Get an Entity Engine

Server: https://{kibana_url}

GET /api/entity_store/engines/{entityType}
GET /s/{space_id}/api/entity_store/engines/{entityType}

Api key auth Basic auth

Refer to Spaces for more information.

Get the engine descriptor for a specific entity type, including its configuration and current status.

Path Parameters

entityType enum required: The entity type of the engine.; Values: user host service

Response

Successful response

application/json

delay string · pattern: [smdh]$ · default: 1m: The delay before the transform processes new data, allowing late-arriving documents to be included.
docsPerSecond integer: Throttle value for the number of documents processed per second. Use -1 for no throttle.
error object: Present when the engine status is error. Describes the failure.
fieldHistoryLength integer required: The number of historical values retained per field.
filter string: An optional Kibana Query Language (KQL) filter applied to source documents before aggregation.
frequency string · pattern: [smdh]$ · default: 1m: How often the transform runs.
indexPattern string required: An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.
lookbackPeriod string · pattern: [smdh]$ · default: 24h: How far back the transform looks when calculating aggregations.
status enum required: The current operational status of an entity engine.; Values: installing started stopped updating error
timeout string · pattern: [smdh]$ · default: 180s: The timeout for initializing the aggregating transform.
timestampField string: The field used as the timestamp for source documents.
type enum required: The type of entity.; Values: user host service

Examples

Returns the engine descriptor for a host engine that is currently running with default settings.

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET /api/entity_store/engines/{entityType}

curl Shell

curl -X GET "https://{kibana_url}/api/entity_store/engines/{entityType}"

Response

{
  "delay": "1m",
  "fieldHistoryLength": 10,
  "frequency": "1m",
  "indexPattern": "",
  "lookbackPeriod": "24h",
  "status": "started",
  "timeout": "180s",
  "timestampField": "@timestamp",
  "type": "host"
}