Initialize the Entity Store
- Base URL
-
https://{kibana_url}
- POST /api/entity_store/enable
- POST /s/{space_id}/api/entity_store/enable
Refer to Spaces for more information.
Initialize the entire Entity Store, creating engines for all or specified entity types.
Request body
Configuration for the entity store initialization.
-
enrichPolicyExecutionIntervalstring · pattern: ^[1-9]\d*[smh]$ -
Interval in which enrich policy runs. For example,
"1h"means the rule runs every hour. Must be less than or equal to half the duration of the lookback period, -
indexPatternstring -
An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.
-
lookbackPeriodstring · pattern: [smdh]$ · default: 24h -
The amount of time the transform looks back to calculate the aggregations.
Responses
Successful response
-
enginesobject -
The engine descriptors created during initialization.
-
delaystring · pattern: [smdh]$ · default: 1m -
The delay before the transform processes new data, allowing late-arriving documents to be included.
-
docsPerSecondinteger -
Throttle value for the number of documents processed per second. Use -1 for no throttle.
-
filterstring -
An optional Kibana Query Language (KQL) filter applied to source documents before aggregation.
-
indexPatternstringrequired -
An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.
-
lookbackPeriodstring · pattern: [smdh]$ · default: 24h -
How far back the transform looks when calculating aggregations.
-
statusrequired -
The current operational status of an entity engine.
-
Values:
installingstartedstoppedupdatingerror
Invalid request