Api key auth (http_api_key)
You must create an API key and use the encoded value in the request header. To learn about creating keys, go to API keys.
https://<KIBANA_URL>
The Kibana REST APIs for Elastic serverless enable you to manage resources such as connectors, data views, and saved objects. The API calls are stateless. Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the request. API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
You can prepend any Kibana API endpoint with kbn:
and run the request in
Dev Tools → Console. For example:
GET kbn:/api/data_views
This documentation is derived from the main
branch of the kibana repository.
It is provided under license Attribution-NonCommercial-NoDerivatives 4.0 International.
This is version 1.0.2
of this API documentation.
Last update on Feb 11, 2025.
You must create an API key and use the encoded value in the request header. To learn about creating keys, go to API keys.
The identifier for the rule.
Default value is []
(empty).
Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
Additional properties are NOT allowed.
When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.
Additional properties are NOT allowed.
The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
Indicates how often alerts generate actions. Valid values include: onActionGroupChange
: Actions run when the alert status changes; onActiveAlert
: Actions run when the alert becomes active and at each check interval while the rule conditions are met; onThrottleInterval
: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specify notify_when
at both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
Values are onActionGroupChange
, onActiveAlert
, or onThrottleInterval
.
The parameters for the rule.
Default value is {}
(empty). Additional properties are allowed.
Additional properties are NOT allowed.
Use the throttle
property in the action frequency
object instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
curl \
--request PUT https://<KIBANA_URL>/api/alerting/rule/{id} \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"name":"new name","tags":[],"params":{"index":[".updated-index"],"aggType":"avg","groupBy":"top","aggField":"sheet.version","termSize":6,"termField":"name.keyword","threshold":[1000],"timeField":"@timestamp","timeWindowSize":5,"timeWindowUnit":"m","thresholdComparator":"\u003e"},"actions":[{"id":"96b668d0-a1b6-11ed-afdf-d39a49596974","group":"threshold met","params":{"level":"info","message":"Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"},"frequency":{"summary":false,"notify_when":"onActionGroupChange"}}],"schedule":{"interval":"1m"}}'
{
"name": "new name",
"tags": [],
"params": {
"index": [
".updated-index"
],
"aggType": "avg",
"groupBy": "top",
"aggField": "sheet.version",
"termSize": 6,
"termField": "name.keyword",
"threshold": [
1000
],
"timeField": "@timestamp",
"timeWindowSize": 5,
"timeWindowUnit": "m",
"thresholdComparator": ">"
},
"actions": [
{
"id": "96b668d0-a1b6-11ed-afdf-d39a49596974",
"group": "threshold met",
"params": {
"level": "info",
"message": "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
},
"frequency": {
"summary": false,
"notify_when": "onActionGroupChange"
}
}
],
"schedule": {
"interval": "1m"
}
}
{
"id": "ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74",
"name": "new name",
"tags": [],
"params": {
"index": [
".updated-index"
],
"aggType": "avg",
"groupBy": "top",
"aggField": "sheet.version",
"termSize": 6,
"termField": "name.keyword",
"threshold": [
1000
],
"timeField": "@timestamp",
"timeWindowSize": 5,
"timeWindowUnit": "m",
"thresholdComparator": ">"
},
"actions": [
{
"id": "96b668d0-a1b6-11ed-afdf-d39a49596974",
"uuid": "07aef2a0-9eed-4ef9-94ec-39ba58eb609d",
"group": "threshold met",
"params": {
"level": "info",
"message": "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}"
},
"frequency": {
"summary": false,
"throttle": null,
"notify_when": "onActionGroupChange"
},
"connector_type_id": ".server-log"
}
],
"enabled": true,
"running": false,
"consumer": "alerts",
"last_run": {
"outcome": "succeeded",
"warning": null,
"outcome_msg": null,
"alerts_count": {
"new": 0,
"active": 0,
"ignored": 0,
"recovered": 0
}
},
"mute_all": false,
"next_run": "2024-03-26T23:23:51.316Z",
"revision": 1,
"schedule": {
"interval": "1m"
},
"throttle": null,
"created_at": "2024-03-26T23:13:20.985Z",
"created_by": "elastic",
"updated_at": "2024-03-26T23:22:59.949Z",
"updated_by": "elastic",
"rule_type_id": ".index-threshold",
"api_key_owner": "elastic",
"muted_alert_ids": [],
"execution_status": {
"status": "ok",
"last_duration": 52,
"last_execution_date": "2024-03-26T23:22:51.390Z"
},
"scheduled_task_id": "4c5eda00-e74f-11ec-b72f-5b18752ff9ea",
"api_key_created_by_user": false
}
The identifier for the rule.
curl \
--request DELETE https://<KIBANA_URL>/api/alerting/rule/{id} \
--header "kbn-xsrf: true"
The identifier for the rule.
curl \
--request POST https://<KIBANA_URL>/api/alerting/rule/{id}/_enable \
--header "kbn-xsrf: true"
The identifier for the rule.
curl \
--request POST https://<KIBANA_URL>/api/alerting/rule/{id}/_mute_all \
--header "kbn-xsrf: true"
The identifier for the rule.
curl \
--request POST https://<KIBANA_URL>/api/alerting/rule/{id}/_unmute_all \
--header "kbn-xsrf: true"
Adjust APM agent configuration without need to redeploy your application.
Configure APM agent keys to authorize requests from APM agents to the APM Server.
The version of the API to use
Value is 2023-10-31
. Default value is 2023-10-31
.
A required header to protect against CSRF attacks
Source map identifier
Successful response
Additional properties are NOT allowed.
Bad Request response
Unauthorized response
Forbidden response
Internal Server Error response
Not Implemented response
curl \
--request DELETE https://<KIBANA_URL>/api/apm/sourcemaps/{id} \
--header "elastic-api-version: 2023-10-31" \
--header "kbn-xsrf: true"
{}
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "string",
"statusCode": 403
}
{
"error": "Internal Server Error",
"message": "string",
"statusCode": 500
}
{
"error": "Not Implemented",
"message": "Not Implemented",
"statusCode": 501
}
Connectors provide a central place to store connection information for services and integrations with Elastic or third party systems. Alerting rules can use connectors to run actions when rule conditions are met.
An identifier for the connector.
curl \
--request GET https://<KIBANA_URL>/api/actions/connector/{id}
{
"id": "df770e30-8b8b-11ed-a780-3b746c987a81",
"name": "my_server_log_connector",
"config": {},
"is_deprecated": false,
"is_preconfigured": false,
"is_system_action": false,
"connector_type_id": ".server-log",
"is_missing_secrets": false
}
An identifier for the connector.
The display name for the connector.
The connector configuration details.
Defines properties for connectors when type is .bedrock
.
Defines secrets for connectors when type is .bedrock
.
curl \
--request PUT https://<KIBANA_URL>/api/actions/connector/{id} \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"name":"updated-connector","config":{"index":"updated-index"}}'
{
"name": "updated-connector",
"config": {
"index": "updated-index"
}
}
{
"config": {},
"connector_type_id": "string",
"id": "string",
"is_deprecated": true,
"is_missing_secrets": true,
"is_preconfigured": true,
"is_system_action": true,
"name": "string"
}
An identifier for the connector.
The type of connector.
The display name for the connector.
The connector configuration details.
Defines properties for connectors when type is .bedrock
.
Defines secrets for connectors when type is .bedrock
.
curl \
--request POST https://<KIBANA_URL>/api/actions/connector/{id} \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"name":"email-connector-1","config":{"from":"tester@example.com","host":"https://example.com","port":1025,"secure":false,"hasAuth":true,"service":"other"},"secrets":{"user":"username","password":"password"},"connector_type_id":".email"}'
{
"name": "email-connector-1",
"config": {
"from": "tester@example.com",
"host": "https://example.com",
"port": 1025,
"secure": false,
"hasAuth": true,
"service": "other"
},
"secrets": {
"user": "username",
"password": "password"
},
"connector_type_id": ".email"
}
{
"name": "my-connector",
"config": {
"index": "test-index"
},
"connector_type_id": ".index"
}
{
"name": "my-webhook-connector",
"config": {
"url": "https://example.com",
"method": "post",
"authType": "webhook-authentication-ssl",
"certType": "ssl-crt-key"
},
"secrets": {
"crt": "QmFnIEF0dH...",
"key": "LS0tLS1CRUdJ...",
"password": "my-passphrase"
},
"connector_type_id": ".webhook"
}
{
"name": "my-xmatters-connector",
"config": {
"usesBasic": false
},
"secrets": {
"secretsUrl": "https://example.com?apiKey=xxxxx"
},
"connector_type_id": ".xmatters"
}
{
"id": "90a82c60-478f-11ee-a343-f98a117c727f",
"name": "email-connector-1",
"config": {
"from": "tester@example.com",
"host": "https://example.com",
"port": 1025,
"secure": false,
"hasAuth": true,
"service": "other",
"clientId": null,
"tenantId": null,
"oauthTokenUrl": null
},
"is_deprecated": false,
"is_preconfigured": false,
"is_system_action": false,
"connector_type_id": ".email",
"is_missing_secrets": false
}
{
"id": "c55b6eb0-6bad-11eb-9f3b-611eebc6c3ad",
"name": "my-connector",
"config": {
"index": "test-index",
"refresh": false,
"executionTimeField": null
},
"is_deprecated": false,
"is_preconfigured": false,
"is_system_action": false,
"connector_type_id": ".index",
"is_missing_secrets": false
}
{
"id": "900eb010-3b9d-11ee-a642-8ffbb94e38bd",
"name": "my-webhook-connector",
"config": {
"url": "https://example.com",
"method": "post",
"hasAuth": true,
"headers": null,
"authType": "webhook-authentication-ssl",
"certType": "ssl-crt-key",
"verificationMode": "full"
},
"is_deprecated": false,
"is_preconfigured": false,
"is_system_action": false,
"connector_type_id": ".webhook",
"is_missing_secrets": false
}
{
"id": "df770e30-8b8b-11ed-a780-3b746c987a81",
"name": "my_server_log_connector",
"config": {},
"is_deprecated": false,
"is_preconfigured": false,
"is_system_action": false,
"connector_type_id": ".server-log",
"is_missing_secrets": false
}
You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.
An identifier for the connector.
Test an action that acknowledges or resolves a PagerDuty alert.
curl \
--request POST https://<KIBANA_URL>/api/actions/connector/{id}/_execute \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"params":{"documents":[{"id":"my_doc_id","name":"my_doc_name","message":"hello, world"}]}}'
{
"params": {
"documents": [
{
"id": "my_doc_id",
"name": "my_doc_name",
"message": "hello, world"
}
]
}
}
{
"params": {
"subAction": "issueTypes"
}
}
{
"params": {
"subAction": "getChoices",
"subActionParams": {
"fields": [
"severity",
"urgency"
]
}
}
}
{
"params": {
"subAction": "postMessage",
"subActionParams": {
"text": "A test message.",
"channelIds": [
"C123ABC456"
]
}
}
}
{
"params": {
"subAction": "pushToService",
"subActionParams": {
"comments": [
{
"comment": "A comment about the incident.",
"commentId": 1
}
],
"incident": {
"caseId": "1000",
"caseName": "Case name",
"description": "Description of the incident."
}
}
}
}
{
"data": {
"took": 135,
"items": [
{
"create": {
"_id": "4JtvwYUBrcyxt2NnfW3y",
"_index": "my-index",
"result": "created",
"status": 201,
"_seq_no": 0,
"_shards": {
"total": 2,
"failed": 0,
"successful": 1
},
"_version": 1,
"_primary_term": 1
}
}
],
"errors": false
},
"status": "ok",
"connector_id": "fd38c600-96a5-11ed-bb79-353b74189cba"
}
{
"data": [
{
"id": 10024,
"name": "Improvement"
},
{
"id": 10006,
"name": "Task"
},
{
"id": 10007,
"name": "Sub-task"
},
{
"id": 10025,
"name": "New Feature"
},
{
"id": 10023,
"name": "Bug"
},
{
"id": 10000,
"name": "Epic"
}
],
"status": "ok",
"connector_id": "b3aad810-edbe-11ec-82d1-11348ecbf4a6"
}
{
"status": "ok",
"connector_id": "7fc7b9a0-ecc9-11ec-8736-e7d63118c907"
}
{
"data": [
{
"label": "Critical",
"value": 1,
"element": "severity",
"dependent_value": ""
},
{
"label": "Major",
"value": 2,
"element": "severity",
"dependent_value": ""
},
{
"label": "Minor",
"value": 3,
"element": "severity",
"dependent_value": ""
},
{
"label": "Warning",
"value": 4,
"element": "severity",
"dependent_value": ""
},
{
"label": "OK",
"value": 5,
"element": "severity",
"dependent_value": ""
},
{
"label": "Clear",
"value": 0,
"element": "severity",
"dependent_value": ""
},
{
"label": "1 - High",
"value": 1,
"element": "urgency",
"dependent_value": ""
},
{
"label": "2 - Medium",
"value": 2,
"element": "urgency",
"dependent_value": ""
},
{
"label": "3 - Low",
"value": 3,
"element": "urgency",
"dependent_value": ""
}
],
"status": "ok",
"connector_id": "9d9be270-2fd2-11ed-b0e0-87533c532698"
}
{
"data": {
"ok": true,
"ts": "1234567890.123456",
"channel": "C123ABC456",
"message": {
"ts": "1234567890.123456",
"team": "T01ABCDE2F",
"text": "A test message",
"type": "message",
"user": "U12A345BC6D",
"app_id": "A01BC2D34EF",
"blocks": [
{
"type": "rich_text",
"block_id": "/NXe",
"elements": [
{
"type": "rich_text_section",
"elements": [
{
"text": "A test message.",
"type": "text"
}
]
}
]
}
],
"bot_id": "B12BCDEFGHI",
"bot_profile": {
"id": "B12BCDEFGHI",
"name": "test",
"icons": {
"image_36": "https://a.slack-edge.com/80588/img/plugins/app/bot_36.png"
},
"app_id": "A01BC2D34EF",
"deleted": false,
"team_id": "T01ABCDE2F",
"updated": 1672169705
}
}
},
"status": "ok",
"connector_id": ".slack_api"
}
{
"data": {
"id": "aKPmBHWzmdRQtx6Mx",
"url": "https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx",
"title": "TEST-457",
"comments": [
{
"commentId": 1,
"pushedDate": "2022-09-08T16:52:27.865Z"
}
],
"pushedDate": "2022-09-08T16:52:27.866Z"
},
"status": "ok",
"connector_id": "a4746470-2f94-11ed-b0e0-87533c532698"
}
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
A unique identifier for the dashboard.
Additional properties are NOT allowed.
curl \
--request POST https://<KIBANA_URL>/api/dashboards/dashboard/{id} \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"attributes":{"controlGroupInput":{"autoApplySelections":true,"chainingSystem":"HIERARCHICAL","controls":[{"controlConfig":{},"grow":false,"id":"string","order":42.0,"type":"string","width":"medium"}],"enhancements":{},"ignoreParentSettings":{"ignoreFilters":false,"ignoreQuery":false,"ignoreTimerange":false,"ignoreValidations":false},"labelPosition":"oneLine"},"description":"","kibanaSavedObjectMeta":{"searchSource":{"filter":[{"$state":{"store":"appState"},"meta":{"alias":"string","controlledBy":"string","disabled":true,"field":"string","group":"string","index":"string","isMultiIndex":true,"key":"string","negate":true,"type":"string","value":"string"},"query":{}}],"query":{"language":"string","query":"string"},"sort":[{}],"type":"string"}},"options":{"hidePanelTitles":false,"syncColors":true,"syncCursor":true,"syncTooltips":true,"useMargins":true},"panels":[{"gridData":{"h":15,"i":"string","w":24,"x":42.0,"y":42.0},"id":"string","panelConfig":{"description":"string","enhancements":{},"hidePanelTitles":true,"savedObjectId":"string","title":"string","version":"string"},"panelIndex":"string","panelRefName":"string","title":"string","type":"string","version":"string"}],"refreshInterval":{"display":"string","pause":true,"section":42.0,"value":42.0},"timeFrom":"string","timeRestore":false,"timeTo":"string","title":"string","version":42.0},"references":[{"id":"string","name":"string","type":"string"}],"spaces":["string"]}'
# Headers
kbn-xsrf: true
# Payload
{
"attributes": {
"controlGroupInput": {
"autoApplySelections": true,
"chainingSystem": "HIERARCHICAL",
"controls": [
{
"controlConfig": {},
"grow": false,
"id": "string",
"order": 42.0,
"type": "string",
"width": "medium"
}
],
"enhancements": {},
"ignoreParentSettings": {
"ignoreFilters": false,
"ignoreQuery": false,
"ignoreTimerange": false,
"ignoreValidations": false
},
"labelPosition": "oneLine"
},
"description": "",
"kibanaSavedObjectMeta": {
"searchSource": {
"filter": [
{
"$state": {
"store": "appState"
},
"meta": {
"alias": "string",
"controlledBy": "string",
"disabled": true,
"field": "string",
"group": "string",
"index": "string",
"isMultiIndex": true,
"key": "string",
"negate": true,
"type": "string",
"value": "string"
},
"query": {}
}
],
"query": {
"language": "string",
"query": "string"
},
"sort": [
{}
],
"type": "string"
}
},
"options": {
"hidePanelTitles": false,
"syncColors": true,
"syncCursor": true,
"syncTooltips": true,
"useMargins": true
},
"panels": [
{
"gridData": {
"h": 15,
"i": "string",
"w": 24,
"x": 42.0,
"y": 42.0
},
"id": "string",
"panelConfig": {
"description": "string",
"enhancements": {},
"hidePanelTitles": true,
"savedObjectId": "string",
"title": "string",
"version": "string"
},
"panelIndex": "string",
"panelRefName": "string",
"title": "string",
"type": "string",
"version": "string"
}
],
"refreshInterval": {
"display": "string",
"pause": true,
"section": 42.0,
"value": 42.0
},
"timeFrom": "string",
"timeRestore": false,
"timeTo": "string",
"title": "string",
"version": 42.0
},
"references": [
{
"id": "string",
"name": "string",
"type": "string"
}
],
"spaces": [
"string"
]
}
{
"item": {
"attributes": {
"controlGroupInput": {
"autoApplySelections": true,
"chainingSystem": "HIERARCHICAL",
"controls": [
{
"controlConfig": {},
"grow": false,
"id": "string",
"order": 42.0,
"type": "string",
"width": "medium"
}
],
"enhancements": {},
"ignoreParentSettings": {
"ignoreFilters": false,
"ignoreQuery": false,
"ignoreTimerange": false,
"ignoreValidations": false
},
"labelPosition": "oneLine"
},
"description": "",
"kibanaSavedObjectMeta": {
"searchSource": {
"filter": [
{
"$state": {
"store": "appState"
},
"meta": {
"alias": "string",
"controlledBy": "string",
"disabled": true,
"field": "string",
"group": "string",
"index": "string",
"isMultiIndex": true,
"key": "string",
"negate": true,
"type": "string",
"value": "string"
},
"query": {}
}
],
"query": {
"language": "string",
"query": "string"
},
"sort": [
{}
],
"type": "string"
}
},
"options": {
"hidePanelTitles": false,
"syncColors": true,
"syncCursor": true,
"syncTooltips": true,
"useMargins": true
},
"panels": [
{
"gridData": {
"h": 15,
"i": "string",
"w": 24,
"x": 42.0,
"y": 42.0
},
"id": "string",
"panelConfig": {
"description": "string",
"enhancements": {},
"hidePanelTitles": true,
"savedObjectId": "string",
"title": "string",
"version": "string"
},
"panelIndex": "string",
"panelRefName": "string",
"title": "string",
"type": "string",
"version": "string"
}
],
"refreshInterval": {
"display": "string",
"pause": true,
"section": 42.0,
"value": 42.0
},
"timeFrom": "string",
"timeRestore": false,
"timeTo": "string",
"title": "string",
"version": 42.0
},
"createdAt": "string",
"createdBy": "string",
"error": {
"error": "string",
"message": "string",
"metadata": {},
"statusCode": 42.0
},
"id": "string",
"managed": true,
"namespaces": [
"string"
],
"originId": "string",
"references": [
{
"id": "string",
"name": "string",
"type": "string"
}
],
"type": "string",
"updatedAt": "string",
"updatedBy": "string",
"version": "string"
}
}
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
A unique identifier for the dashboard.
curl \
--request DELETE https://<KIBANA_URL>/api/dashboards/dashboard/{id} \
--header "kbn-xsrf: true"
curl \
--request POST https://<KIBANA_URL>/api/data_views/data_view \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"data_view":{"name":"My Logstash data view","title":"logstash-*","runtimeFieldMap":{"runtime_shape_name":{"type":"keyword","script":{"source":"emit(doc['shape_name'].value)"}}}}}'
{
"data_view": {
"name": "My Logstash data view",
"title": "logstash-*",
"runtimeFieldMap": {
"runtime_shape_name": {
"type": "keyword",
"script": {
"source": "emit(doc['shape_name'].value)"
}
}
}
}
}
{
"data_view": {
"allowNoIndex": true,
"fieldAttrs": {
"additionalProperty1": {
"count": 42,
"customDescription": "string",
"customLabel": "string"
},
"additionalProperty2": {
"count": 42,
"customDescription": "string",
"customLabel": "string"
}
},
"fieldFormats": {},
"fields": {},
"id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f",
"name": "string",
"namespaces": [
"default"
],
"runtimeFieldMap": {
"additionalProperty1": {
"script": {
"source": "string"
},
"type": "string"
},
"additionalProperty2": {
"script": {
"source": "string"
},
"type": "string"
}
},
"sourceFilters": [
{
"value": "string"
}
],
"timeFieldName": "string",
"title": "string",
"typeMeta": {
"aggs": {},
"params": {}
},
"version": "WzQ2LDJd"
}
}
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}
An identifier for the data view.
curl \
--request GET https://<KIBANA_URL>/api/data_views/data_view/ff959d40-b880-11e8-a6d9-e546fe2bba5f
{
"data_view": {
"id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f",
"name": "Kibana Sample Data eCommerce",
"title": "kibana_sample_data_ecommerce",
"fields": {
"_id": {
"name": "_id",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"_id"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"sku": {
"name": "sku",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"type": {
"name": "type",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"user": {
"name": "user",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"email": {
"name": "email",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"_index": {
"name": "_index",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"_index"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": false
},
"_score": {
"name": "_score",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"isMapped": true,
"scripted": false,
"searchable": false,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"_source": {
"name": "_source",
"type": "_source",
"count": 0,
"format": {
"id": "_source"
},
"esTypes": [
"_source"
],
"isMapped": true,
"scripted": false,
"searchable": false,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"category": {
"name": "category",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"currency": {
"name": "currency",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"order_id": {
"name": "order_id",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"order_date": {
"name": "order_date",
"type": "date",
"count": 0,
"format": {
"id": "date"
},
"esTypes": [
"date"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_id": {
"name": "customer_id",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"day_of_week": {
"name": "day_of_week",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"manufacturer": {
"name": "manufacturer",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products._id": {
"name": "products._id",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.sku": {
"name": "products.sku",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"day_of_week_i": {
"name": "day_of_week_i",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"integer"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"event.dataset": {
"name": "event.dataset",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_phone": {
"name": "customer_phone",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"geoip.location": {
"name": "geoip.location",
"type": "geo_point",
"count": 0,
"format": {
"id": "geo_point",
"params": {
"transform": "wkt"
}
},
"esTypes": [
"geo_point"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.price": {
"name": "products.price",
"type": "number",
"count": 1,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"total_quantity": {
"name": "total_quantity",
"type": "number",
"count": 1,
"format": {
"id": "number"
},
"esTypes": [
"integer"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_gender": {
"name": "customer_gender",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"geoip.city_name": {
"name": "geoip.city_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"category.keyword": {
"name": "category.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "category"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"geoip.region_name": {
"name": "geoip.region_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.category": {
"name": "products.category",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.quantity": {
"name": "products.quantity",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"integer"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_full_name": {
"name": "customer_full_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"customer_last_name": {
"name": "customer_last_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.min_price": {
"name": "products.min_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"taxful_total_price": {
"name": "taxful_total_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.[00]"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_birth_date": {
"name": "customer_birth_date",
"type": "date",
"count": 0,
"format": {
"id": "date"
},
"esTypes": [
"date"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_first_name": {
"name": "customer_first_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.base_price": {
"name": "products.base_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.created_on": {
"name": "products.created_on",
"type": "date",
"count": 0,
"format": {
"id": "date"
},
"esTypes": [
"date"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.product_id": {
"name": "products.product_id",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"long"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.tax_amount": {
"name": "products.tax_amount",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"taxless_total_price": {
"name": "taxless_total_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"geoip.continent_name": {
"name": "geoip.continent_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"manufacturer.keyword": {
"name": "manufacturer.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "manufacturer"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products._id.keyword": {
"name": "products._id.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "products._id"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.manufacturer": {
"name": "products.manufacturer",
"type": "string",
"count": 1,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.product_name": {
"name": "products.product_name",
"type": "string",
"count": 1,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.taxful_price": {
"name": "products.taxful_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"total_unique_products": {
"name": "total_unique_products",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"integer"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"geoip.country_iso_code": {
"name": "geoip.country_iso_code",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.taxless_price": {
"name": "products.taxless_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.base_unit_price": {
"name": "products.base_unit_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.discount_amount": {
"name": "products.discount_amount",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.category.keyword": {
"name": "products.category.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "products.category"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_full_name.keyword": {
"name": "customer_full_name.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "customer_full_name"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_last_name.keyword": {
"name": "customer_last_name.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "customer_last_name"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_first_name.keyword": {
"name": "customer_first_name.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "customer_first_name"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.discount_percentage": {
"name": "products.discount_percentage",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.manufacturer.keyword": {
"name": "products.manufacturer.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "products.manufacturer"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.product_name.keyword": {
"name": "products.product_name.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "products.product_name"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.unit_discount_amount": {
"name": "products.unit_discount_amount",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
}
},
"version": "WzUsMV0=",
"typeMeta": {},
"fieldAttrs": {
"products.price": {
"count": 1
},
"total_quantity": {
"count": 1
},
"products.manufacturer": {
"count": 1
},
"products.product_name": {
"count": 1
}
},
"namespaces": [
"default"
],
"allowNoIndex": false,
"fieldFormats": {
"products.price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.min_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"taxful_total_price": {
"id": "number",
"params": {
"pattern": "$0,0.[00]"
}
},
"products.base_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"taxless_total_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.taxful_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.taxless_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.base_unit_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
}
},
"sourceFilters": [],
"timeFieldName": "order_date",
"runtimeFieldMap": {}
}
}
{
"error": "Not Found",
"message": "Saved object [index-pattern/caaad6d0-920c-11ed-b36a-874bd1548a00] not found",
"statusCode": 404
}
An identifier for the data view.
The data view properties you want to update. Only the specified properties are updated in the data view. Unspecified fields stay as they are persisted.
Additional properties are allowed.
Reloads the data view fields after the data view is updated.
Default value is false
.
curl \
--request POST https://<KIBANA_URL>/api/data_views/data_view/ff959d40-b880-11e8-a6d9-e546fe2bba5f \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"data_view":{"name":"Kibana Sample Data eCommerce","title":"kibana_sample_data_ecommerce","allowNoIndex":false,"timeFieldName":"order_date"},"refresh_fields":true}'
{
"data_view": {
"name": "Kibana Sample Data eCommerce",
"title": "kibana_sample_data_ecommerce",
"allowNoIndex": false,
"timeFieldName": "order_date"
},
"refresh_fields": true
}
{
"data_view": {
"allowNoIndex": true,
"fieldAttrs": {
"additionalProperty1": {
"count": 42,
"customDescription": "string",
"customLabel": "string"
},
"additionalProperty2": {
"count": 42,
"customDescription": "string",
"customLabel": "string"
}
},
"fieldFormats": {},
"fields": {},
"id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f",
"name": "string",
"namespaces": [
"default"
],
"runtimeFieldMap": {
"additionalProperty1": {
"script": {
"source": "string"
},
"type": "string"
},
"additionalProperty2": {
"script": {
"source": "string"
},
"type": "string"
}
},
"sourceFilters": [
{
"value": "string"
}
],
"timeFieldName": "string",
"title": "string",
"typeMeta": {
"aggs": {},
"params": {}
},
"version": "WzQ2LDJd"
}
}
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}
The ID of the data view fields you want to update.
The name for a runtime field.
The runtime field definition object.
Additional properties are allowed.
curl \
--request PUT https://<KIBANA_URL>/api/data_views/data_view/{viewId}/runtime_field \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"name":"runtimeFoo","runtimeField":{"type":"long","script":{"source":"emit(doc[\"foo\"].value)"}}}'
{
"name": "runtimeFoo",
"runtimeField": {
"type": "long",
"script": {
"source": "emit(doc[\"foo\"].value)"
}
}
}
{
"data_view": {},
"fields": [
{}
]
}
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}
An identifier for the data view.
The name for a runtime field.
The runtime field definition object.
Additional properties are allowed.
curl \
--request POST https://<KIBANA_URL>/api/data_views/data_view/ff959d40-b880-11e8-a6d9-e546fe2bba5f/runtime_field \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"name":"runtimeFoo","runtimeField":{"type":"long","script":{"source":"emit(doc[\"foo\"].value)"}}}'
{
"name": "runtimeFoo",
"runtimeField": {
"type": "long",
"script": {
"source": "emit(doc[\"foo\"].value)"
}
}
}
{}
[Required authorization] Route required privileges: ALL of [fleet-agents-all].
curl \
--request POST https://<KIBANA_URL>/api/fleet/agents/{agentId}/upgrade \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"force":true,"skipRateLimitCheck":true,"source_uri":"string","version":"string"}'
# Headers
kbn-xsrf: true
# Payload
{
"force": true,
"skipRateLimitCheck": true,
"source_uri": "string",
"version": "string"
}
{}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ALL of [fleet-agents-all].
Default value is false
.
Minimum value is 600
.
curl \
--request POST https://<KIBANA_URL>/api/fleet/agents/bulk_upgrade \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"agents":["string"],"batchSize":42.0,"force":true,"includeInactive":false,"rollout_duration_seconds":42.0,"skipRateLimitCheck":true,"source_uri":"string","start_time":"string","version":"string"}'
# Headers
kbn-xsrf: true
# Payload
{
"agents": [
"string"
],
"batchSize": 42.0,
"force": true,
"includeInactive": false,
"rollout_duration_seconds": 42.0,
"skipRateLimitCheck": true,
"source_uri": "string",
"start_time": "string",
"version": "string"
}
{
"actionId": "string"
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ANY of [fleet-agent-policies-read OR fleet-settings-read].
curl \
--request GET https://<KIBANA_URL>/api/fleet/agent_download_sources
{
"items": [
{
"host": "https://example.com",
"id": "string",
"is_default": false,
"name": "string",
"proxy_id": "string"
}
],
"page": 42.0,
"perPage": 42.0,
"total": 42.0
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Update an agent binary download source by ID.
[Required authorization] Route required privileges: ALL of [fleet-settings-all].
curl \
--request PUT https://<KIBANA_URL>/api/fleet/agent_download_sources/{sourceId} \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"host":"https://example.com","id":"string","is_default":false,"name":"string","proxy_id":"string"}'
# Headers
kbn-xsrf: true
# Payload
{
"host": "https://example.com",
"id": "string",
"is_default": false,
"name": "string",
"proxy_id": "string"
}
{
"item": {
"host": "https://example.com",
"id": "string",
"is_default": false,
"name": "string",
"proxy_id": "string"
}
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ANY of [fleet-agent-policies-read OR fleet-agents-read OR fleet-setup].
Values are simplified
or legacy
.
get full policies with package policies populated
list of package policy ids
curl \
--request POST https://<KIBANA_URL>/api/fleet/agent_policies/_bulk_get \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"full":true,"ids":["string"],"ignoreMissing":true}'
# Headers
kbn-xsrf: true
# Payload
{
"full": true,
"ids": [
"string"
],
"ignoreMissing": true
}
{
"items": [
{
"advanced_settings": {},
"agent_features": [
{
"enabled": true,
"name": "string"
}
],
"agentless": {
"resources": {
"requests": {
"cpu": "string",
"memory": "string"
}
}
},
"agents": 42.0,
"data_output_id": "string",
"description": "string",
"download_source_id": "string",
"fleet_server_host_id": "string",
"global_data_tags": [
{
"name": "string",
"value": "string"
}
],
"has_fleet_server": true,
"id": "string",
"inactivity_timeout": 1209600,
"is_default": true,
"is_default_fleet_server": true,
"is_managed": true,
"is_preconfigured": true,
"is_protected": true,
"keep_monitoring_alive": false,
"monitoring_diagnostics": {
"limit": {
"burst": 42.0,
"interval": "string"
},
"uploader": {
"init_dur": "string",
"max_dur": "string",
"max_retries": 42.0
}
},
"monitoring_enabled": [
"logs"
],
"monitoring_http": {
"buffer": {
"enabled": false
},
"enabled": true,
"host": "string",
"port": 42.0
},
"monitoring_output_id": "string",
"monitoring_pprof_enabled": true,
"name": "string",
"namespace": "string",
"overrides": {},
"package_policies": [
"string"
],
"required_versions": [
{
"percentage": 42.0,
"version": "string"
}
],
"revision": 42.0,
"schema_version": "string",
"space_ids": [
"string"
],
"status": "active",
"supports_agentless": false,
"unenroll_timeout": 42.0,
"unprivileged_agents": 42.0,
"updated_at": "string",
"updated_by": "string",
"version": "string"
}
]
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Get an agent policy by ID.
