Module alerts 

Detection alerts: the signals search, status, tags, and assignees routes.

Alert identity is the document _id. Every mutation here takes explicit ids or an explicit query; there is no reconciliation path (triage spec section 2).

Structs

AlertHit

AlertPage

SignalsOutcome

The raw update-by-query envelope the status, tags, and assignees routes answer with (measured, triage spec section 10).

Enums

AlertStatus

The modern status vocabulary. The route also accepts in-progress, the pre-8.0 name acknowledged replaced; elasticctl never sends it.

Conflicts

Version-conflict handling for query-scoped transitions. Abort is the server default: a document whose version moved between resolution and write stops the run rather than being silently skipped.

Constants

ASSIGNEES_PATH

SEARCH_PATH

STATUS_PATH

TAGS_PATH

Functions

decode_outcome

Fail-closed decode: all four counters and the failures array are required. A response missing one is an http error, never “nothing happened” (main spec section 6.3).

decode_page

Decode a signals-search response. Fail-closed: hits.hits must be an array and every hit must carry a string _id — an alert without identity cannot be acted on — and an object _source.

search

Run one bounded signals search with the caller’s body verbatim.

search_all

Page a query fully with sort + search_after through the same route. sort must be a total order (the caller ends it with a tiebreaker field).

search_all_with_page_size

The paging loop with an explicit page size, exposed for tests.

set_assignees

Add and remove assignee profile uids on explicit alerts in one request. The route rejects a uid present in both lists; callers pre-check.

set_tags

Add and remove workflow tags on explicit alerts in one request.

status_by_ids

Transition explicit alerts. The route is idempotent: a no-op transition counts as processed.

status_by_query

Transition every alert a query matches. The server resolves the set and mutates it in one update-by-query — no client-side id round-trip.