Spaces method and path for this operation:
Refer to Spaces for more information.
Creates or updates a stream definition. Classic streams can not be created through this API, only updated
[Required authorization] Route required privileges: manage_stream.
Body
object
-
Additional properties are allowed.
Hide stream attributes Show stream attributes object
-
Additional properties are allowed.
Hide ingest attributes Show ingest attributes object
-
Additional properties are allowed.
Hide processing attributes Show processing attributes object
-
Any of: Grok processor - Extract fields from text using grok patterns
Hide attributes Show attributes
-
Value is
grok. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Source field to parse with grok patterns
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Skip processing when source field is missing
-
Grok patterns applied in order to extract fields
At least
1element. Minimum length of each is1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Dissect processor - Extract fields from text using a lightweight, delimiter-based parser
Hide attributes Show attributes
-
Value is
dissect. -
Separator inserted when target fields are concatenated
Minimum length is
1. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Source field to parse with dissect pattern
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Skip processing when source field is missing
-
Dissect pattern describing field boundaries
Minimum length is
1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Date processor - Parse dates from strings using one or more expected formats
Hide attributes Show attributes
-
Value is
date. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Accepted input date formats, tried in order
Minimum length of each is
1. -
Source field containing the date/time text
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Optional locale for date parsing
Minimum length is
1. -
Optional output format for storing the parsed date as text
Minimum length is
1. -
Optional timezone for date parsing
Minimum length is
1. -
Target field for the parsed date (defaults to source)
Minimum length is
1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Base processor options plus conditional execution
Hide attributes Show attributes
-
Value is
drop_document. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Continue pipeline execution if this processor fails
where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Base processor options plus conditional execution
Hide attributes Show attributes
-
Value is
math. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
A non-empty string.
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
A non-empty string.
Minimum length is
1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Rename processor - Change a field name and optionally its location
Hide attributes Show attributes
-
Value is
rename. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Existing source field to rename or move
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Skip when source field is missing
-
Allow overwriting the target field if it already exists
-
New field name or destination path
Minimum length is
1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Set processor - Assign a literal or copied value to a field (mutually exclusive inputs)
Hide attributes Show attributes
-
Value is
set. -
Copy value from another field instead of providing a literal
Minimum length is
1. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Continue pipeline execution if this processor fails
-
Allow overwriting an existing target field
-
Target field to set or create
Minimum length is
1. -
Literal value to assign to the target field
where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Append processor - Append one or more values to an existing or new array field
Hide attributes Show attributes
-
Value is
append. -
If true, do not deduplicate appended values
-
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Continue pipeline execution if this processor fails
-
Array field to append values to
Minimum length is
1. -
Values to append (must be literal, no templates)
At least
1element. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Remove by prefix processor - Remove a field and all nested fields matching the prefix
Hide attributes Show attributes
-
Value is
remove_by_prefix. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Field to remove along with all its nested fields
Minimum length is
1. -
Continue pipeline execution if this processor fails
Remove processor - Delete one or more fields from the document
Hide attributes Show attributes
-
Value is
remove. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Field to remove from the document
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Skip processing when source field is missing
where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Base processor options plus conditional execution
Hide attributes Show attributes
-
Value is
replace. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
A non-empty string.
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
A non-empty string or string with whitespace.
Minimum length is
1. -
A non-empty string.
Minimum length is
1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Convert processor - Change the data type of a field value (integer, long, double, boolean, or string)
Hide attributes Show attributes
-
Value is
convert. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Source field to convert to a different data type
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Skip processing when source field is missing
-
Target field for the converted value (defaults to source)
Minimum length is
1. -
Target data type: integer, long, double, boolean, or string
Values are
integer,long,double,boolean, orstring. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Manual ingest pipeline wrapper around native Elasticsearch processors
Hide attributes Show attributes
-
Manual ingest pipeline - executes raw Elasticsearch ingest processors
Value is
manual_ingest_pipeline. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Continue pipeline execution if this processor fails
-
Fallback processors to run when a processor fails
Additional properties are allowed.
-
List of raw Elasticsearch ingest processors to run
Additional properties are NOT allowed.
-
Optional ingest processor tag for Elasticsearch
where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Hide attributes Show attributes
condition
object Required Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
-
-
Additional properties are NOT allowed.
Hide settings attributes Show settings attributes object
-
Additional properties are NOT allowed.
-
Additional properties are NOT allowed.
-
Additional properties are NOT allowed.
Hide index.refresh_interval attributes Show index.refresh_interval attributes object
-
-
Additional properties are NOT allowed.
