Get Timeline or Timeline template details
- Base URL
-
https://{kibana_url}
- GET /api/timeline
- GET /s/{space_id}/api/timeline
Refer to Spaces for more information.
Get the details of an existing saved Timeline or Timeline template.
Authentication
Authorization: <value>These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey
Authorization: Basic <credentials>Response
Indicates that the (template) Timeline was found and returned.
-
dataobjectrequired -
getOneTimelineobjectrequired -
excludedRowRendererIdsenum[]nullable -
A list of row renderers that should not be used when in
Event renderersmode -
Values:
alertalertsauditdauditd_filelibrarynetflowplainregistrysuricatasystemsystem_dnssystem_endgame_processsystem_filesystem_fimsystem_security_eventsystem_socketthreat_matchzeek -
indexNamesstring[]nullable -
A list of index names to use in the query (e.g. when the default data view has been modified)
-
kqlModestringnullable -
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query resultssearch: displays additional search results
-
templateTimelineIdstringnullable -
A unique ID (UUID) for Timeline templates. For Timelines, the value is
null. -
templateTimelineVersionnumbernullable -
Timeline template version number. For Timelines, the value is
null. -
pinnedEventIdsstring[]nullable -
A list of all the ids of pinned events that are associated to this Timeline.