You are looking at preliminary documentation for a future release. Not what you want? See the current release documentation.
Elastic Docs ›Elastic Security Solution [master] ›Elastic Security APIs ›Timeline API
« Timeline API Get Timeline or Timeline template by savedObjectId »

Get Timelines or Timeline templatesedit

Retrieves a list of all Timelines or Timeline templates.

Request URLedit

GET <kibana host>:<port>/api/timelines

URL query parametersedit

Name Type Description Required

only_user_favorite

Boolean

If set to true, returns only favorite Timelines / Timeline templates. Defaults to false.

No

page_index

Number

The page number to return. Defaults to 1.

No

page_size

Number

The number of items to return per page. Defaults to 10.

No

search

String

The keyword in the Timeline / Timeline template title or description to filter the results by.

No

sort_field

String

The field to sort the results by. Valid values are:

  • title
  • description
  • updated
  • created

No

sort_order

String

The order to sort the results in. Valid values are:

  • asc
  • desc

No

status

String

Defines whether to return custom Timeline / Timeline templates or Elastic prebuilt templates. Valid values are:

  • active: Returns custom Timelines / Timeline templates
  • immutable: Returns Elastic prebuilt templates

No

timeline_type

String

Defines whether to return Timelines or Timeline templates. Valid values are:

  • default: Returns Timelines
  • template: Returns Timeline templates

No

Example requestsedit

Retrieves a list of all Timelines, sorted by the updated field in descending order:

GET api/timelines?page_size=10&page_index=1&sort_field=updated&sort_order=desc&timeline_type=default

Response codeedit

200
Indicates a successful call.

Example responseedit

{
  "totalCount": 2,
  "timeline": [
    {
      "savedObjectId": "a3f145ed-262f-488d-b550-334fb16fc4d5",
      "version": "WzEyMTQzLDFd",
      "columns": [
        {
          "columnHeaderType": "not-filtered",
          "id": "@timestamp",
          "type": "date"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "message"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.category"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.action"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "host.name"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "source.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "destination.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "user.name"
        }
      ],
      "dataProviders": [],
      "dataViewId": "security-solution-default",
      "description": "",
      "eqlOptions": {
        "eventCategoryField": "event.category",
        "tiebreakerField": "",
        "timestampField": "@timestamp",
        "query": "",
        "size": 100
      },
      "eventType": "all",
      "excludedRowRendererIds": [],
      "favorite": [],
      "filters": [],
      "indexNames": [
        ".alerts-security.alerts-default",
        "logs-*"
      ],
      "kqlMode": "filter",
      "kqlQuery": {
        "filterQuery": null
      },
      "title": "Another timeline",
      "templateTimelineId": null,
      "templateTimelineVersion": null,
      "dateRange": {
        "start": "2023-12-08T00:00:00.000Z",
        "end": "2024-03-07T11:10:21.475Z"
      },
      "savedQueryId": null,
      "created": 1709810442736,
      "createdBy": "docsuser",
      "updated": 1709810443384,
      "updatedBy": "docsuser",
      "timelineType": "default",
      "status": "active",
      "sort": [
        {
          "columnId": "@timestamp",
          "columnType": "date",
          "esTypes": [
            "date"
          ],
          "sortDirection": "desc"
        }
      ],
      "savedSearchId": null,
      "eventIdToNoteIds": [],
      "noteIds": [],
      "notes": [],
      "pinnedEventIds": [],
      "pinnedEventsSaveObject": []
    },
    {
      "savedObjectId": "cbe6c180-7ef9-414b-b362-748ff7d96b1b",
      "version": "WzEyMTQxLDFd",
      "columns": [
        {
          "columnHeaderType": "not-filtered",
          "id": "@timestamp",
          "type": "date"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "message"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.category"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.action"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "host.name"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "source.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "destination.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "user.name"
        }
      ],
      "dataProviders": [
        {
          "and": [],
          "id": "send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-alert-id-493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584",
          "name": "493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584",
          "enabled": true,
          "excluded": false,
          "kqlQuery": "",
          "queryMatch": {
            "field": "_id",
            "value": "493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584",
            "operator": ":"
          }
        }
      ],
      "dataViewId": null,
      "description": "",
      "eqlOptions": {
        "eventCategoryField": "event.category",
        "tiebreakerField": "",
        "timestampField": "@timestamp",
        "query": "",
        "size": 100
      },
      "eventType": "all",
      "excludedRowRendererIds": [],
      "favorite": [],
      "filters": [],
      "indexNames": [],
      "kqlMode": "filter",
      "kqlQuery": {
        "filterQuery": {
          "kuery": {
            "kind": "kuery",
            "expression": ""
          },
          "serializedQuery": ""
        }
      },
      "title": "Test timeline",
      "templateTimelineId": null,
      "templateTimelineVersion": null,
      "dateRange": {
        "start": "2024-02-20T15:36:41.196Z",
        "end": "2024-02-20T15:46:41.196Z"
      },
      "savedQueryId": null,
      "created": 1709809866827,
      "createdBy": "docsuser",
      "updated": 1709809868011,
      "updatedBy": "docsuser",
      "timelineType": "default",
      "status": "active",
      "sort": [
        {
          "columnId": "@timestamp",
          "columnType": "date",
          "esTypes": [
            "date"
          ],
          "sortDirection": "desc"
        }
      ],
      "savedSearchId": null,
      "eventIdToNoteIds": [],
      "noteIds": [],
      "notes": [],
      "pinnedEventIds": [],
      "pinnedEventsSaveObject": []
    }
  ],
  "defaultTimelineCount": 2,
  "templateTimelineCount": 10,
  "elasticTemplateTimelineCount": 10,
  "customTemplateTimelineCount": 0,
  "favoriteCount": 0
}
« Timeline API Get Timeline or Timeline template by savedObjectId »