Initialize an Entity Engine
Path parameters
-
The entity type of the engine (either 'user' or 'host').
Values are
user
,host
,service
, oruniversal
.
Body Required
Schema for the engine initialization
-
Interval in which enrich policy runs. For example,
"1h"
means the rule runs every hour.Format should match the following pattern:
^[1-9]\d*[smh]$
. -
fieldHistoryLength integer
The number of historical values to keep for each field.
Default value is
10
. -
filter string
-
indexPattern string
POST
/api/entity_store/engines/{entityType}/init
curl \
--request POST https://localhost:5601/api/entity_store/engines/{entityType}/init \
--header "Content-Type: application/json; Elastic-Api-Version=2023-10-31"
Request examples
{
"enrichPolicyExecutionInterval": "1h",
"fieldHistoryLength": 10,
"filter": "string",
"indexPattern": "string"
}
Response examples (200)
{
"error": {},
"fieldHistoryLength": 42,
"filter": "string",
"indexPattern": "string",
"lookbackPeriod": "24h",
"status": "installing",
"type": "user"
}