IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Get Timelines or Timeline templates Get Timeline template by templateTimelineId »

› › ›

Get Timeline or Timeline template by savedObjectId

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Get Timeline or Timeline template by savedObjectId

edit

Retrieves details of a single Timeline or Timeline template using savedObjectId.

Request URL

edit

GET <kibana host>:<port>/api/timeline?id=<savedObjectId>

URL query parameters

edit

Name	Type	Description	Required
`id`	String	The `savedObjectId` of an existing Timeline or Timeline template.	Yes

Example requests

edit

Retrieves details of a Timeline template with the savedObjectId value of 9115e3bc-444c-4c91-b844-c62717253c4e:

GET /api/timeline?id=9115e3bc-444c-4c91-b844-c62717253c4e

Response code

edit

200: Indicates a successful call.

Example response

edit

{
  "data": {
    "getOneTimeline": {
      "savedObjectId": "9115e3bc-444c-4c91-b844-c62717253c4e",
      "version": "WzQwMjYsMV0=",
      "columns": [
        {
          "columnHeaderType": "not-filtered",
          "id": "@timestamp",
          "type": "date"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "signal.rule.name"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "message"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.category"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.action"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "host.name"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "user.name"
        }
      ],
      "dataProviders": [
        {
          "excluded": false,
          "and": [
            {
              "excluded": false,
              "kqlQuery": "",
              "name": "user.name",
              "queryMatch": {
                "displayValue": "{user.name}",
                "field": "user.name",
                "displayField": "user.name",
                "value": "{user.name}",
                "operator": ":"
              },
              "id": "timeline-1-6a1ffe5f-6188-4cf3-915d-e53c2563a1bf",
              "type": "template",
              "enabled": true
            }
          ],
          "kqlQuery": "",
          "name": "signal",
          "queryMatch": {
            "field": "event.kind",
            "value": "signal",
            "operator": ":"
          },
          "id": "timeline-1-ac9b7ab7-0fea-4724-864c-19122139b08f",
          "type": "default",
          "enabled": true
        }
      ],
      "dataViewId": null,
      "description": "",
      "eventType": "all",
      "excludedRowRendererIds": [],
      "favorite": [],
      "filters": [],
      "indexNames": [
        ".alerts-*"
      ],
      "kqlMode": "filter",
      "title": "Alerts Involving a Single User Timeline",
      "templateTimelineId": "3e827bab-838a-469f-bd1e-5e19a2bff2fd",
      "templateTimelineVersion": 1,
      "dateRange": {
        "start": "2024-02-19T15:42:52.325Z",
        "end": "2024-02-20T15:42:52.325Z"
      },
      "savedQueryId": null,
      "created": 1708443772325,
      "createdBy": "Elastic",
      "updated": 1708443772325,
      "updatedBy": "Elastic",
      "timelineType": "template",
      "status": "immutable",
      "sort": [
        {
          "esTypes": [
            "date"
          ],
          "columnType": "date",
          "sortDirection": "desc",
          "columnId": "@timestamp"
        }
      ],
      "eventIdToNoteIds": [],
      "noteIds": [],
      "notes": [],
      "pinnedEventIds": [],
      "pinnedEventsSaveObject": []
    }
  }
}

« Get Timelines or Timeline templates Get Timeline template by templateTimelineId »