Hide wired attributes Show wired attributes object
-
Hide routing attributes Show routing attributes object
-
A non-empty string.
Minimum length is
1. -
Values are
enabledordisabled. where
object Required The root condition object. It can be a simple filter or a combination of other conditions.
Any of: A condition that compares a field to a value or range using an operator as the key.
Hide attributes Show attributes
-
The document field to filter on.
Minimum length is
1. -
Range comparison values.
Additional properties are NOT allowed.
Hide range attributes Show range attributes object
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
-
-
-
-
Hide queries attributes Show queries attributes object
-
A non-empty string.
Minimum length is
1. -
A non-empty string.
Minimum length is
1. -
Additional properties are NOT allowed.
Hide feature attributes Show feature attributes object
filter
object Required The root condition object. It can be a simple filter or a combination of other conditions.
Any of: A condition that compares a field to a value or range using an operator as the key.
Hide attributes Show attributes
-
The document field to filter on.
Minimum length is
1. -
Range comparison values.
Additional properties are NOT allowed.
Hide range attributes Show range attributes object
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
-
A non-empty string.
Minimum length is
1. -
Value is
system.
-
Additional properties are NOT allowed.
-
-
Additional properties are allowed.
Hide stream attributes Show stream attributes object
-
Additional properties are allowed.
Hide ingest attributes Show ingest attributes object
-
Additional properties are allowed.
Hide processing attributes Show processing attributes object
-
Any of: Grok processor - Extract fields from text using grok patterns
Hide attributes Show attributes
-
Value is
grok. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Source field to parse with grok patterns
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Skip processing when source field is missing
-
Grok patterns applied in order to extract fields
At least
1element. Minimum length of each is1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Dissect processor - Extract fields from text using a lightweight, delimiter-based parser
Hide attributes Show attributes
-
Value is
dissect. -
Separator inserted when target fields are concatenated
Minimum length is
1. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Source field to parse with dissect pattern
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Skip processing when source field is missing
-
Dissect pattern describing field boundaries
Minimum length is
1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Date processor - Parse dates from strings using one or more expected formats
Hide attributes Show attributes
-
Value is
date. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Accepted input date formats, tried in order
Minimum length of each is
1. -
Source field containing the date/time text
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Optional locale for date parsing
Minimum length is
1. -
Optional output format for storing the parsed date as text
Minimum length is
1. -
Optional timezone for date parsing
Minimum length is
1. -
Target field for the parsed date (defaults to source)
Minimum length is
1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Base processor options plus conditional execution
Hide attributes Show attributes
-
Value is
drop_document. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Continue pipeline execution if this processor fails
where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Base processor options plus conditional execution
Hide attributes Show attributes
-
Value is
math. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
A non-empty string.
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
A non-empty string.
Minimum length is
1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Rename processor - Change a field name and optionally its location
Hide attributes Show attributes
-
Value is
rename. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Existing source field to rename or move
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Skip when source field is missing
-
Allow overwriting the target field if it already exists
-
New field name or destination path
Minimum length is
1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Set processor - Assign a literal or copied value to a field (mutually exclusive inputs)
Hide attributes Show attributes
-
Value is
set. -
Copy value from another field instead of providing a literal
Minimum length is
1. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Continue pipeline execution if this processor fails
-
Allow overwriting an existing target field
-
Target field to set or create
Minimum length is
1. -
Literal value to assign to the target field
where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Append processor - Append one or more values to an existing or new array field
Hide attributes Show attributes
-
Value is
append. -
If true, do not deduplicate appended values
-
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Continue pipeline execution if this processor fails
-
Array field to append values to
Minimum length is
1. -
Values to append (must be literal, no templates)
At least
1element. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Remove by prefix processor - Remove a field and all nested fields matching the prefix
Hide attributes Show attributes
-
Value is
remove_by_prefix. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Field to remove along with all its nested fields
Minimum length is
1. -
Continue pipeline execution if this processor fails
Remove processor - Delete one or more fields from the document
Hide attributes Show attributes
-
Value is
remove. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Field to remove from the document
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Skip processing when source field is missing
where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Base processor options plus conditional execution
Hide attributes Show attributes
-
Value is
replace. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
A non-empty string.
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
A non-empty string or string with whitespace.
Minimum length is
1. -
A non-empty string.
