Create package policy

POST /api/fleet/package_policies
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/package_policies

Refer to Spaces for more information.

Headers

  • kbn-xsrf string Required

    Kibana's anti Cross-Site Request Forgery token. Can be any string value.

Query parameters

  • format string

    Simplified or legacy format for package inputs

    Values are simplified or legacy.

application/json

Body

You should use inputs as an object and not use the deprecated inputs array.

  • description string

    Package policy description

  • force boolean

    Force package policy creation even if package is not verified, or if the agent policy is managed.

  • id string

    Package policy unique identifier

  • inputs object

    Package policy inputs (see integration documentation to know what inputs are available)

    Hide inputs attribute Show inputs attribute object
    • * object Additional properties
      Hide * attributes Show * attributes object
      • enabled boolean

        enable or disable that input, (default to true)

      • streams object

        Input streams (see integration documentation to know what streams are available)

        Hide streams attribute Show streams attribute object
        • * object Additional properties
          Hide * attributes Show * attributes object
          • enabled boolean

            enable or disable that stream, (default to true)

          • vars object

            Stream level variable (see integration documentation for more information)

      • vars object

        Input level variable (see integration documentation for more information)

  • name string Required

    Package policy name (should be unique)

  • namespace string

    The package policy namespace. Leave blank to inherit the agent policy's namespace.

  • output_id string | null

    Output ID to send package data to

  • overrides object | null

    Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.

    Hide overrides attribute Show overrides attribute object | null
    • inputs object
  • package object Required
    Hide package attributes Show package attributes object
    • name string Required

      Package name

    • version string Required

      Package version

  • policy_id string | null Deprecated

    Agent policy ID where that package policy will be added

  • policy_ids array[string]

    Agent policy IDs where that package policy will be added

  • vars object

    Package root level variable (see integration documentation for more information)

Responses

  • 200 application/json

    OK

    Hide response attribute Show response attribute object
    • item object Required
      Hide item attributes Show item attributes object
      • id string Required

      • inputs array | object

        One of:
        array-1 array object-2 object
      • inputs array[object] Required
        Hide inputs attributes Show inputs attributes object
        • config object
        • enabled boolean Required
        • processors array[string]
        • streams array
        • type string Required
        • vars object
      • revision number Required
      • description string
      • enabled boolean
      • name string Required
      • namespace string
      • output_id string
      • overrides object
      • package object
        Hide package attributes Show package attributes object
        • name string Required
        • requires_root boolean
        • title string
        • version string Required
      • policy_id string | null Deprecated
      • policy_ids array[string]
  • 400 application/json

    Generic Error

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode number
  • 409 application/json

    Generic Error

    Hide response attributes Show response attributes object
    • error string
    • message string
    • statusCode number
POST /api/fleet/package_policies 
curl \
 --request POST 'https://localhost:5601/api/fleet/package_policies' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: string" \
 --data '{
  "description": "my description",
  "force": true,
  "id": "string",
  "inputs": {
    "nginx-logfile": {
      "enabled": true,
      "streams": {
        "nginx.access": {
          "enabled": true,
          "vars": {
            "ignore_older": "72h",
            "paths": [
              "/var/log/nginx/access.log*"
            ],
            "preserve_original_event": false,
            "tags": [
              "nginx-access"
            ]
          }
        }
      }
    }
  },
  "name": "nginx-123",
  "namespace": "customnamespace",
  "output_id": "output-id",
  "overrides": {
    "inputs": {}
  },
  "package": {
    "name": "nginx",
    "version": "1.6.0"
  },
  "policy_id": "agent-policy-id",
  "policy_ids": [
    "agent-policy-id"
  ],
  "vars": {}
}'