Initialize the Entity Store

Base URL
https://{kibana_url}
  • POST /api/entity_store/enable
  • POST /s/{space_id}/api/entity_store/enable
Auth

Initialize the entire Entity Store, creating engines for all or specified entity types.

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

Configuration for the entity store initialization.

delay string · pattern: [smdh]$ · default: 1m

The delay before the transform will run.

docsPerSecond integer

The number of documents per second to process.

enrichPolicyExecutionInterval string · pattern: ^[1-9]\d*[smh]$

Interval in which enrich policy runs. For example, "1h" means the rule runs every hour. Must be less than or equal to half the duration of the lookback period,

entityTypes enum[]
Values: user host service
fieldHistoryLength integer · default: 10

The number of historical values to keep for each field.

filter string
frequency string · pattern: [smdh]$ · default: 1m

The frequency at which the transform will run.

indexPattern string

An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.

lookbackPeriod string · pattern: [smdh]$ · default: 24h

The amount of time the transform looks back to calculate the aggregations.

timeout string · pattern: [smdh]$ · default: 180s

The timeout for initializing the aggregating transform.

timestampField string · default: @timestamp

The field to use as the timestamp.

Responses

Successful response

application/json
engines object[]

The engine descriptors created during initialization.

delay string · pattern: [smdh]$ · default: 1m

The delay before the transform processes new data, allowing late-arriving documents to be included.

docsPerSecond integer

Throttle value for the number of documents processed per second. Use -1 for no throttle.

error object

Present when the engine status is error. Describes the failure.

action enum required

The lifecycle action that caused the error.

Values: init
message string required

A human-readable error message.

fieldHistoryLength integer required

The number of historical values retained per field.

filter string

An optional Kibana Query Language (KQL) filter applied to source documents before aggregation.

frequency string · pattern: [smdh]$ · default: 1m

How often the transform runs.

indexPattern string required

An additional Elasticsearch index pattern to include as a source for entity data. Merged with the default data view indices when the engine runs.

lookbackPeriod string · pattern: [smdh]$ · default: 24h

How far back the transform looks when calculating aggregations.

status enum required

The current operational status of an entity engine.

Values: installing started stopped updating error
timeout string · pattern: [smdh]$ · default: 180s

The timeout for initializing the aggregating transform.

timestampField string

The field used as the timestamp for source documents.

type enum required

The type of entity.

Values: user host service
succeeded boolean

Whether the Entity Store was initialized successfully.

400

Invalid request

Base URL
https://{kibana_url}