FIELDS

Server-owned rule fields excluded from comparison to avoid false drift.

Functions

exception_refs

Read a rule’s exceptions_list array. A malformed entry is skipped rather than failing the rule: the field is server-owned and unknown shapes must survive a round trip.

server_defaults

Fields the server fills when a create request omits them.