Initialize an Entity Engine
https://{kibana_url}
- POST /api/entity_store/engines/{entityType}/init
- POST /s/{space_id}/api/entity_store/engines/{entityType}/init
Refer to Spaces for more information.
Initialize a single entity engine for the specified entity type.
Path Parameters
-
entityType -
The entity type of the engine (either 'user' or 'host').
-
Values:
userhostservice
Request
Schema for the engine initialization
-
delaystring · pattern: [smdh]$ · default: 1m -
The delay before the transform will run.
-
docsPerSecondinteger -
The number of documents per second to process.
-
enrichPolicyExecutionIntervalstring · pattern: ^[1-9]\d*[smh]$ -
Interval in which enrich policy runs. For example,
"1h"means the rule runs every hour. Must be less than or equal to half the duration of the lookback period, -
fieldHistoryLengthinteger · default: 10 -
The number of historical values to keep for each field.
-
filterstring -
frequencystring · pattern: [smdh]$ · default: 1m -
The frequency at which the transform will run.
-
indexPatternstring -
An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.
-
lookbackPeriodstring · pattern: [smdh]$ · default: 24h -
The amount of time the transform looks back to calculate the aggregations.
-
timeoutstring · pattern: [smdh]$ · default: 180s -
The timeout for initializing the aggregating transform.
-
timestampFieldstring · default: @timestamp -
The field to use as the timestamp for the entity type.
Responses
Successful response
-
delaystring · pattern: [smdh]$ · default: 1m -
The delay before the transform processes new data, allowing late-arriving documents to be included.
-
docsPerSecondinteger -
Throttle value for the number of documents processed per second. Use -1 for no throttle.
-
errorobject -
Present when the engine status is
error. Describes the failure. -
fieldHistoryLengthintegerrequired -
The number of historical values retained per field.
-
filterstring -
An optional Kibana Query Language (KQL) filter applied to source documents before aggregation.
-
frequencystring · pattern: [smdh]$ · default: 1m -
How often the transform runs.
-
indexPatternstringrequired -
An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.
-
lookbackPeriodstring · pattern: [smdh]$ · default: 24h -
How far back the transform looks when calculating aggregations.
-
status -
The current operational status of an entity engine.
-
Values:
installingstartedstoppedupdatingerror -
timeoutstring · pattern: [smdh]$ · default: 180s -
The timeout for initializing the aggregating transform.
-
timestampFieldstring -
The field used as the timestamp for source documents.
Invalid request