Create a package policy

View as Markdown
POST /api/fleet/package_policies
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/package_policies

Refer to Spaces for more information.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

Query parameters

  • format string

    Values are simplified or legacy.

application/json

Body object

You should use inputs as an object and not use the deprecated inputs array.

Any of:
object-1 object object-2 object

Responses

  • 200 application/json

    OK: A successful request.

    Hide response attribute Show response attribute object
    • item object Required

      Additional properties are NOT allowed.

      Hide item attributes Show item attributes object
      • additional_datastreams_permissions array[string] | null

        Additional datastream permissions, that will be added to the agent policy.

      • agents number
      • cloud_connector_id string | null

        ID of the cloud connector associated with this package policy.

      • created_at string Required
      • created_by string Required
      • description string

        Package policy description

      • elasticsearch object

        Additional properties are allowed.

        Hide elasticsearch attribute Show elasticsearch attribute object
        • privileges object

          Additional properties are allowed.

          Hide privileges attribute Show privileges attribute object
          • cluster array[string]
      • enabled boolean Required
      • id string Required

        Package policy unique identifier.

      • inputs array[object] | object Required

        Package policy inputs.

        Any of:
        array-1 array[object] object-2 object
        Hide attributes Show attributes object
        • config object

          Package variable (see integration documentation for more information)

          Hide config attribute Show config attribute object
          • * object Additional properties

            Additional properties are NOT allowed.

            Hide * attributes Show * attributes object
            • frozen boolean
            • type string
        • enabled boolean Required
        • id string
        • keep_enabled boolean
        • policy_template string
        • streams array[object] Required
          Hide streams attributes Show streams attributes object
          • config object

            Package variable (see integration documentation for more information)

            Hide config attribute Show config attribute object
            • * object Additional properties

              Additional properties are NOT allowed.

              Hide * attributes Show * attributes object
              • frozen boolean
              • type string
          • data_stream object Required

            Additional properties are NOT allowed.

            Hide data_stream attributes Show data_stream attributes object
            • dataset string Required
            • elasticsearch object

              Additional properties are NOT allowed.

              Hide elasticsearch attributes Show elasticsearch attributes object
              • dynamic_dataset boolean
              • dynamic_namespace boolean
              • privileges object

                Additional properties are NOT allowed.

                Hide privileges attribute Show privileges attribute object
                • indices array[string]
            • type string Required
          • enabled boolean Required
          • id string
          • keep_enabled boolean
          • release string

            Values are ga, beta, or experimental.

          • vars object

            Package variable (see integration documentation for more information)

            Hide vars attribute Show vars attribute object
            • * object Additional properties

              Additional properties are NOT allowed.

              Hide * attributes Show * attributes object
              • frozen boolean
              • type string
        • type string Required
        • vars object

          Package variable (see integration documentation for more information)

          Hide vars attribute Show vars attribute object
          • * object Additional properties

            Additional properties are NOT allowed.

            Hide * attributes Show * attributes object
            • frozen boolean
            • type string
      • is_managed boolean
      • name string Required

        Unique name for the package policy.

      • namespace string

        The package policy namespace. Leave blank to inherit the agent policy's namespace.

      • output_id string | null
      • overrides object | null

        Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.

        Additional properties are NOT allowed.

        Hide overrides attribute Show overrides attribute object | null
        • inputs object

          Additional properties are allowed.

      • package object

        Additional properties are NOT allowed.

        Hide package attributes Show package attributes object
        • experimental_data_stream_features array[object]
          Hide experimental_data_stream_features attributes Show experimental_data_stream_features attributes object
          • data_stream string Required
          • features object Required

            Additional properties are NOT allowed.

            Hide features attributes Show features attributes object
            • doc_value_only_numeric boolean
            • doc_value_only_other boolean
            • synthetic_source boolean
            • tsdb boolean
        • fips_compatible boolean
        • name string Required

          Package name

        • requires_root boolean
        • title string
        • version string Required

          Package version

      • policy_id string | null Deprecated

        ID of the agent policy which the package policy will be added to.

      • policy_ids array[string]

        IDs of the agent policies which that package policy will be added to.

      • revision number Required

        Package policy revision.

      • secret_references array[object]
        Hide secret_references attribute Show secret_references attribute object
        • id string Required
      • spaceIds array[string]
      • supports_agentless boolean | null

        Indicates whether the package policy belongs to an agentless agent policy.

        Default value is false.

      • supports_cloud_connector boolean | null

        Indicates whether the package policy supports cloud connectors.

        Default value is false.

      • updated_at string Required
      • updated_by string Required

      • vars object

        Package level variable.

        Any of:
        object-1 object object-2 object

        Input/stream level variable. Refer to the integration documentation for more information.

      • version string

        Package policy ES version.
  • 400 application/json

    A bad request.

    Hide response attributes Show response attributes object
    • error string
    • errorType string
    • message string Required
    • statusCode number
  • 409 application/json

    A conflict occurred.

    Hide response attributes Show response attributes object
    • error string
    • errorType string
    • message string Required
    • statusCode number
POST /api/fleet/package_policies 
curl \
 --request POST 'https://localhost:5601/api/fleet/package_policies' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{"additional_datastreams_permissions":["string"],"cloud_connector_id":"string","description":"string","enabled":true,"force":true,"id":"string","inputs":[{"config":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}},"enabled":true,"id":"string","keep_enabled":true,"policy_template":"string","streams":[{"config":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}},"data_stream":{"dataset":"string","elasticsearch":{"dynamic_dataset":true,"dynamic_namespace":true,"privileges":{"indices":["string"]}},"type":"string"},"enabled":true,"id":"string","keep_enabled":true,"release":"ga","vars":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}}}],"type":"string","vars":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}}}],"is_managed":true,"name":"string","namespace":"string","output_id":"string","overrides":{"inputs":{}},"package":{"experimental_data_stream_features":[{"data_stream":"string","features":{"doc_value_only_numeric":true,"doc_value_only_other":true,"synthetic_source":true,"tsdb":true}}],"fips_compatible":true,"name":"string","requires_root":true,"title":"string","version":"string"},"policy_id":"string","policy_ids":["string"],"spaceIds":["string"],"supports_agentless":false,"supports_cloud_connector":false,"vars":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}}}'