Resolve a Timeline or Timeline template
https://{kibana_url}
- GET /api/timeline/resolve
Resolve a Timeline or Timeline template, surfacing outcomes such as exactMatch, aliasMatch, or conflict when object IDs have been remapped during upgrades or imports. Provide either id for default Timelines or template_timeline_id for templates.
Query Parameters
-
template_timeline_idstring The ID of the template timeline to resolve
-
idstring The ID of the timeline to resolve
Responses
Indicates a successful call.
-
alias_purpose -
Values:
savedObjectConversionsavedObjectImport -
alias_target_idstring -
outcomerequired -
Values:
exactMatchaliasMatchconflict -
timelinerequired -
columnsobjectnullable -
The Timeline's columns
-
aggregatablebooleannullable -
categorystringnullable -
columnHeaderTypestringnullable -
descriptionstringnullable -
examplestringnullable -
idstringnullable -
indexesstringnullable -
namestringnullable -
placeholderstringnullable -
searchablebooleannullable -
typestringnullable -
creatednumbernullable -
The time the Timeline was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the Timeline.
-
dataProvidersobjectnullable -
Object containing query clauses
-
andobjectnullable -
enabledbooleannullable -
excludedbooleannullable -
idstringnullable -
kqlQuerystringnullable -
namestringnullable -
queryMatch -
displayFieldstringnullable -
displayValuestringnullable -
fieldstringnullable -
operatorstringnullable -
valuestring | stringnullable -
enabledbooleannullable -
excludedbooleannullable -
idstringnullable -
kqlQuerystringnullable -
namestringnullable -
queryMatch -
displayFieldstringnullable -
displayValuestringnullable -
fieldstringnullable -
operatorstringnullable -
valuestring | stringnullable -
dataViewIdstringnullable -
ID of the Timeline's Data View
-
dateRangeobjectnullable -
The Timeline's search period.
-
descriptionstringnullable -
The Timeline's description
-
eqlOptionsobjectnullable -
EQL query that is used in the correlation tab
-
eventCategoryFieldstringnullable -
querystringnullable -
sizestring | numbernullable -
tiebreakerFieldstringnullable -
timestampFieldstringnullable -
eventTypestringnullable deprecated -
Event types displayed in the Timeline
-
excludedRowRendererIdsnullable -
A list of row renderers that should not be used when in
Event renderersmode -
Values:
alertalertsauditdauditd_filelibrarynetflowplainregistrysuricatasystemsystem_dnssystem_endgame_processsystem_filesystem_fimsystem_security_eventsystem_socketthreat_matchzeek -
favoriteobjectnullable -
favoriteDatenumbernullable -
fullNamestringnullable -
userNamestringnullable -
indexNamesstringnullable -
A list of index names to use in the query (e.g. when the default data view has been modified)
-
kqlModestringnullable -
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query resultssearch: displays additional search results
-
kqlQuery -
KQL bar query.
-
filterQueryobjectnullable -
kueryobjectnullable -
expressionstringnullable -
kindstringnullable -
serializedQuerystringnullable -
savedQueryIdstringnullable -
The ID of the saved query that might be used in the Query tab
-
savedSearchIdstringnullable -
The ID of the saved search that is used in the ES|QL tab
-
sort -
columnIdstringnullable -
columnTypestringnullable -
sortDirectionstringnullable -
templateTimelineIdstringnullable -
A unique ID (UUID) for Timeline templates. For Timelines, the value is
null. -
templateTimelineVersionnumbernullable -
Timeline template version number. For Timelines, the value is
null. -
titlestringnullable -
The Timeline's title.
-
updatednumbernullable -
The last time the Timeline was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the Timeline
-
eventIdToNoteIdsobjectnullable -
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
Elasticsearch document
_idfor the event or alert this note refers to. Same value as thedocumentIdsquery parameter when fetching notes via GET /api/note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline this note belongs to (not the note's own ID). -
noteIdstringrequired -
The
savedObjectIdof the note -
versionstringrequired -
The version of the note
-
noteIdsstringnullable -
notesobjectnullable -
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
Elasticsearch document
_idfor the event or alert this note refers to. Same value as thedocumentIdsquery parameter when fetching notes via GET /api/note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline this note belongs to (not the note's own ID). -
noteIdstringrequired -
The
savedObjectIdof the note -
versionstringrequired -
The version of the note
-
pinnedEventIdsstringnullable -
pinnedEventsSaveObjectobjectnullable -
creatednumbernullable -
The time the pinned event was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the pinned event.
-
updatednumbernullable -
The last time the pinned event was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the pinned event
-
eventIdstringrequired -
The
_idof the associated event for this pinned event. -
timelineIdstringrequired -
The
savedObjectIdof the timeline that this pinned event is associated with -
pinnedEventIdstringrequired -
The
savedObjectIdof this pinned event -
versionstringrequired -
The version of this pinned event
-
savedObjectIdstringrequired -
versionstringrequired
Bad Request response.
Response Type: object
The (template) Timeline was not found
Response Type: object