# l4 alerts update

> Change a cost alert's name, rule, source, recipients or Slack channels from a JSON file of only the fields to change.

Source: https://docs.levelfour.ai/cli/commands/alerts/update


`l4 alerts update` changes a cost alert. It sends only the fields its file names, and leaves every other field as it is.

```bash
l4 alerts update <id> --file <path|-> [--yes]
```

## The change file

The file takes any of `name`, `params`, `source_id`, `recipients` and `slack_channel_ids`, in the shapes [`l4 alerts create`](/cli/commands/alerts/create#the-rule-file) describes.

* `params` replaces the whole rule. To move one threshold, send the rule back with that figure changed.
* `recipients` and `slack_channel_ids` replace the list they name. An empty `slack_channel_ids` takes every channel off.
* The CLI refuses a file that names no field with `... changes nothing`, before it sends anything.

Raise a monthly budget to 50,000, keeping the rest of the rule:

```bash
l4 alerts get <id> --json \
  | jq '{params: (.data.params | .budget = 50000)}' \
  | l4 alerts update <id> --file - --yes
```

To pause an alert, use [`l4 alerts pause`](/cli/commands/alerts#pause-and-resume).

## Flags

| Flag           | Description                                             |
| -------------- | ------------------------------------------------------- |
| `-f`, `--file` | The change file, or `-` to read it from stdin. Required |
| `-y`, `--yes`  | Skip the confirmation prompt                            |

## Confirmation

At a terminal, the command asks `Change cost alert <id>? [y/N]`. Anything other than `y` or `yes` aborts, prints `Aborted.`, and exits `0` without calling the API. In a pipe or a script, where stdout is not a terminal, it changes the alert without asking. With `--file -` at a terminal, pass `--yes`, for the reason [`create`](/cli/commands/alerts/create#confirmation) gives.

## Requires a read-write key

A read-only key fails with exit `1` and `permission denied`. See [CLI authentication](/cli/authentication#browser-login-mints-a-read-only-key).

## Output

A success line, then the alert as it now reads, in the layout of [`l4 alerts get`](/cli/commands/alerts#get). With `--json`, the alert as the API returns it.

## Errors

| Exit | Symptom                      | Cause                                                                                                                      |
| ---- | ---------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `1`  | `... is not a cost alert id` | The id is not a UUID                                                                                                       |
| `1`  | `... changes nothing`        | The file is an empty object                                                                                                |
| `1`  | `403` permission denied      | The key is read-only                                                                                                       |
| `1`  | `404`                        | No alert has that id in your organization                                                                                  |
| `1`  | `422` with a reason          | The API refused the change for a reason [`create`](/cli/commands/alerts/create#errors) lists, or for a field set to `null` |