Timeline schema
A list of JSON elements inside the timeline object.
The Timeline schema lists all the JSON fields and objects required to create a Timeline or a Timeline template using the Create Timeline API.
Important
All column, dropzone, and filter fields must be ECS fields.
This screenshot maps the Timeline UI components to their JSON objects:
- Title (
title
) - Global notes (
globalNotes
) - Data view (
dataViewId
) - KQL bar query (
kqlQuery
) - Time filter (
dateRange
) - Additional filters (
filters
) - KQL bar mode (
kqlMode
) - Dropzone (each clause is contained in its own
dataProviders
object) - Column headers (
columns
) - Event-specific notes (
eventNotes
)
Name | Type | Description |
---|---|---|
columns | The Timeline's columns. | |
created | Float | The time the Timeline was created, using a 13-digit Epoch timestamp. |
createdBy | String | The user who created the Timeline. |
| Object containing dropzone query clauses. | |
dataViewId | String | ID of the Timeline's Data View, for example: |
dateRange | dateRange | The Timeline's search period:
|
description | String | The Timeline's description. |
eventNotes | Notes added to specific events in the Timeline. | |
eventType | String | Event types displayed in the Timeline, which can be:
|
favorite | Indicates when and who marked a Timeline as a favorite. | |
filters | Filters used in addition to the dropzone query. | |
| Global notes added to the Timeline. | |
kqlMode | String | Indicates whether the KQL bar filters the dropzone query results or searches for additional results, where:
|
kqlQuery | KQL bar query. | |
pinnedEventIds | pinnedEventIds[] | IDs of events pinned to the Timeline's search results. |
savedObjectId | String | The Timeline's saved object ID. |
savedQueryId | String | If used, the saved query ID used to filter or search dropzone query results. |
sort | sort | Object indicating how rows are sorted in the Timeline's grid:
|
templateTimelineId | String | A unique ID (UUID) for Timeline templates. For
Timelines, the value is |
templateTimelineVersion | Integer | Timeline template version number. For
Timelines, the value is |
timelineType | String | Indicates whether the Timeline is a template or not, where:
|
title | String | The Timeline's title. |
updated | Float | The last time the Timeline was updated, using a 13-digit Epoch timestamp. |
updatedBy | String | The user who last updated the Timeline. |
version | String | The Timeline's version. |
columns object
Name | Type | Description |
---|---|---|
aggregatable | Boolean | Indicates whether the field can be aggregated across all indices (used to sort columns in the UI). |
category | String | The ECS field set to which the field belongs. |
description | String | UI column field description tooltip. |
example | String | UI column field example tooltip. |
indexes | String | Security indices in which the field exists and has the same
Elasticsearch type. |
id | String | ECS field name, displayed as the column header in the UI. |
type | String | The field's type. |
dataProviders object
Name | Type | Description |
---|---|---|
and | dataProviders[] | Array containing dropzone query clauses using |
enabled | Boolean | Indicates if the dropzone query clause is enabled. |
excluded | Boolean | Indicates if the dropzone query clause uses |
id | String | The dropzone query clause's unique ID. |
name | String | The dropzone query clause's name (the clause's value when Timelines are exported from the UI). |
queryMatch | queryMatch | The dropzone query clause:
|
eventNotes object
Name | Type | Description |
---|---|---|
created | Float | The time the note was created, using a 13-digit Epoch timestamp. |
createdBy | String | The user who added the note. |
eventId | String | The ID of the event to which the note was added. |
note | String | The note's text. |
noteId | String | The note's ID |
timelineId | String | The ID of the Timeline to which the note was added. |
updated | Float | The last time the note was updated, using a 13-digit Epoch timestamp. |
updatedBy | String | The user who last updated the note. |
version | String | The note's version. |
favorite object
Name | Type | Description |
---|---|---|
favoriteDate | Float | The time the Timeline was marked as a favorite, using a 13-digit Epoch timestamp. |
fullName | String | The full name of the user who marked the Timeline as a favorite. |
keySearch | String |
|
userName | String | The username of the user who marked the Timeline as a favorite. |
filters object
Name | Type | Description |
---|---|---|
exists | String | Exists term query for the
specified field ( |
meta | meta | Filter details:
|
match_all | String | Match all term query
for the specified field ( |
query | String | DSL query ( |
range | String | Range query ( |
globalNotes object
Name | Type | Description |
---|---|---|
created | Float | The time the note was created, using a 13-digit Epoch timestamp. |
createdBy | String | The user who added the note. |
note | String | The note's text. |
noteId | String | The note's ID |
timelineId | String | The ID of the Timeline to which the note was added. |
updated | Float | The last time the note was updated, using a 13-digit Epoch timestamp. |
updatedBy | String | The user who last updated the note. |
version | String | The note's version. |
kqlQuery object
Name | Type | Description |
---|---|---|
filterQuery | filterQuery | Object containing query details:
|