IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

« Timeline API Get Timeline or Timeline template by savedObjectId »

› › ›

Get Timelines or Timeline templates

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Get Timelines or Timeline templates

edit

Retrieves a list of all Timelines or Timeline templates.

Request URL

edit

GET <kibana host>:<port>/api/timelines

URL query parameters

edit

Name	Type	Description	Required
`only_user_favorite`	Boolean	If set to `true`, returns only favorite Timelines / Timeline templates. Defaults to `false`.	No
`page_index`	Number	The page number to return. Defaults to `1`.	No
`page_size`	Number	The number of items to return per page. Defaults to `10`.	No
`search`	String	The keyword in the Timeline / Timeline template title or description to filter the results by.	No
`sort_field`	String	The field to sort the results by. Valid values are: `title` `description` `updated` `created`	No
`sort_order`	String	The order to sort the results in. Valid values are: `asc` `desc`	No
`status`	String	Defines whether to return custom Timeline / Timeline templates or Elastic prebuilt templates. Valid values are: `active`: Returns custom Timelines / Timeline templates `immutable`: Returns Elastic prebuilt templates	No
`timeline_type`	String	Defines whether to return Timelines or Timeline templates. Valid values are: `default`: Returns Timelines `template`: Returns Timeline templates	No

Example requests

edit

Retrieves a list of all Timelines, sorted by the updated field in descending order:

GET api/timelines?page_size=10&page_index=1&sort_field=updated&sort_order=desc&timeline_type=default

Response code

edit

200: Indicates a successful call.

Example response

edit

{
  "totalCount": 2,
  "timeline": [
    {
      "savedObjectId": "a3f145ed-262f-488d-b550-334fb16fc4d5",
      "version": "WzEyMTQzLDFd",
      "columns": [
        {
          "columnHeaderType": "not-filtered",
          "id": "@timestamp",
          "type": "date"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "message"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.category"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.action"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "host.name"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "source.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "destination.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "user.name"
        }
      ],
      "dataProviders": [],
      "dataViewId": "security-solution-default",
      "description": "",
      "eqlOptions": {
        "eventCategoryField": "event.category",
        "tiebreakerField": "",
        "timestampField": "@timestamp",
        "query": "",
        "size": 100
      },
      "eventType": "all",
      "excludedRowRendererIds": [],
      "favorite": [],
      "filters": [],
      "indexNames": [
        ".alerts-security.alerts-default",
        "logs-*"
      ],
      "kqlMode": "filter",
      "kqlQuery": {
        "filterQuery": null
      },
      "title": "Another timeline",
      "templateTimelineId": null,
      "templateTimelineVersion": null,
      "dateRange": {
        "start": "2023-12-08T00:00:00.000Z",
        "end": "2024-03-07T11:10:21.475Z"
      },
      "savedQueryId": null,
      "created": 1709810442736,
      "createdBy": "docsuser",
      "updated": 1709810443384,
      "updatedBy": "docsuser",
      "timelineType": "default",
      "status": "active",
      "sort": [
        {
          "columnId": "@timestamp",
          "columnType": "date",
          "esTypes": [
            "date"
          ],
          "sortDirection": "desc"
        }
      ],
      "savedSearchId": null,
      "eventIdToNoteIds": [],
      "noteIds": [],
      "notes": [],
      "pinnedEventIds": [],
      "pinnedEventsSaveObject": []
    },
    {
      "savedObjectId": "cbe6c180-7ef9-414b-b362-748ff7d96b1b",
      "version": "WzEyMTQxLDFd",
      "columns": [
        {
          "columnHeaderType": "not-filtered",
          "id": "@timestamp",
          "type": "date"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "message"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.category"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.action"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "host.name"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "source.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "destination.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "user.name"
        }
      ],
      "dataProviders": [
        {
          "and": [],
          "id": "send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-alert-id-493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584",
          "name": "493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584",
          "enabled": true,
          "excluded": false,
          "kqlQuery": "",
          "queryMatch": {
            "field": "_id",
            "value": "493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584",
            "operator": ":"
          }
        }
      ],
      "dataViewId": null,
      "description": "",
      "eqlOptions": {
        "eventCategoryField": "event.category",
        "tiebreakerField": "",
        "timestampField": "@timestamp",
        "query": "",
        "size": 100
      },
      "eventType": "all",
      "excludedRowRendererIds": [],
      "favorite": [],
      "filters": [],
      "indexNames": [],
      "kqlMode": "filter",
      "kqlQuery": {
        "filterQuery": {
          "kuery": {
            "kind": "kuery",
            "expression": ""
          },
          "serializedQuery": ""
        }
      },
      "title": "Test timeline",
      "templateTimelineId": null,
      "templateTimelineVersion": null,
      "dateRange": {
        "start": "2024-02-20T15:36:41.196Z",
        "end": "2024-02-20T15:46:41.196Z"
      },
      "savedQueryId": null,
      "created": 1709809866827,
      "createdBy": "docsuser",
      "updated": 1709809868011,
      "updatedBy": "docsuser",
      "timelineType": "default",
      "status": "active",
      "sort": [
        {
          "columnId": "@timestamp",
          "columnType": "date",
          "esTypes": [
            "date"
          ],
          "sortDirection": "desc"
        }
      ],
      "savedSearchId": null,
      "eventIdToNoteIds": [],
      "noteIds": [],
      "notes": [],
      "pinnedEventIds": [],
      "pinnedEventsSaveObject": []
    }
  ],
  "defaultTimelineCount": 2,
  "templateTimelineCount": 10,
  "elasticTemplateTimelineCount": 10,
  "customTemplateTimelineCount": 0,
  "favoriteCount": 0
}

« Timeline API Get Timeline or Timeline template by savedObjectId »