---
type: api
title: Install prepackaged Timelines
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-installprepackedtimelines
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/operation/operation-installprepackedtimelines
products:
  - Kibana
---

# Install prepackaged Timelines

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/timeline/_prepackaged`
- `POST` `/s/{space_id}/api/timeline/_prepackaged`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana-serverless/authentication#apikeyauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Install or update prepackaged Timelines.

## Request Body

`application/json`

The Timelines to install or update.

- `prepackagedTimelines` ([] object) — required
  - `columns` ([] object) — optional — nullable
    The Timeline's columns
    - `aggregatable` (boolean) — optional — nullable
    - `category` (string) — optional — nullable
    - `columnHeaderType` (string) — optional — nullable
    - `description` (string) — optional — nullable
    - `example` (string) — optional — nullable
    - `id` (string) — optional — nullable
    - `indexes` ([] string) — optional — nullable
    - `name` (string) — optional — nullable
    - `placeholder` (string) — optional — nullable
    - `searchable` (boolean) — optional — nullable
    - `type` (string) — optional — nullable
  - `created` (number) — optional — nullable
    The time the Timeline was created, using a 13-digit Epoch timestamp.
  - `createdBy` (string) — optional — nullable
    The user who created the Timeline.
  - `dataProviders` ([] object) — optional — nullable
    Object containing query clauses
    - `and` ([] object) — optional — nullable
      - `enabled` (boolean) — optional — nullable
      - `excluded` (boolean) — optional — nullable
      - `id` (string) — optional — nullable
      - `kqlQuery` (string) — optional — nullable
      - `name` (string) — optional — nullable
      - `queryMatch` ({}) — optional
        - `displayField` (string) — optional — nullable
        - `displayValue` (string) — optional — nullable
        - `field` (string) — optional — nullable
        - `operator` (string) — optional — nullable
        - `value` (union string | [] string) — optional — nullable
      - `type` (enum) — optional
        The type of data provider.
        Values: `default`, `template`
    - `enabled` (boolean) — optional — nullable
    - `excluded` (boolean) — optional — nullable
    - `id` (string) — optional — nullable
    - `kqlQuery` (string) — optional — nullable
    - `name` (string) — optional — nullable
    - `queryMatch` ({}) — optional
      - `displayField` (string) — optional — nullable
      - `displayValue` (string) — optional — nullable
      - `field` (string) — optional — nullable
      - `operator` (string) — optional — nullable
      - `value` (union string | [] string) — optional — nullable
    - `type` (enum) — optional
      The type of data provider.
      Values: `default`, `template`
  - `dataViewId` (string) — optional — nullable
    ID of the Timeline's Data View
  - `dateRange` (object) — optional — nullable
    The Timeline's search period.
    - `end` (union string | number) — optional — nullable
    - `start` (union string | number) — optional — nullable
  - `description` (string) — optional — nullable
    The Timeline's description
  - `eqlOptions` (object) — optional — nullable
    EQL query that is used in the correlation tab
    - `eventCategoryField` (string) — optional — nullable
    - `query` (string) — optional — nullable
    - `size` (union string | number) — optional — nullable
    - `tiebreakerField` (string) — optional — nullable
    - `timestampField` (string) — optional — nullable
  - `eventType` (string) — optional — nullable — deprecated
    Event types displayed in the Timeline
  - `excludedRowRendererIds` ([] enum) — optional — nullable
    A list of row renderers that should not be used when in `Event renderers` mode
    Values: `alert`, `alerts`, `auditd`, `auditd_file`, `library`, `netflow`, `plain`, `registry`, `suricata`, `system`, `system_dns`, `system_endgame_process`, `system_file`, `system_fim`, `system_security_event`, `system_socket`, `threat_match`, `zeek`
  - `favorite` ([] object) — optional — nullable
    - `favoriteDate` (number) — optional — nullable
    - `fullName` (string) — optional — nullable
    - `userName` (string) — optional — nullable
  - `filters` ([] object) — optional — nullable
    A list of filters that should be applied to the query
    - `exists` (string) — optional — nullable
    - `match_all` (string) — optional — nullable
    - `meta` (object) — optional — nullable
      - `alias` (string) — optional — nullable
      - `controlledBy` (string) — optional — nullable
      - `disabled` (boolean) — optional — nullable
      - `field` (string) — optional — nullable
      - `formattedValue` (string) — optional — nullable
      - `index` (string) — optional — nullable
      - `key` (string) — optional — nullable
      - `negate` (boolean) — optional — nullable
      - `params` (string) — optional — nullable
      - `type` (string) — optional — nullable
      - `value` (string) — optional — nullable
    - `missing` (string) — optional — nullable
    - `query` (string) — optional — nullable
