Bulk update queries | Kibana API documentation (v9)

Bulk update queries Deprecated Experimental; added in 9.1.0

POST /api/streams/{name}/queries/_bulk

Spaces method and path for this operation:

post /s/{space_id}/api/streams/{name}/queries/_bulk

Refer to Spaces for more information.

Bulk update queries of a stream. Can add new queries and delete existing ones.

[Required authorization] Route required privileges: manage_stream.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

Path parameters

name string Required

The name of the stream.

Maximum length is 255.

application/json

Body

operations array[object] Required
Any of:
object-1 object object-2 object
Hide attribute Show attribute

index object Required

Hide index attributes Show index attributes object

description string

Maximum length is 10000. Default value is empty.

esql object Required

Hide esql attribute Show esql attribute object

query string Required

Maximum length is 10000.

evidence array[string]

Maximum length of each is 10000.

expires_at string(date-time)

Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.

id string Required

A non-empty string.

Minimum length is 1.

severity_score number

title string Required

A non-empty string.

Minimum length is 1.
Hide attribute Show attribute

delete object Required

Hide delete attribute Show delete attribute object

id string Required

Maximum length is 255.

Responses

200

Bulk operation completed successfully.

POST /api/streams/{name}/queries/_bulk

curl \
 --request POST 'https://localhost:5601/api/streams/{name}/queries/_bulk' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '"{\n  \"operations\": [\n    {\n      \"index\": {\n        \"description\": \"Count error-level log events grouped by host name\",\n        \"esql\": {\n          \"query\": \"FROM logs* | WHERE log.level == \\\"error\\\" | STATS count = COUNT(*) BY host.name\"\n        },\n        \"id\": \"error-count-by-host\",\n        \"title\": \"Error count by host\"\n      }\n    },\n    {\n      \"delete\": {\n        \"id\": \"old-query-id\"\n      }\n    }\n  ]\n}"'

Request example

{
  "operations": [
    {
      "index": {
        "description": "Count error-level log events grouped by host name",
        "esql": {
          "query": "FROM logs* | WHERE log.level == \"error\" | STATS count = COUNT(*) BY host.name"
        },
        "id": "error-count-by-host",
        "title": "Error count by host"
      }
    },
    {
      "delete": {
        "id": "old-query-id"
      }
    }
  ]
}