Read one alerting monitor's query and triggers
malcolm_alerting_monitor_detailRead-only
Read a monitor's full OpenSearch query and trigger conditions to determine if its silence is real, revealing whether any traffic can satisfy the firing rule.
Instructions
Read one alerting monitor in full: the query it runs and the conditions that fire it.
Use this to decide whether a monitor's SILENCE means anything.
malcolm_alerting_monitors says a monitor exists and whether it is
enabled, but cannot show the query or the trigger condition, so it
cannot separate a monitor that watches the right traffic from one whose
condition no traffic can satisfy — measured on Malcolm v26.07.1, the shipped
loopback monitor fires on `ctx.results[0].hits.total.value > 999999999`.
Take the id from malcolm_alerting_monitors; for the alerts a monitor has
raised use malcolm_alerting_alerts with monitor_id.
Field names are in the output schema; what it cannot show is what sits
inside `inputs` and `triggers` — each search input's whole OpenSearch
query as the monitor stores it, mustache placeholders such as
{{period_end}} left intact, and each trigger's severity, firing
condition and action names. Watch for the `note` key: it marks a monitor
that cannot fire at all, disabled or trigger-less. Raises if no monitor
has that id.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| monitor_id | Yes | The monitor's OpenSearch document id, returned as `id` by malcolm_alerting_monitors (e.g. "NYUZsZ8Bao8axaN3ef1f"). Not the monitor name. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |