Get stream list

Base URL: https://{kibana_url}

GET /api/streams

Fetches list of all streams

Required authorization

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Request body

Response

200

A list of all streams.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/streams
{}

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/streams" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{}'

Generated from the API spec

Response

{
  "streams": [
    {
      "description": "Root logs stream",
      "ingest": {
        "failure_store": {
          "inherit": {}
        },
        "lifecycle": {
          "inherit": {}
        },
        "processing": {
          "steps": [],
          "updated_at": "2025-01-10T08:00:00.000Z"
        },
        "settings": {},
        "wired": {
          "fields": {
            "@timestamp": {
              "type": "date"
            },
            "log.level": {
              "type": "keyword"
            },
            "message": {
              "type": "match_only_text"
            }
          },
          "routing": [
            {
              "destination": "logs.nginx",
              "status": "enabled",
              "where": {
                "eq": "nginx",
                "field": "host.name"
              }
            }
          ]
        }
      },
      "name": "logs",
      "type": "wired",
      "updated_at": "2025-01-10T08:00:00.000Z"
    },
    {
      "description": "Web server access logs, routed by severity",
      "ingest": {
        "failure_store": {
          "inherit": {}
        },
        "lifecycle": {
          "inherit": {}
        },
        "processing": {
          "steps": [],
          "updated_at": "2025-01-15T10:30:00.000Z"
        },
        "settings": {},
        "wired": {
          "fields": {
            "host.name": {
              "type": "keyword"
            },
            "http.response.status_code": {
              "type": "long"
            },
            "message": {
              "type": "match_only_text"
            }
          },
          "routing": [
            {
              "destination": "logs.nginx.errors",
              "status": "enabled",
              "where": {
                "field": "http.response.status_code",
                "gte": 500
              }
            }
          ]
        }
      },
      "name": "logs.nginx",
      "type": "wired",
      "updated_at": "2025-01-15T10:30:00.000Z"
    },
    {
      "description": "Legacy application logs",
      "ingest": {
        "classic": {},
        "failure_store": {
          "disabled": {}
        },
        "lifecycle": {
          "dsl": {
            "data_retention": "30d"
          }
        },
        "processing": {
          "steps": [
            {
              "action": "grok",
              "from": "message",
              "ignore_missing": true,
              "patterns": [
                "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}"
              ]
            }
          ],
          "updated_at": "2024-12-01T09:00:00.000Z"
        },
        "settings": {}
      },
      "name": "logs-myapp-default",
      "type": "classic",
      "updated_at": "2024-12-01T09:00:00.000Z"
    },
    {
      "description": "All error-level logs across every stream",
      "name": "logs.errors",
      "query": {
        "esql": "FROM logs* | WHERE log.level == \u0022error\u0022",
        "view": "logs.errors-view"
      },
      "type": "query",
      "updated_at": "2025-01-20T14:00:00.000Z"
    }
  ]
}