Minimum length is
1. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Convert processor - Change the data type of a field value (integer, long, double, boolean, or string)
Hide attributes Show attributes
-
Value is
convert. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Source field to convert to a different data type
Minimum length is
1. -
Continue pipeline execution if this processor fails
-
Skip processing when source field is missing
-
Target field for the converted value (defaults to source)
Minimum length is
1. -
Target data type: integer, long, double, boolean, or string
Values are
integer,long,double,boolean, orstring. where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Manual ingest pipeline wrapper around native Elasticsearch processors
Hide attributes Show attributes
-
Manual ingest pipeline - executes raw Elasticsearch ingest processors
Value is
manual_ingest_pipeline. -
Custom identifier to correlate this processor across outputs
Minimum length is
1. -
Human-readable notes about this processor step
-
Continue pipeline execution if this processor fails
-
Fallback processors to run when a processor fails
Additional properties are allowed.
-
List of raw Elasticsearch ingest processors to run
Additional properties are NOT allowed.
-
Optional ingest processor tag for Elasticsearch
where
object Conditional expression controlling whether this processor runs
Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
Hide attributes Show attributes
condition
object Required Any of: A condition that compares a field to a value or range using an operator as the key.
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
-
-
Additional properties are NOT allowed.
Hide settings attributes Show settings attributes object
-
Additional properties are NOT allowed.
-
Additional properties are NOT allowed.
-
Additional properties are NOT allowed.
Hide index.refresh_interval attributes Show index.refresh_interval attributes object
-
-
Additional properties are NOT allowed.
-
-
-
Hide queries attributes Show queries attributes object
-
A non-empty string.
Minimum length is
1. -
A non-empty string.
Minimum length is
1. -
Additional properties are NOT allowed.
Hide feature attributes Show feature attributes object
filter
object Required The root condition object. It can be a simple filter or a combination of other conditions.
Any of: A condition that compares a field to a value or range using an operator as the key.
Hide attributes Show attributes
-
The document field to filter on.
Minimum length is
1. -
Range comparison values.
Additional properties are NOT allowed.
Hide range attributes Show range attributes object
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
-
A non-empty string.
Minimum length is
1. -
Value is
system.
-
Additional properties are NOT allowed.
-
-
Additional properties are allowed.
Hide stream attributes Show stream attributes object
-
Additional properties are allowed.
-
Additional properties are NOT allowed.
-
-
Hide queries attributes Show queries attributes object
-
A non-empty string.
Minimum length is
1. -
A non-empty string.
Minimum length is
1. -
Additional properties are NOT allowed.
Hide feature attributes Show feature attributes object
filter
object Required The root condition object. It can be a simple filter or a combination of other conditions.
Any of: A condition that compares a field to a value or range using an operator as the key.
Hide attributes Show attributes
-
The document field to filter on.
Minimum length is
1. -
Range comparison values.
Additional properties are NOT allowed.
Hide range attributes Show range attributes object
A condition that checks for the existence or non-existence of a field.
A logical AND that groups multiple conditions.
A logical OR that groups multiple conditions.
A logical NOT that negates a condition.
A condition that always evaluates to false.
-
A non-empty string.
Minimum length is
1. -
Value is
system.
-
Additional properties are NOT allowed.
-
curl \
--request PUT 'https://<KIBANA_URL>/api/streams/{name}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"stream":{"ingest":{"processing":{"steps":[{"action":"grok","customIdentifier":"string","description":"string","from":"string","ignore_failure":true,"ignore_missing":true,"pattern_definitions":{"additionalProperty1":"string","additionalProperty2":"string"},"patterns":["string"],"where":{"field":"string","range":{}}}]},"failure_store":{"inherit":{}},"lifecycle":{"dsl":{"data_retention":"string"}},"settings":{"index.number_of_replicas":{"value":42.0},"index.number_of_shards":{"value":42.0},"index.refresh_interval":{"value":"string"}},"wired":{"fields":{},"routing":[{"destination":"string","status":"enabled","where":{"contains":"string","endsWith":"string","eq":"string","field":"string","gt":"string","gte":"string","lt":"string","lte":"string","neq":"string","range":{"gt":"string","gte":"string","lt":"string","lte":"string"},"startsWith":"string"}}]}},"description":"string"},"dashboards":["string"],"queries":[{"id":"string","title":"string","evidence":["string"],"feature":{"filter":{"contains":"string","endsWith":"string","eq":"string","field":"string","gt":"string","gte":"string","lt":"string","lte":"string","neq":"string","range":{"gt":"string","gte":"string","lt":"string","lte":"string"},"startsWith":"string"},"name":"string","type":"system"},"kql":{"query":"string"},"severity_score":42.0}],"rules":["string"]}'