Upsert a query to a stream | Kibana API documentation (v9)

Upsert a query to a stream Deprecated Experimental; added in 9.1.0

PUT /api/streams/{name}/queries/{queryId}

Spaces method and path for this operation:

put /s/{space_id}/api/streams/{name}/queries/{queryId}

Refer to Spaces for more information.

Adds a query to a stream. Noop if the query is already present on the stream.

[Required authorization] Route required privileges: manage_stream.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

Path parameters

name string Required

The name of the stream.

Maximum length is 255.
queryId string Required

The identifier of the query.

Maximum length is 255.

application/json

Body

description string

Maximum length is 10000. Default value is empty.
esql object Required

Additional properties are NOT allowed.
Hide esql attribute Show esql attribute object
- query string Required
  
  Maximum length is 10000.
evidence array[string]

Maximum length of each is 10000.
expires_at string(date-time)

Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
severity_score number
title string Required

A non-empty string.

Minimum length is 1.

Responses

200

The query was added or updated successfully.

PUT /api/streams/{name}/queries/{queryId}

curl \
 --request PUT 'https://localhost:5601/api/streams/{name}/queries/{queryId}' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '"{\n  \"description\": \"Count error-level log events grouped by host name\",\n  \"esql\": {\n    \"query\": \"FROM logs* | WHERE log.level == \\\"error\\\" | STATS count = COUNT(*) BY host.name\"\n  },\n  \"title\": \"Error count by host\"\n}"'

Request example

{
  "description": "Count error-level log events grouped by host name",
  "esql": {
    "query": "FROM logs* | WHERE log.level == \"error\" | STATS count = COUNT(*) BY host.name"
  },
  "title": "Error count by host"
}