Create package policy

POST /api/fleet/package_policies
Api key auth Basic auth

Headers

  • kbn-xsrf string Required

    Kibana's anti Cross-Site Request Forgery token. Can be any string value.

Query parameters

  • format string

    Simplified or legacy format for package inputs

    Values are simplified or legacy.

application/json; Elastic-Api-Version=2023-10-31

Body

You should use inputs as an object and not use the deprecated inputs array.

  • description string

    Package policy description

  • force boolean

    Force package policy creation even if package is not verified, or if the agent policy is managed.

  • id string

    Package policy unique identifier

  • inputs object

    Package policy inputs (see integration documentation to know what inputs are available)

    Hide inputs attribute Show inputs attribute object
    • * object Additional properties
      Hide * attributes Show * attributes object
      • enabled boolean

        enable or disable that input, (default to true)

      • streams object

        Input streams (see integration documentation to know what streams are available)

        Hide streams attribute Show streams attribute object
        • * object Additional properties
          Hide * attributes Show * attributes object
          • enabled boolean

            enable or disable that stream, (default to true)

          • vars object

            Stream level variable (see integration documentation for more information)

      • vars object

        Input level variable (see integration documentation for more information)

  • name string Required

    Package policy name (should be unique)

  • namespace string

    The package policy namespace. Leave blank to inherit the agent policy's namespace.

  • output_id string | null

    Output ID to send package data to

  • overrides object | null

    Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.

    Hide overrides attribute Show overrides attribute object | null
  • package object Required
    Hide package attributes Show package attributes object
    • name string Required

      Package name

    • version string Required

      Package version

  • policy_id string | null Deprecated

    Agent policy ID where that package policy will be added

  • policy_ids array[string]

    Agent policy IDs where that package policy will be added

  • vars object

    Package root level variable (see integration documentation for more information)

Responses

POST /api/fleet/package_policies 
curl \
 --request POST http://localhost:5622/api/fleet/package_policies \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json; Elastic-Api-Version=2023-10-31" \
 --header "kbn-xsrf: string"
Request examples 
# Headers
kbn-xsrf: string

# Payload
{
  "description": "my description",
  "force": true,
  "id": "string",
  "inputs": {
    "nginx-logfile": {
      "enabled": true,
      "streams": {
        "nginx.access": {
          "vars": {
            "tags": [
              "nginx-access"
            ],
            "paths": [
              "/var/log/nginx/access.log*"
            ],
            "ignore_older": "72h",
            "preserve_original_event": false
          },
          "enabled": true
        }
      }
    }
  },
  "name": "nginx-123",
  "namespace": "customnamespace",
  "output_id": "output-id",
  "overrides": {
    "inputs": {}
  },
  "package": {
    "name": "nginx",
    "version": "1.6.0"
  },
  "policy_id": "agent-policy-id",
  "policy_ids": [
    "agent-policy-id"
  ],
  "vars": {}
}
Response examples (200) 
{
  "item": {
    "id": "string",
    "inputs": [],
    "revision": 42.0,
    "description": "string",
    "enabled": true,
    "name": "string",
    "namespace": "string",
    "output_id": "string",
    "overrides": {},
    "package": {
      "name": "string",
      "requires_root": true,
      "title": "string",
      "version": "string"
    },
    "policy_id": "string",
    "policy_ids": [
      "string"
    ]
  }
}
Response examples (400) 
{
  "error": "string",
  "message": "string",
  "statusCode": 42.0
}
Response examples (409) 
{
  "error": "string",
  "message": "string",
  "statusCode": 42.0
}