Upsert multiple monitored users via CSV upload

deprecated

Server: https://{kibana_url}

POST /api/entity_analytics/monitoring/users/_csv
POST /s/{space_id}/api/entity_analytics/monitoring/users/_csv

Api key auth Basic auth

Refer to Spaces for more information.

Deprecated in 9.4.0. Use the Watchlists API instead.

Bulk upserts privileged users by uploading a CSV file. Returns per-row errors and aggregate upload statistics.

Request

file string required: The CSV file to upload.

Responses

Bulk upload successful

application/json

413

File too large

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/entity_analytics/monitoring/users/_csv
{
  "file": "username,is_privileged\njohn.doe,true\njane.smith,true\n"
}

curl Shell

curl -X POST "https://{kibana_url}/api/entity_analytics/monitoring/users/_csv" \
  -H "Content-Type: multipart/form-data" \
  -d '{
  "file": "username,is_privileged\njohn.doe,true\njane.smith,true\n"
}'

Response

{
  "errors": [
    {
      "index": 1,
      "message": "Invalid monitored field",
      "username": "john.doe"
    }
  ],
  "stats": {
    "failedOperations": 1,
    "successfulOperations": 1,
    "totalOperations": 2,
    "uploaded": 2
  }
}