Create a Timeline or Timeline template

Base URL: https://{kibana_url}

POST /api/timeline

Create a new Timeline or Timeline template.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Request body

The required Timeline fields used to create a new Timeline, along with optional fields that will be created if not provided.

status enum: The status of the Timeline.; Values: active draft immutable
templateTimelineId string nullable: A unique identifier for the Timeline template.
templateTimelineVersion number nullable: Timeline template version number.
timeline object required
timelineId string nullable: A unique identifier for the Timeline.
timelineType enum: The type of Timeline.; Values: default template
version string nullable

Responses

Indicates a successful call.

application/json

columns object[] nullable: The Timeline's columns; Same fields as columns in timeline
created number nullable: The time the Timeline was created, using a 13-digit Epoch timestamp.
createdBy string nullable: The user who created the Timeline.
dataProviders object[] nullable: Object containing query clauses; Same fields as dataProviders in timeline
dataViewId string nullable: ID of the Timeline's Data View
dateRange object nullable: The Timeline's search period.
description string nullable: The Timeline's description
eqlOptions object nullable: EQL query that is used in the correlation tab
eventType string nullable deprecated: Event types displayed in the Timeline
excludedRowRendererIds enum[] nullable: A list of row renderers that should not be used when in Event renderers mode; Values: alert alerts auditd auditd_file library netflow plain registry suricata system system_dns system_endgame_process system_file system_fim system_security_event system_socket threat_match zeek
favorite object[] nullable
filters object[] nullable: A list of filters that should be applied to the query; Same fields as filters in timeline
indexNames string[] nullable: A list of index names to use in the query (e.g. when the default data view has been modified)
kqlMode string nullable: Indicates whether the KQL bar filters the query results or searches for additional results, where:

filter: filters query results

search: displays additional search results
kqlQuery object: KQL bar query.
savedQueryId string nullable: The ID of the saved query that might be used in the Query tab
savedSearchId string nullable: The ID of the saved search that is used in the ES|QL tab
sort union oneOf: object or object[]
status enum: The status of the Timeline.; Values: active draft immutable
templateTimelineId string nullable: A unique ID (UUID) for Timeline templates. For Timelines, the value is null.
templateTimelineVersion number nullable: Timeline template version number. For Timelines, the value is null.
timelineType enum: The type of Timeline.; Values: default template
title string nullable: The Timeline's title.
updated number nullable: The last time the Timeline was updated, using a 13-digit Epoch timestamp
updatedBy string nullable: The user who last updated the Timeline
savedObjectId string required: The savedObjectId of the Timeline or Timeline template
version string required: The version of the Timeline or Timeline template
eventIdToNoteIds object[] nullable: A list of all the notes that are associated to this Timeline.
noteIds string[] nullable: A list of all the ids of notes that are associated to this Timeline.
notes object[] nullable: A list of all the notes that are associated to this Timeline.
pinnedEventIds string[] nullable: A list of all the ids of pinned events that are associated to this Timeline.
pinnedEventsSaveObject object[] nullable: A list of all the pinned events that are associated to this Timeline.

Indicates that there was an error in the Timeline creation.

application/json

Authentication

Request body { }

Responses

Request body