Update Timeline or Timeline templateedit
Updates an existing Timeline or Timeline template.
Use the timeline
object’s timelineType
field
to specify whether you’re updating a Timeline or a Timeline template:
-
"timelineType": "default"
updates an existing Timeline. -
"timelineType": "template"
updates an existing Timeline template.
Request URLedit
PATCH <kibana host>:<port>/api/timeline
Request bodyedit
A JSON object defining the Timeline or Timeline template query and time filter.
For detailed information about the Timeline object schema and its corresponding UI components, refer to Timeline schema.
Name | Type | Description | Required |
---|---|---|---|
|
The If you’re updating a Timeline template, provide these fields so you can easily import template updates:
|
Yes |
|
|
String |
The |
Yes |
|
String |
The version of the Timeline or Timeline template that you’re updating. |
Yes |
Example requestsedit
Example 1
Updates an existing Timeline.
PATCH api/timeline { "timeline": { "columns": [ { "columnHeaderType": "not-filtered", "id": "@timestamp" }, { "columnHeaderType": "not-filtered", "id": "message" }, { "columnHeaderType": "not-filtered", "id": "event.category" }, { "columnHeaderType": "not-filtered", "id": "event.action" }, { "columnHeaderType": "not-filtered", "id": "host.name" }, { "columnHeaderType": "not-filtered", "id": "source.ip" }, { "columnHeaderType": "not-filtered", "id": "destination.ip" }, { "columnHeaderType": "not-filtered", "id": "user.name" } ], "dataProviders": [], "description": "", "eventType": "all", "filters": [], "kqlMode": "filter", "kqlQuery": { "filterQuery": null }, "title": "abd", "dateRange": { "start": 1587370079200, "end": 1587456479201 }, "savedQueryId": null, "sort": { "columnId": "@timestamp", "sortDirection": "desc" }, "created": 1587468588922, "createdBy": "casetester", "updated": 1587468588922, "updatedBy": "casetester", "timelineType": "default" }, "timelineId": "4bc294e0-3516-11ee-9f62-49614d8a84fd", "version": "WzE5MTUsMV0=" }
|
|
|
Example 2
Updates an existing Timeline template.
PATCH api/timeline { "timeline": { "columns": [ { "columnHeaderType": "not-filtered", "id": "@timestamp" }, { "columnHeaderType": "not-filtered", "id": "message" }, { "columnHeaderType": "not-filtered", "id": "event.category" }, { "columnHeaderType": "not-filtered", "id": "event.action" }, { "columnHeaderType": "not-filtered", "id": "host.name" }, { "columnHeaderType": "not-filtered", "id": "source.ip" }, { "columnHeaderType": "not-filtered", "id": "destination.ip" }, { "columnHeaderType": "not-filtered", "id": "user.name" } ], "dataProviders": [], "description": "", "eventType": "all", "filters": [], "kqlMode": "filter", "kqlQuery": { "filterQuery": null }, "title": "abd", "dateRange": { "start": 1587370079200, "end": 1587456479201 }, "savedQueryId": null, "sort": { "columnId": "@timestamp", "sortDirection": "desc" }, "timelineType": "template", "created": 1587473119992, "createdBy": "casetester", "updated": 1587473119992, "updatedBy": "casetester", "templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1", "templateTimelineVersion": 2 }, "timelineId": "7d7d4b60-3516-11ee-9f62-49614d8a84fd", "version": "WzE5MTcsMV0=" }
|
|
|
|
|
|
|
Response codeedit
-
200
- Indicates a successful call.
Response payloadedit
A JSON Timeline object with a unique savedObjectId
and its version
.
Example 1
Response payload of an updated Timeline:
{ "data": { "persistTimeline": { "code": 200, "message": "success", "timeline": { "savedObjectId": "4bc294e0-3516-11ee-9f62-49614d8a84fd", "version": "WzE5MTgsMV0=", "columns": [ { "columnHeaderType": "not-filtered", "id": "@timestamp" }, { "columnHeaderType": "not-filtered", "id": "message" }, { "columnHeaderType": "not-filtered", "id": "event.category" }, { "columnHeaderType": "not-filtered", "id": "event.action" }, { "columnHeaderType": "not-filtered", "id": "host.name" }, { "columnHeaderType": "not-filtered", "id": "source.ip" }, { "columnHeaderType": "not-filtered", "id": "destination.ip" }, { "columnHeaderType": "not-filtered", "id": "user.name" } ], "dataProviders": [], "dataViewId": null, "description": "", "eventType": "all", "excludedRowRendererIds": [], "favorite": [], "filters": [], "kqlMode": "filter", "kqlQuery": { "filterQuery": null }, "title": "abd", "templateTimelineId": null, "templateTimelineVersion": null, "dateRange": { "start": 1587370079200, "end": 1587456479201 }, "savedQueryId": null, "created": 1587468588922, "createdBy": "casetester", "updated": 1691408201273, "updatedBy": "elastic", "timelineType": "default", "status": "active", "sort": [ { "sortDirection": "desc", "columnId": "@timestamp" } ], "eventIdToNoteIds": [], "noteIds": [], "notes": [], "pinnedEventIds": [], "pinnedEventsSaveObject": [] } } } }
Example 2
Response payload of an updated Timeline template:
{ "data": { "persistTimeline": { "code": 200, "message": "success", "timeline": { "savedObjectId": "7d7d4b60-3516-11ee-9f62-49614d8a84fd", "version": "WzE5MTksMV0=", "columns": [ { "columnHeaderType": "not-filtered", "id": "@timestamp" }, { "columnHeaderType": "not-filtered", "id": "message" }, { "columnHeaderType": "not-filtered", "id": "event.category" }, { "columnHeaderType": "not-filtered", "id": "event.action" }, { "columnHeaderType": "not-filtered", "id": "host.name" }, { "columnHeaderType": "not-filtered", "id": "source.ip" }, { "columnHeaderType": "not-filtered", "id": "destination.ip" }, { "columnHeaderType": "not-filtered", "id": "user.name" } ], "dataProviders": [], "dataViewId": null, "description": "", "eventType": "all", "excludedRowRendererIds": [], "favorite": [], "filters": [], "kqlMode": "filter", "kqlQuery": { "filterQuery": null }, "title": "abd", "templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1", "templateTimelineVersion": 2, "dateRange": { "start": 1587370079200, "end": 1587456479201 }, "savedQueryId": null, "created": 1587473119992, "createdBy": "casetester", "updated": 1691408702104, "updatedBy": "elastic", "timelineType": "template", "status": "active", "sort": [ { "sortDirection": "desc", "columnId": "@timestamp" } ], "eventIdToNoteIds": [], "noteIds": [], "notes": [], "pinnedEventIds": [], "pinnedEventsSaveObject": [] } } } }