Import timelines and timeline templatesedit

Imports timelines and timeline templates from an ndjson file.

The Kibana Console supports only Elasticsearch APIs. You cannot interact with the Kibana APIs with the Console and must use curl or another HTTP tool instead. For more information, refer to Console.

If you are updating an existing timeline template, make sure:

  • You specify the relevant template’s unique ID (templateTimelineId).
  • You increment the timeline’s version number (templateTimelineVersion).

Request URLedit

POST <kibana host>:<port>/api/timeline/_import

The request must include:

  • The Content-Type: multipart/form-data HTTP header.
  • A link to the ndjson file containing the timelines.

For example, using cURL:

curl -X POST "<KibanaURL>/api/timeline/_import"
-u <username>:<password> -H 'kbn-xsrf: true'
-H 'Content-Type: multipart/form-data'
--form "file=@<link to file>" 

The relative link to the ndjson file containing the timelines.

Example requestedit

Imports the rules in the timelines_export.ndjson file:

curl -X POST "api/detection_engine/rules/_import"
-H 'kbn-xsrf: true' -H 'Content-Type: multipart/form-data'
--form "file=@timelines_export.ndjson"

Response codeedit

200
Indicates a successful call.