Get an existing saved Timeline or Timeline template
https://{kibana_url}
- GET /api/timeline/resolve
- GET /s/{space_id}/api/timeline/resolve
Refer to Spaces for more information.
Query Parameters
-
template_timeline_idstring The ID of the template timeline to resolve
-
idstring The ID of the timeline to resolve
Responses
The (template) Timeline has been found
-
data -
alias_purpose -
Values:
savedObjectConversionsavedObjectImport -
alias_target_idstring -
outcome -
Values:
exactMatchaliasMatchconflict -
timeline -
columnsobjectnullable -
The Timeline's columns
-
aggregatablebooleannullable -
categorystringnullable -
columnHeaderTypestringnullable -
descriptionstringnullable -
examplestringnullable -
idstringnullable -
indexesstringnullable -
namestringnullable -
placeholderstringnullable -
searchablebooleannullable -
typestringnullable -
creatednumbernullable -
The time the Timeline was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the Timeline.
-
dataProvidersobjectnullable -
Object containing query clauses
-
andobjectnullable -
enabledbooleannullable -
excludedbooleannullable -
idstringnullable -
kqlQuerystringnullable -
namestringnullable -
queryMatch -
displayFieldstringnullable -
displayValuestringnullable -
fieldstringnullable -
operatorstringnullable -
valuestring | stringnullable -
enabledbooleannullable -
excludedbooleannullable -
idstringnullable -
kqlQuerystringnullable -
namestringnullable -
queryMatch -
displayFieldstringnullable -
displayValuestringnullable -
fieldstringnullable -
operatorstringnullable -
valuestring | stringnullable -
dataViewIdstringnullable -
ID of the Timeline's Data View
-
dateRangeobjectnullable -
The Timeline's search period.
-
descriptionstringnullable -
The Timeline's description
-
eqlOptionsobjectnullable -
EQL query that is used in the correlation tab
-
eventCategoryFieldstringnullable -
querystringnullable -
sizestring | numbernullable -
tiebreakerFieldstringnullable -
timestampFieldstringnullable -
eventTypestringnullable deprecated -
Event types displayed in the Timeline
-
excludedRowRendererIds -
A list of row renderers that should not be used when in
Event renderersmode -
Values:
alertalertsauditdauditd_filelibrarynetflowplainregistrysuricatasystemsystem_dnssystem_endgame_processsystem_filesystem_fimsystem_security_eventsystem_socketthreat_matchzeek -
favoriteobjectnullable -
favoriteDatenumbernullable -
fullNamestringnullable -
userNamestringnullable -
indexNamesstringnullable -
A list of index names to use in the query (e.g. when the default data view has been modified)
-
kqlModestringnullable -
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query resultssearch: displays additional search results
-
kqlQuery -
KQL bar query.
-
filterQueryobjectnullable -
kueryobjectnullable -
expressionstringnullable -
kindstringnullable -
serializedQuerystringnullable -
savedQueryIdstringnullable -
The ID of the saved query that might be used in the Query tab
-
savedSearchIdstringnullable -
The ID of the saved search that is used in the ES|QL tab
-
sort -
columnIdstringnullable -
columnTypestringnullable -
sortDirectionstringnullable -
templateTimelineIdstringnullable -
A unique ID (UUID) for Timeline templates. For Timelines, the value is
null. -
templateTimelineVersionnumbernullable -
Timeline template version number. For Timelines, the value is
null. -
titlestringnullable -
The Timeline's title.
-
updatednumbernullable -
The last time the Timeline was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the Timeline
-
eventIdToNoteIdsobjectnullable -
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
The
_idof the associated event for this note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline that this note is associated with -
noteIdstringrequired -
The
savedObjectIdof the note -
versionstringrequired -
The version of the note
-
noteIdsstringnullable -
notesobjectnullable -
creatednumbernullable -
The time the note was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the note.
-
updatednumbernullable -
The last time the note was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the note
-
eventIdstringnullable -
The
_idof the associated event for this note. -
notestringnullable -
The text of the note
-
timelineIdstringrequired -
The
savedObjectIdof the Timeline that this note is associated with -
noteIdstringrequired -
The
savedObjectIdof the note -
versionstringrequired -
The version of the note
-
pinnedEventIdsstringnullable -
pinnedEventsSaveObjectobjectnullable -
creatednumbernullable -
The time the pinned event was created, using a 13-digit Epoch timestamp.
-
createdBystringnullable -
The user who created the pinned event.
-
updatednumbernullable -
The last time the pinned event was updated, using a 13-digit Epoch timestamp
-
updatedBystringnullable -
The user who last updated the pinned event
-
eventIdstringrequired -
The
_idof the associated event for this pinned event. -
timelineIdstringrequired -
The
savedObjectIdof the timeline that this pinned event is associated with -
pinnedEventIdstringrequired -
The
savedObjectIdof this pinned event -
versionstringrequired -
The version of this pinned event
-
savedObjectIdstringrequired -
versionstringrequired
The request is missing parameters
The (template) Timeline was not found