Read one alerting monitor's query and triggers
malcolm_alerting_monitor_detailRead-only
Retrieve an alerting monitor by ID to inspect its full OpenSearch query and firing conditions, checking if silence is meaningful or the monitor cannot fire.
Instructions
Read one alerting monitor in full: the query it runs and the conditions that fire it.
Use this to decide whether a monitor's SILENCE means anything.
malcolm_alerting_monitors says a monitor exists and whether it is
enabled, but cannot show the query or the trigger condition, so it
cannot separate a monitor that watches the right traffic from one whose
condition no traffic can satisfy — Malcolm's shipped loopback monitor
fires on `ctx.results[0].hits.total.value > 999999999`.
Take the id from malcolm_alerting_monitors; for the alerts a monitor has
raised use malcolm_alerting_alerts with monitor_id.
Field names are in the output schema; what it cannot show is what sits
inside `inputs` and `triggers` — each search input's whole OpenSearch
query as the monitor stores it, mustache placeholders such as
{{period_end}} left intact, and each trigger's severity, firing
condition and action names. Watch for the `note` key: it marks a monitor
that cannot fire at all, disabled or trigger-less. Raises if no monitor
has that id.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| monitor_id | Yes | The monitor's OpenSearch document id, returned as `id` by malcolm_alerting_monitors (e.g. "ExampleOsDocId000001"). Not the monitor name. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |