Create a clean draft Timeline or Timeline template
https://{kibana_url}
- POST /api/timeline/_draft
- POST /s/{space_id}/api/timeline/_draft
Refer to Spaces for more information.
Create a clean draft Timeline or Timeline template for the current user.
info If the user already has a draft Timeline, the existing draft Timeline is cleared and returned.
Request
The type of Timeline to create. Valid values are default and template.
Responses
Indicates that the draft Timeline was successfully created. In the event the user already has a draft Timeline, the existing draft Timeline is cleared and returned.
-
dataobjectrequired -
persistTimelineobjectrequired -
timelinerequired -
columnsobjectnullable -
The Timeline's columns
-
aggregatablebooleannullable -
categorystringnullable -
columnHeaderTypestringnullable -
descriptionstringnullable -
examplestringnullable -
idstringnullable -
indexesstringnullable -
namestringnullable -
placeholderstringnullable -
searchablebooleannullable -
typestringnullable -
creatednumbernullable -
The time the Timeline was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the Timeline.
-
dataProvidersobjectnullable -
Object containing query clauses
-
andobjectnullable -
enabledbooleannullable -
excludedbooleannullable -
idstringnullable -
kqlQuerystringnullable -
namestringnullable -
queryMatch -
displayFieldstringnullable -
displayValuestringnullable -
fieldstringnullable -
operatorstringnullable -
valuestring | stringnullable -
enabledbooleannullable -
excludedbooleannullable -
idstringnullable -
kqlQuerystringnullable -
namestringnullable -
queryMatch -
displayFieldstringnullable -
displayValuestringnullable -
fieldstringnullable -
operatorstringnullable -
valuestring | stringnullable -
dataViewIdstringnullable -
ID of the Timeline's Data View
-
dateRangeobjectnullable -
The Timeline's search period.
-
descriptionstringnullable -
The Timeline's description
-
eqlOptionsobjectnullable -
EQL query that is used in the correlation tab
-
eventCategoryFieldstringnullable -
querystringnullable -
sizestring | numbernullable -
tiebreakerFieldstringnullable -
timestampFieldstringnullable -
eventTypestringnullable deprecated -
Event types displayed in the Timeline
-
excludedRowRendererIdsnullable -
A list of row renderers that should not be used when in
Event renderersmode -
Values:
alertalertsauditdauditd_filelibrarynetflowplainregistrysuricatasystemsystem_dnssystem_endgame_processsystem_filesystem_fimsystem_security_eventsystem_socketthreat_matchzeek -
favoriteobjectnullable -
favoriteDatenumbernullable -
fullNamestringnullable -
userNamestringnullable -
indexNamesstringnullable -
A list of index names to use in the query (e.g. when the default data view has been modified)
-
kqlModestringnullable -
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query resultssearch: displays additional search results
-
kqlQuery -
KQL bar query.
-
filterQueryobjectnullable -
kueryobjectnullable -
expressionstringnullable -
kindstringnullable -
serializedQuerystringnullable -
savedQueryIdstringnullable -
The ID of the saved query that might be used in the Query tab
-
savedSearchIdstringnullable -
The ID of the saved search that is used in the ES|QL tab
-
sort -
columnIdstringnullable -
columnTypestringnullable -
sortDirectionstringnullable -
templateTimelineIdstringnullable -
A unique ID (UUID) for Timeline templates. For Timelines, the value is
null. -
templateTimelineVersionnumbernullable -
Timeline template version number. For Timelines, the value is
null. -
titlestringnullable -
The Timeline's title.
-
updatednumbernullable -
The last time the Timeline was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the Timeline
-
savedObjectIdstringrequired -
The
savedObjectIdof the Timeline or Timeline template -
versionstringrequired -
The version of the Timeline or Timeline template
-
eventIdToNoteIdsobjectnullable -
A list of all the notes that are associated to this Timeline.
-
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
The
_idof the associated event for this note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline that this note is associated with -
noteIdstringrequired -
The
savedObjectIdof the note -
versionstringrequired -
The version of the note
-
noteIdsstringnullable -
A list of all the ids of notes that are associated to this Timeline.
-
notesobjectnullable -
A list of all the notes that are associated to this Timeline.
-
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
The
_idof the associated event for this note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline that this note is associated with -
noteIdstringrequired -
The
savedObjectIdof the note -
versionstringrequired -
The version of the note
-
pinnedEventIdsstringnullable -
A list of all the ids of pinned events that are associated to this Timeline.
-
pinnedEventsSaveObjectobjectnullable -
A list of all the pinned events that are associated to this Timeline.
-
creatednumbernullable -
The time the pinned event was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the pinned event.
-
updatednumbernullable -
The last time the pinned event was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the pinned event
-
eventIdstringrequired -
The
_idof the associated event for this pinned event. -
timelineIdstringrequired -
The
savedObjectIdof the timeline that this pinned event is associated with -
pinnedEventIdstringrequired -
The
savedObjectIdof this pinned event -
versionstringrequired -
The version of this pinned event
Indicates that the user does not have the required permissions to create a draft Timeline.
-
messagestring -
status_codenumber
Indicates that there is already a draft Timeline with the given timelineId.
-
messagestring -
status_codenumber