    - `range` (string) — optional — nullable
    - `script` (string) — optional — nullable
  - `indexNames` ([] string) — optional — nullable
    A list of index names to use in the query (e.g. when the default data view has been modified)
  - `kqlMode` (string) — optional — nullable
    Indicates whether the KQL bar filters the query results or searches for additional results, where:
  * `filter`: filters query results
  * `search`: displays additional search results
  - `kqlQuery` ({}) — optional
    KQL bar query.
    - `filterQuery` (object) — optional — nullable
      - `kuery` (object) — optional — nullable
        - `expression` (string) — optional — nullable
        - `kind` (string) — optional — nullable
      - `serializedQuery` (string) — optional — nullable
  - `savedQueryId` (string) — optional — nullable
    The ID of the saved query that might be used in the Query tab
  - `savedSearchId` (string) — optional — nullable
    The ID of the saved search that is used in the ES|QL tab
  - `sort` (union) — optional
    `SortObject` or `SortObject[]`
    - `columnId` (string) — optional — nullable
    - `columnType` (string) — optional — nullable
    - `sortDirection` (string) — optional — nullable
  - `status` (enum) — optional
    The status of the Timeline.
    Values: `active`, `draft`, `immutable`
  - `templateTimelineId` (string) — optional — nullable
    A unique ID (UUID) for Timeline templates. For Timelines, the value is `null`.
  - `templateTimelineVersion` (number) — optional — nullable
    Timeline template version number. For Timelines, the value is `null`.
  - `timelineType` (enum) — optional
    The type of Timeline.
    Values: `default`, `template`
  - `title` (string) — optional — nullable
    The Timeline's title.
  - `updated` (number) — optional — nullable
    The last time the Timeline was updated, using a 13-digit Epoch timestamp
  - `updatedBy` (string) — optional — nullable
    The user who last updated the Timeline
  - `eventIdToNoteIds` ([] object) — optional — nullable
    - `created` (number) — optional — nullable
      The time the note was created, using a 13-digit Epoch timestamp.
    - `createdBy` (string) — optional — nullable
      The user who created the note.
    - `updated` (number) — optional — nullable
      The last time the note was updated, using a 13-digit Epoch timestamp
    - `updatedBy` (string) — optional — nullable
      The user who last updated the note
    - `eventId` (string) — optional — nullable
      Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.
    - `note` (string) — optional — nullable
      The text of the note
    - `timelineId` (string) — required
      The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
    - `noteId` (string) — required
      The `savedObjectId` of the note
    - `version` (string) — required
      The version of the note
  - `noteIds` ([] string) — optional — nullable
  - `notes` ([] object) — optional — nullable
    - `created` (number) — optional — nullable
      The time the note was created, using a 13-digit Epoch timestamp.
    - `createdBy` (string) — optional — nullable
      The user who created the note.
    - `updated` (number) — optional — nullable
      The last time the note was updated, using a 13-digit Epoch timestamp
    - `updatedBy` (string) — optional — nullable
      The user who last updated the note
    - `eventId` (string) — optional — nullable
      Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.
    - `note` (string) — optional — nullable
      The text of the note
    - `timelineId` (string) — required
      The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
    - `noteId` (string) — required
      The `savedObjectId` of the note
    - `version` (string) — required
      The version of the note
  - `pinnedEventIds` ([] string) — optional — nullable
  - `pinnedEventsSaveObject` ([] object) — optional — nullable
    - `created` (number) — optional — nullable
      The time the pinned event was created, using a 13-digit Epoch timestamp.
    - `createdBy` (string) — optional — nullable
      The user who created the pinned event.
    - `updated` (number) — optional — nullable
      The last time the pinned event was updated, using a 13-digit Epoch timestamp
    - `updatedBy` (string) — optional — nullable
      The user who last updated the pinned event
    - `eventId` (string) — required
      The `_id` of the associated event for this pinned event.
    - `timelineId` (string) — required
      The `savedObjectId` of the timeline that this pinned event is associated with
    - `pinnedEventId` (string) — required
      The `savedObjectId` of this pinned event
    - `version` (string) — required
      The version of this pinned event
  - `savedObjectId` (string) — required
  - `version` (string) — required
- `timelinesToInstall` ([] object) — required
  - `columns` ([] object) — optional — nullable
    The Timeline's columns
    Same fields as `columns` in `prepackagedTimelines`
  - `created` (number) — optional — nullable
    The time the Timeline was created, using a 13-digit Epoch timestamp.
  - `createdBy` (string) — optional — nullable
    The user who created the Timeline.
  - `dataProviders` ([] object) — optional — nullable
    Object containing query clauses
