Read one alerting monitor's query and triggers
malcolm_alerting_monitor_detailRead-only
Read one alerting monitor's complete query and trigger conditions to decide if its silence means anything. Use the monitor ID from the monitor listing.
Instructions
Read one alerting monitor in full: the query it runs and the conditions that fire it.
Use this to decide whether a monitor's SILENCE means anything.
malcolm_alerting_monitors says a monitor exists and whether it is
enabled, but cannot show the query or the trigger condition, so it
cannot separate a monitor that watches the right traffic from one whose
condition no traffic can satisfy — measured on Malcolm v26.07.1, the shipped
loopback monitor fires on `ctx.results[0].hits.total.value > 999999999`.
Take the id from malcolm_alerting_monitors; for the alerts a monitor has
raised use malcolm_alerting_alerts with monitor_id.
Field names are in the output schema; what it cannot show is what sits
inside `inputs` and `triggers` — each search input's whole OpenSearch
query as the monitor stores it, mustache placeholders such as
{{period_end}} left intact, and each trigger's severity, firing
condition and action names. Watch for the `note` key: it marks a monitor
that cannot fire at all, disabled or trigger-less. Raises if no monitor
has that id.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| monitor_id | Yes | The monitor's OpenSearch document id, returned as `id` by malcolm_alerting_monitors (e.g. "NYUZsZ8Bao8axaN3ef1f"). Not the monitor name. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |