Create or update a stream | Kibana API documentation

Create or update a stream Technical Preview

PUT /api/streams/{name}

Api key auth Basic auth

Creates or updates a stream definition. Classic streams can not be created through this API, only updated

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

Path parameters

name string Required

application/json

Body object

dashboards array[string] Required

Minimum length of each is 1.
queries array[object] Required
Hide queries attributes Show queries attributes object
- id string Required
  
  Minimum length is 1.
- title string Required
  
  Minimum length is 1.
- kql object Required
  
  Additional properties are NOT allowed.
  Hide kql attribute Show kql attribute object
  
  query string Required
  
  Minimum length is 1.
stream object Required

Additional properties are NOT allowed.
Hide stream attribute Show stream attribute object
- ingest object Required
  Hide ingest attributes Show ingest attributes object
  
  lifecycle object Required
  
  Any of:
  object-1 object object-2 object object-3 object
  
  Hide attribute Show attribute
  
  dsl object Required
  
  Additional properties are NOT allowed.
  
  Hide dsl attribute Show dsl attribute object
  
  data_retention string
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  ilm object Required
  
  Additional properties are NOT allowed.
  
  Hide ilm attribute Show ilm attribute object
  
  policy string Required
  
  Minimum length is 1.
  
  processing array[object] Required
  
  Any of:
  object-1 object object-2 object object-3 object object-4 object object-5 object object-6 object object-7 object object-8 object object-9 object
  
  Hide attribute Show attribute
  
  date object Required
  
  Hide date attributes Show date attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  field string Required
  
  Minimum length is 1.
  
  formats array[string] Required
  
  Minimum length of each is 1.
  
  locale string
  
  Minimum length is 1.
  
  output_format string
  
  Minimum length is 1.
  
  target_field string
  
  Minimum length is 1.
  
  timezone string
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  dissect object Required
  
  Hide dissect attributes Show dissect attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  append_separator string
  
  Minimum length is 1.
  
  field string Required
  
  Minimum length is 1.
  
  ignore_missing boolean
  
  pattern string Required
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  grok object Required
  
  Hide grok attributes Show grok attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  field string Required
  
  Minimum length is 1.
  
  ignore_missing boolean
  
  pattern_definitions object
  
  Hide pattern_definitions attribute Show pattern_definitions attribute object
  
  * string Additional properties
  
  patterns array[string] Required
  
  At least 1 element. Minimum length of each is 1.
  
  Hide attribute Show attribute
  
  kv object Required
  
  Hide kv attributes Show kv attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  exclude_keys array[string]
  
  Minimum length of each is 1.
  
  field string Required
  
  Minimum length is 1.
  
  field_split string Required
  
  ignore_missing boolean
  
  include_keys array[string]
  
  Minimum length of each is 1.
  
  prefix string
  
  Minimum length is 1.
  
  strip_brackets boolean
  
  target_field string
  
  Minimum length is 1.
  
  trim_key string
  
  Minimum length is 1.
  
  trim_value string
  
  Minimum length is 1.
  
  value_split string Required
  
  Hide attribute Show attribute
  
  geoip object Required
  
  Additional properties are NOT allowed.
  
  Hide geoip attributes Show geoip attributes object
  
  database_file string
  
  Minimum length is 1.
  
  field string Required
  
  Minimum length is 1.
  
  first_only boolean
  
  ignore_missing boolean
  
  properties array[string]
  
  Minimum length of each is 1.
  
  target_field string
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  rename object Required
  
  Hide rename attributes Show rename attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  field string Required
  
  Minimum length is 1.
  
  ignore_missing boolean
  
  override boolean
  
  target_field string Required
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  set object Required
  
  Hide set attributes Show set attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  field string Required
  
  Minimum length is 1.
  
  ignore_empty_value boolean
  
  media_type string
  
  override boolean
  
  value string Required
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  urldecode object Required
  
  Hide urldecode attributes Show urldecode attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  field string Required
  
  Minimum length is 1.
  
  ignore_missing boolean
  
  target_field string
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  user_agent object Required
  
  Additional properties are NOT allowed.
  
  Hide user_agent attributes Show user_agent attributes object
  
  field string Required
  
  Minimum length is 1.
  
  ignore_missing boolean
  
  properties array[string]
  
  Minimum length of each is 1.
  
  regex_file string
  
  Minimum length is 1.
  
  target_field string
  
  Minimum length is 1.
  
  wired object Required
  
  Additional properties are NOT allowed.
  
  Hide wired attributes Show wired attributes object
  
  fields object Required
  
  routing array[object] Required
  
  Hide routing attributes Show routing attributes object
  
  destination string Required
  
  Minimum length is 1.
  
  if object Required
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean

dashboards array[string] Required

Minimum length of each is 1.
queries array[object] Required
Hide queries attributes Show queries attributes object
- id string Required
  
  Minimum length is 1.
- title string Required
  
  Minimum length is 1.
- kql object Required
  
  Additional properties are NOT allowed.
  Hide kql attribute Show kql attribute object
  
  query string Required
  
  Minimum length is 1.
stream object Required

Additional properties are NOT allowed.
Hide stream attribute Show stream attribute object
- ingest object Required
  Hide ingest attributes Show ingest attributes object
  
  lifecycle object Required
  
  Any of:
  object-1 object object-2 object object-3 object
  
  Hide attribute Show attribute
  
  dsl object Required
  
  Additional properties are NOT allowed.
  
  Hide dsl attribute Show dsl attribute object
  
  data_retention string
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  ilm object Required
  
  Additional properties are NOT allowed.
  
  Hide ilm attribute Show ilm attribute object
  
  policy string Required
  
  Minimum length is 1.
  
  processing array[object] Required
  
  Any of:
  object-1 object object-2 object object-3 object object-4 object object-5 object object-6 object object-7 object object-8 object object-9 object
  
  Hide attribute Show attribute
  
  date object Required
  
  Hide date attributes Show date attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  field string Required
  
  Minimum length is 1.
  
  formats array[string] Required
  
  Minimum length of each is 1.
  
  locale string
  
  Minimum length is 1.
  
  output_format string
  
  Minimum length is 1.
  
  target_field string
  
  Minimum length is 1.
  
  timezone string
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  dissect object Required
  
  Hide dissect attributes Show dissect attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  append_separator string
  
  Minimum length is 1.
  
  field string Required
  
  Minimum length is 1.
  
  ignore_missing boolean
  
  pattern string Required
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  grok object Required
  
  Hide grok attributes Show grok attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  field string Required
  
  Minimum length is 1.
  
  ignore_missing boolean
  
  pattern_definitions object
  
  Hide pattern_definitions attribute Show pattern_definitions attribute object
  
  * string Additional properties
  
  patterns array[string] Required
  
  At least 1 element. Minimum length of each is 1.
  
  Hide attribute Show attribute
  
  kv object Required
  
  Hide kv attributes Show kv attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  exclude_keys array[string]
  
  Minimum length of each is 1.
  
  field string Required
  
  Minimum length is 1.
  
  field_split string Required
  
  ignore_missing boolean
  
  include_keys array[string]
  
  Minimum length of each is 1.
  
  prefix string
  
  Minimum length is 1.
  
  strip_brackets boolean
  
  target_field string
  
  Minimum length is 1.
  
  trim_key string
  
  Minimum length is 1.
  
  trim_value string
  
  Minimum length is 1.
  
  value_split string Required
  
  Hide attribute Show attribute
  
  geoip object Required
  
  Additional properties are NOT allowed.
  
  Hide geoip attributes Show geoip attributes object
  
  database_file string
  
  Minimum length is 1.
  
  field string Required
  
  Minimum length is 1.
  
  first_only boolean
  
  ignore_missing boolean
  
  properties array[string]
  
  Minimum length of each is 1.
  
  target_field string
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  rename object Required
  
  Hide rename attributes Show rename attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  field string Required
  
  Minimum length is 1.
  
  ignore_missing boolean
  
  override boolean
  
  target_field string Required
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  set object Required
  
  Hide set attributes Show set attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  field string Required
  
  Minimum length is 1.
  
  ignore_empty_value boolean
  
  media_type string
  
  override boolean
  
  value string Required
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  urldecode object Required
  
  Hide urldecode attributes Show urldecode attributes object
  
  description string
  
  if object
  
  Any of:
  object-1 object object-2 object object-2 object object-3 object object-4 object object-5 object
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are exists or notExists.
  
  Hide attributes Show attributes
  
  field string Required
  
  Minimum length is 1.
  
  operator string Required
  
  Values are eq, neq, lt, lte, gt, gte, contains, startsWith, or endsWith.
  
  value string | number | boolean Required
  
  Any of:
  string-1 string number-2 number boolean-3 boolean
  
  ignore_failure boolean
  
  field string Required
  
  Minimum length is 1.
  
  ignore_missing boolean
  
  target_field string
  
  Minimum length is 1.
  
  Hide attribute Show attribute
  
  user_agent object Required
  
  Additional properties are NOT allowed.
  
  Hide user_agent attributes Show user_agent attributes object
  
  field string Required
  
  Minimum length is 1.
  
  ignore_missing boolean
  
  properties array[string]
  
  Minimum length of each is 1.
  
  regex_file string
  
  Minimum length is 1.
  
  target_field string
  
  Minimum length is 1.
  
  unwired object Required
  
  Additional properties are NOT allowed.

dashboards array[string] Required

Minimum length of each is 1.
queries array[object] Required
Hide queries attributes Show queries attributes object
- id string Required
  
  Minimum length is 1.
- title string Required
  
  Minimum length is 1.
- kql object Required
  
  Additional properties are NOT allowed.
  Hide kql attribute Show kql attribute object
  
  query string Required
  
  Minimum length is 1.
stream object Required

Additional properties are NOT allowed.
Hide stream attribute Show stream attribute object
- group object Required
  
  Additional properties are NOT allowed.
  Hide group attributes Show group attributes object
  
  description string
  
  members array[string] Required
  
  Minimum length of each is 1.

PUT /api/streams/{name}

curl \
 --request PUT 'https://localhost:5601/api/streams/{name}' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{"dashboards":["string"],"queries":[{"id":"string","title":"string","kql":{"query":"string"}}],"stream":{"ingest":{"lifecycle":{"dsl":{"data_retention":"string"}},"processing":[{"date":{"description":"string","if":{"field":"string","operator":"exists"},"ignore_failure":true,"field":"string","formats":["string"],"locale":"string","output_format":"string","target_field":"string","timezone":"string"}}],"wired":{"fields":{},"routing":[{"destination":"string","if":{"field":"string","operator":"exists"}}]}}}}'

Request examples

# Headers
kbn-xsrf: true

# Payload
{
  "dashboards": [
    "string"
  ],
  "queries": [
    {
      "id": "string",
      "title": "string",
      "kql": {
        "query": "string"
      }
    }
  ],
  "stream": {
    "ingest": {
      "lifecycle": {
        "dsl": {
          "data_retention": "string"
        }
      },
      "processing": [
        {
          "date": {
            "description": "string",
            "if": {
              "field": "string",
              "operator": "exists"
            },
            "ignore_failure": true,
            "field": "string",
            "formats": [
              "string"
            ],
            "locale": "string",
            "output_format": "string",
            "target_field": "string",
            "timezone": "string"
          }
        }
      ],
      "wired": {
        "fields": {},
        "routing": [
          {
            "destination": "string",
            "if": {
              "field": "string",
              "operator": "exists"
            }
          }
        ]
      }
    }
  }
}

# Headers
kbn-xsrf: true

# Payload
{
  "dashboards": [
    "string"
  ],
  "queries": [
    {
      "id": "string",
      "title": "string",
      "kql": {
        "query": "string"
      }
    }
  ],
  "stream": {
    "ingest": {
      "lifecycle": {
        "dsl": {
          "data_retention": "string"
        }
      },
      "processing": [
        {
          "date": {
            "description": "string",
            "if": {
              "field": "string",
              "operator": "exists"
            },
            "ignore_failure": true,
            "field": "string",
            "formats": [
              "string"
            ],
            "locale": "string",
            "output_format": "string",
            "target_field": "string",
            "timezone": "string"
          }
        }
      ],
      "unwired": {}
    }
  }
}

# Headers
kbn-xsrf: true

# Payload
{
  "dashboards": [
    "string"
  ],
  "queries": [
    {
      "id": "string",
      "title": "string",
      "kql": {
        "query": "string"
      }
    }
  ],
  "stream": {
    "group": {
      "description": "string",
      "members": [
        "string"
      ]
    }
  }
}

Create or update a stream Technical Preview

Headers

Path parameters

Body object

lifecycle object Required

if object

if object Required

lifecycle object Required

if object