Update a package policy

Base URL
https://{kibana_url}
Auth

Update a package policy by ID.

Path parameters

packagePolicyId string required

The ID of the package policy

Query parameters

format enum

Format for the response: simplified or legacy

Values: simplified legacy

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

Any of:
additional_datastreams_permissions string[] · max items: 1000 nullable

Additional data stream permissions that will be added to the agent policy.

cloud_connector_id string nullable

ID of the cloud connector associated with this package policy.

cloud_connector_name string · min length: 1 · max length: 255 nullable

Transient field for cloud connector name during creation.

condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this integration to its inputs.

description string

Package policy description

enabled boolean
force boolean
global_data_tags object[] · max items: 100 nullable
name string required

The name of the custom field. Cannot contain spaces.

value number | string required

The value of the custom field.

inputs object[] · max items: 1000
condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this input.

config map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
deprecated object
description string · max length: 4096 required
replaced_by map string to string
<string> string · max length: 1024
since string · max length: 50
enabled boolean required
id string
keep_enabled boolean
migrate_from string
name string
policy_template string
streams object[] · max items: 1000
compiled_stream object required
condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this stream.

config map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
data_stream object required
dataset string required
elasticsearch object
dynamic_dataset boolean
dynamic_namespace boolean
privileges object
indices string[] · max items: 100
type string
deprecated object
description string · max length: 4096 required
replaced_by map string to string
<string> string · max length: 1024
since string · max length: 50
enabled boolean required
id string
keep_enabled boolean
migrate_from string
release enum
Values: ga beta experimental
var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
type string required
var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
is_managed boolean
name string
namespace string · max length: 100

The package policy namespace. Leave blank to inherit the agent policy's namespace.

output_id string nullable
overrides object nullable

Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.

inputs map string to object
package object
experimental_data_stream_features object[] · max items: 100
data_stream string · max length: 1024 required
features object required
doc_value_only_numeric boolean
doc_value_only_other boolean
synthetic_source boolean
tsdb boolean
fips_compatible boolean
name string · max length: 255 required

Package name

requires_root boolean
title string · max length: 255
version string · max length: 50 required

Package version

package_agent_version_condition string
policy_id string nullable deprecated

ID of the agent policy which the package policy will be added to.

policy_ids string[] · max items: 1000
spaceIds string[] · max items: 100
supports_agentless boolean nullable

Indicates whether the package policy belongs to an agentless agent policy.

supports_cloud_connector boolean nullable

Indicates whether the package policy supports cloud connectors.

var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
version string

Responses

Successful response

application/json
item object required
additional_datastreams_permissions string[] · max items: 1000 nullable

Additional data stream permissions that will be added to the agent policy.

agents number
cloud_connector_id string nullable

ID of the cloud connector associated with this package policy.

cloud_connector_name string · min length: 1 · max length: 255 nullable

Transient field for cloud connector name during creation.

condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this integration to its inputs.

created_at string required
created_by string required
description string

Package policy description

elasticsearch object
privileges object
cluster string[] · max items: 100
enabled boolean required
global_data_tags object[] · max items: 100 nullable
name string required

The name of the custom field. Cannot contain spaces.

value number | string required

The value of the custom field.

id string required

Package policy unique identifier.

inputs union anyOf required

Package policy inputs.

Any of:
{} { compiled_input, enabled, streams, … }[]
compiled_input object required
condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this input.

config map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
deprecated object
description string · max length: 4096 required
replaced_by map string to string
<string> string · max length: 1024
since string · max length: 50
enabled boolean required
id string
keep_enabled boolean
migrate_from string
name string
policy_template string
streams object[] · max items: 1000 required
compiled_stream object required
condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this stream.

config map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
data_stream object required
dataset string required
elasticsearch object
dynamic_dataset boolean
dynamic_namespace boolean
privileges object
indices string[] · max items: 100
type string
deprecated object
description string · max length: 4096 required
replaced_by map string to string
<string> string · max length: 1024
since string · max length: 50
enabled boolean required
id string
keep_enabled boolean
migrate_from string
release enum
Values: ga beta experimental
var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
type string required
var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
is_managed boolean
name string required

Unique name for the package policy.

namespace string · max length: 100

The package policy namespace. Leave blank to inherit the agent policy's namespace.

output_id string nullable
overrides object nullable

Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.

inputs map string to object
package object
Same fields as package in update_package_policy_request
package_agent_version_condition string
policy_id string nullable deprecated

ID of the agent policy which the package policy will be added to.

policy_ids string[] · max items: 1000
revision number required

Package policy revision.

secret_references object[] · max items: 1000
id string required
spaceIds string[] · max items: 100
supports_agentless boolean nullable

Indicates whether the package policy belongs to an agentless agent policy.

supports_cloud_connector boolean nullable

Indicates whether the package policy supports cloud connectors.

updated_at string required
updated_by string required
var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars union anyOf

Package level variable.

Any of:

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
version string

Package policy ES version.

Bad Request

application/json
attributes object required
error string
errorType string
message string required
statusCode number

Forbidden

application/json
attributes object required
error string
errorType string
message string required
statusCode number
Base URL
https://{kibana_url}