Resolve a Timeline or Timeline template
- Base URL
-
https://{kibana_url}
- GET /api/timeline/resolve
- GET /s/{space_id}/api/timeline/resolve
Refer to Spaces for more information.
Resolve a Timeline or Timeline template, surfacing outcomes such as exactMatch, aliasMatch, or conflict when object IDs have been remapped during upgrades or imports. Provide either id for default Timelines or template_timeline_id for templates.
Responses
Indicates a successful call.
-
timelineobjectrequired -
excludedRowRendererIdsnullable -
A list of row renderers that should not be used when in
Event renderersmode -
Values:
alertalertsauditdauditd_filelibrarynetflowplainregistrysuricatasystemsystem_dnssystem_endgame_processsystem_filesystem_fimsystem_security_eventsystem_socketthreat_matchzeek -
indexNamesstringnullable -
A list of index names to use in the query (e.g. when the default data view has been modified)
-
kqlModestringnullable -
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query resultssearch: displays additional search results
-
templateTimelineIdstringnullable -
A unique ID (UUID) for Timeline templates. For Timelines, the value is
null. -
templateTimelineVersionnumbernullable -
Timeline template version number. For Timelines, the value is
null.
Bad Request response.
Response Type: object
The (template) Timeline was not found
Response Type: object