Service-Level Objectives (SLOs) Create and manage SLOs in Elastic Observability. SLOs track service performance against measurable targets using service-level indicators (SLIs) computed from Elasticsearch data. Authentication SLO operations go through the Kibana API. Authenticate with either an API key or basic auth:

API key

curl -H "Authorization: ApiKey " -H "kbn-xsrf: true" < KIBANA_URL

/api/observability/slos

Basic auth

curl -u " $KIBANA_USER : $KIBANA_PASSWORD " -H "kbn-xsrf: true" < KIBANA_URL

/api/observability/slos For non-default spaces, prefix the path: /s//api/observability/slos . Include kbn-xsrf: true on all POST, PUT, and DELETE requests. SLI Types Type API value Use case Custom KQL sli.kql.custom Raw logs — good/total using KQL queries Custom metric sli.metric.custom Metric fields — equations with aggregations Timeslice metric sli.metric.timeslice Metric fields — per-slice threshold check Histogram metric sli.histogram.custom Histogram fields — range/value_count APM latency sli.apm.transactionDuration APM — latency threshold APM availability sli.apm.transactionErrorRate APM — success rate Synthetics availability sli.synthetics.availability Synthetics monitors — uptime percentage Guidelines objective.target is a decimal between 0 and 1 (for example 0.995 for 99.5%). Timeslice metric indicators require budgetingMethod: "timeslices" . Updating an SLO resets the underlying transform — historical data is recomputed. The cluster needs nodes with both transform and ingest roles. Use POST .../slos/{id}/_reset when an SLO is stuck or after index mapping changes. Group-by SLOs create one instance per unique value — avoid high-cardinality fields. Synthetics SLOs are auto-grouped by monitor and location; do not set groupBy manually. Burn rate alert rules are not auto-created using the API — set them up separately.