Spaces method and path for this operation:
post /s/{space_id}/api/streams/{name}/queries/_bulk
Refer to Spaces for more information.
Bulk update queries of a stream. Can add new queries and delete existing ones.
[Required authorization] Route required privileges: manage_stream.
POST
/api/streams/{name}/queries/_bulk
curl \
--request POST 'https://localhost:5601/api/streams/{name}/queries/_bulk' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"operations":[{"index":{"description":"Count error-level log events grouped by host name","esql":{"query":"FROM logs* | WHERE log.level == \"error\" | STATS count = COUNT(*) BY host.name"},"id":"error-count-by-host","title":"Error count by host"}},{"delete":{"id":"old-query-id"}}]}'
Request example
{
"operations": [
{
"index": {
"description": "Count error-level log events grouped by host name",
"esql": {
"query": "FROM logs* | WHERE log.level == \"error\" | STATS count = COUNT(*) BY host.name"
},
"id": "error-count-by-host",
"title": "Error count by host"
}
},
{
"delete": {
"id": "old-query-id"
}
}
]
}