    Same fields as `dataProviders` in `prepackagedTimelines`
  - `dataViewId` (string) — optional — nullable
    ID of the Timeline's Data View
  - `dateRange` (object) — optional — nullable
    The Timeline's search period.
    - `end` (union string | number) — optional — nullable
    - `start` (union string | number) — optional — nullable
  - `description` (string) — optional — nullable
    The Timeline's description
  - `eqlOptions` (object) — optional — nullable
    EQL query that is used in the correlation tab
    - `eventCategoryField` (string) — optional — nullable
    - `query` (string) — optional — nullable
    - `size` (union string | number) — optional — nullable
    - `tiebreakerField` (string) — optional — nullable
    - `timestampField` (string) — optional — nullable
  - `eventType` (string) — optional — nullable — deprecated
    Event types displayed in the Timeline
  - `excludedRowRendererIds` ([] enum) — optional — nullable
    A list of row renderers that should not be used when in `Event renderers` mode
    Values: `alert`, `alerts`, `auditd`, `auditd_file`, `library`, `netflow`, `plain`, `registry`, `suricata`, `system`, `system_dns`, `system_endgame_process`, `system_file`, `system_fim`, `system_security_event`, `system_socket`, `threat_match`, `zeek`
  - `favorite` ([] object) — optional — nullable
    - `favoriteDate` (number) — optional — nullable
    - `fullName` (string) — optional — nullable
    - `userName` (string) — optional — nullable
  - `filters` ([] object) — optional — nullable
    A list of filters that should be applied to the query
    Same fields as `filters` in `prepackagedTimelines`
  - `indexNames` ([] string) — optional — nullable
    A list of index names to use in the query (e.g. when the default data view has been modified)
  - `kqlMode` (string) — optional — nullable
    Indicates whether the KQL bar filters the query results or searches for additional results, where:
  * `filter`: filters query results
  * `search`: displays additional search results
  - `kqlQuery` ({}) — optional
    KQL bar query.
    - `filterQuery` (object) — optional — nullable
      - `kuery` (object) — optional — nullable
        - `expression` (string) — optional — nullable
        - `kind` (string) — optional — nullable
      - `serializedQuery` (string) — optional — nullable
  - `savedQueryId` (string) — optional — nullable
    The ID of the saved query that might be used in the Query tab
  - `savedSearchId` (string) — optional — nullable
    The ID of the saved search that is used in the ES|QL tab
  - `sort` (union) — optional
    `SortObject` or `SortObject[]`
    - `columnId` (string) — optional — nullable
    - `columnType` (string) — optional — nullable
    - `sortDirection` (string) — optional — nullable
  - `status` (enum) — optional
    The status of the Timeline.
    Values: `active`, `draft`, `immutable`
  - `templateTimelineId` (string) — optional — nullable
    A unique ID (UUID) for Timeline templates. For Timelines, the value is `null`.
  - `templateTimelineVersion` (number) — optional — nullable
    Timeline template version number. For Timelines, the value is `null`.
  - `timelineType` (enum) — optional
    The type of Timeline.
    Values: `default`, `template`
  - `title` (string) — optional — nullable
    The Timeline's title.
  - `updated` (number) — optional — nullable
    The last time the Timeline was updated, using a 13-digit Epoch timestamp
  - `updatedBy` (string) — optional — nullable
    The user who last updated the Timeline
  - `eventNotes` ([] object) — required — nullable
    - `created` (number) — optional — nullable
      The time the note was created, using a 13-digit Epoch timestamp.
    - `createdBy` (string) — optional — nullable
      The user who created the note.
    - `updated` (number) — optional — nullable
      The last time the note was updated, using a 13-digit Epoch timestamp
    - `updatedBy` (string) — optional — nullable
      The user who last updated the note
    - `eventId` (string) — optional — nullable
      Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.
    - `note` (string) — optional — nullable
      The text of the note
    - `timelineId` (string) — required
      The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
  - `globalNotes` ([] object) — required — nullable
    - `created` (number) — optional — nullable
      The time the note was created, using a 13-digit Epoch timestamp.
    - `createdBy` (string) — optional — nullable
      The user who created the note.
    - `updated` (number) — optional — nullable
      The last time the note was updated, using a 13-digit Epoch timestamp
    - `updatedBy` (string) — optional — nullable
      The user who last updated the note
    - `eventId` (string) — optional — nullable
      Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.
    - `note` (string) — optional — nullable
      The text of the note
    - `timelineId` (string) — required
      The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
  - `pinnedEventIds` ([] string) — required — nullable
  - `savedObjectId` (string) — required — nullable
  - `version` (string) — required — nullable
- `timelinesToUpdate` ([] object) — required
  Same fields as `timelinesToInstall`

