Copies timeline or timeline template

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Source timeline id to copy plus timeline fields for the new saved object.

timeline object required

− hide properties

columns object[] nullable

The Timeline's columns

− hide properties

aggregatable boolean nullable

category string nullable

columnHeaderType string nullable

description string nullable

example string nullable

id string nullable

indexes string[] nullable

name string nullable

placeholder string nullable

searchable boolean nullable

type string nullable

created number nullable

The time the Timeline was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the Timeline.

dataProviders object[] nullable

Object containing query clauses

− hide properties

and object[] nullable

− hide properties

enabled boolean nullable

excluded boolean nullable

id string nullable

kqlQuery string nullable

name string nullable

queryMatch object

− hide properties

displayField string nullable

displayValue string nullable

field string nullable

operator string nullable

value union string | string[] nullable

type enum

The type of data provider.

Values: default template

enabled boolean nullable

excluded boolean nullable

id string nullable

kqlQuery string nullable

name string nullable

queryMatch object

− hide properties

displayField string nullable

displayValue string nullable

field string nullable

operator string nullable

value union string | string[] nullable

type enum

The type of data provider.

Values: default template

dataViewId string nullable

ID of the Timeline's Data View

dateRange object nullable

The Timeline's search period.

− hide properties

end union string | number nullable

start union string | number nullable

description string nullable

The Timeline's description

eqlOptions object nullable

EQL query that is used in the correlation tab

− hide properties

eventCategoryField string nullable

query string nullable

size union string | number nullable

tiebreakerField string nullable

timestampField string nullable

eventType string nullable deprecated

Event types displayed in the Timeline

excludedRowRendererIds enum[] nullable

A list of row renderers that should not be used when in Event renderers mode

Values: alert alerts auditd auditd_file library netflow plain registry suricata system system_dns system_endgame_process system_file system_fim system_security_event system_socket threat_match zeek

favorite object[] nullable

− hide properties

favoriteDate number nullable

fullName string nullable

userName string nullable

filters object[] nullable

A list of filters that should be applied to the query

− hide properties

exists string nullable

match_all string nullable

meta object nullable

− hide properties

alias string nullable

controlledBy string nullable

disabled boolean nullable

field string nullable

formattedValue string nullable

index string nullable

key string nullable

negate boolean nullable

params string nullable

type string nullable

value string nullable

missing string nullable

query string nullable

range string nullable

script string nullable

indexNames string[] nullable

A list of index names to use in the query (e.g. when the default data view has been modified)

kqlMode string nullable

Indicates whether the KQL bar filters the query results or searches for additional results, where:

• filter: filters query results
• search: displays additional search results

kqlQuery object

KQL bar query.

− hide properties

filterQuery object nullable

− hide properties

kuery object nullable

− hide properties

expression string nullable

kind string nullable

serializedQuery string nullable

savedQueryId string nullable

The ID of the saved query that might be used in the Query tab

savedSearchId string nullable

The ID of the saved search that is used in the ES|QL tab

sort union oneOf

object or object[]

− hide properties

columnId string nullable

columnType string nullable

sortDirection string nullable

status enum

The status of the Timeline.

Values: active draft immutable

templateTimelineId string nullable

A unique ID (UUID) for Timeline templates. For Timelines, the value is null.

templateTimelineVersion number nullable

Timeline template version number. For Timelines, the value is null.

timelineType enum

The type of Timeline.

Values: default template

title string nullable

The Timeline's title.

updated number nullable

The last time the Timeline was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the Timeline

timelineIdToCopy string required

The savedObjectId of the timeline or template to duplicate.