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `errors` ([] object)
  The list of failed Timeline imports
  - `error` (object)
    The error containing the reason why the timeline could not be imported
    - `message` (string)
      The reason why the timeline could not be imported
    - `status_code` (number)
      The HTTP status code of the error
  - `id` (string)
    The ID of the timeline that failed to import
- `success` (boolean)
  Indicates whether any of the Timelines were successfully imports
- `success_count` (number)
  The amount of successfully imported/updated Timelines
- `timelines_installed` (number)
  The amount of successfully installed Timelines
- `timelines_updated` (number)
  The amount of successfully updated Timelines
#### `500`

Indicates the installation of prepackaged Timelines was unsuccessful.

`application/json`

- `body` (string)
- `statusCode` (number)
## Code Examples

#### Console

```console
POST /api/timeline/_prepackaged
{
  "prepackagedTimelines": [],
  "timelinesToInstall": [],
  "timelinesToUpdate": []
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/timeline/_prepackaged" \
  -H "Content-Type: application/json" \
  -d '{
  "prepackagedTimelines": [],
  "timelinesToInstall": [],
  "timelinesToUpdate": []
}'
```

## Response Examples

#### Install result counts

```json
{
  "errors": [],
  "success": true,
  "success_count": 10,
  "timelines_installed": 8,
  "timelines_updated": 2
}
```

#### Server error

```json
{
  "body": "Internal error",
  "statusCode": 500
}
```