[Required authorization] Route required privileges: ANY of [fleet-agent-policies-read OR fleet-agents-read OR fleet-setup].
Values are simplified
or legacy
.
curl \
--request GET https://<KIBANA_URL>/api/fleet/agent_policies/{agentPolicyId}
{
"item": {
"advanced_settings": {},
"agent_features": [
{
"enabled": true,
"name": "string"
}
],
"agentless": {
"resources": {
"requests": {
"cpu": "string",
"memory": "string"
}
}
},
"agents": 42.0,
"data_output_id": "string",
"description": "string",
"download_source_id": "string",
"fleet_server_host_id": "string",
"global_data_tags": [
{
"name": "string",
"value": "string"
}
],
"has_fleet_server": true,
"id": "string",
"inactivity_timeout": 1209600,
"is_default": true,
"is_default_fleet_server": true,
"is_managed": true,
"is_preconfigured": true,
"is_protected": true,
"keep_monitoring_alive": false,
"monitoring_diagnostics": {
"limit": {
"burst": 42.0,
"interval": "string"
},
"uploader": {
"init_dur": "string",
"max_dur": "string",
"max_retries": 42.0
}
},
"monitoring_enabled": [
"logs"
],
"monitoring_http": {
"buffer": {
"enabled": false
},
"enabled": true,
"host": "string",
"port": 42.0
},
"monitoring_output_id": "string",
"monitoring_pprof_enabled": true,
"name": "string",
"namespace": "string",
"overrides": {},
"package_policies": [
"string"
],
"required_versions": [
{
"percentage": 42.0,
"version": "string"
}
],
"revision": 42.0,
"schema_version": "string",
"space_ids": [
"string"
],
"status": "active",
"supports_agentless": false,
"unenroll_timeout": 42.0,
"unprivileged_agents": 42.0,
"updated_at": "string",
"updated_by": "string",
"version": "string"
}
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Download an agent policy by ID.
[Required authorization] Route required privileges: ALL of [fleet-agent-policies-read, fleet-setup].
curl \
--request GET https://<KIBANA_URL>/api/fleet/agent_policies/{agentPolicyId}/download
string
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ALL of [fleet-agent-policies-read, fleet-setup].
curl \
--request GET https://<KIBANA_URL>/api/fleet/kubernetes
{
"item": "string"
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ALL of [fleet-agents-read].
Default value is 1
.
Default value is 20
.
Default value is false
.
Default value is false
.
Default value is false
.
Default value is false
.
Values are asc
or desc
.
curl \
--request GET https://<KIBANA_URL>/api/fleet/agents
{
"items": [
{
"access_api_key": "string",
"access_api_key_id": "string",
"active": true,
"agent": {
"id": "string",
"version": "string"
},
"audit_unenrolled_reason": "string",
"components": [
{
"id": "string",
"message": "string",
"status": "STARTING",
"type": "string",
"units": [
{
"id": "string",
"message": "string",
"payload": {},
"status": "STARTING",
"type": "input"
}
]
}
],
"default_api_key": "string",
"default_api_key_history": [
{
"id": "string",
"retired_at": "string"
}
],
"default_api_key_id": "string",
"enrolled_at": "string",
"id": "string",
"last_checkin": "string",
"last_checkin_message": "string",
"last_checkin_status": "error",
"local_metadata": {},
"metrics": {
"cpu_avg": 42.0,
"memory_size_byte_avg": 42.0
},
"namespaces": [
"string"
],
"outputs": {
"additionalProperty1": {
"api_key_id": "string",
"to_retire_api_key_ids": [
{
"id": "string",
"retired_at": "string"
}
],
"type": "string"
},
"additionalProperty2": {
"api_key_id": "string",
"to_retire_api_key_ids": [
{
"id": "string",
"retired_at": "string"
}
],
"type": "string"
}
},
"packages": [
"string"
],
"policy_id": "string",
"policy_revision": 42.0,
"sort": [
42.0
],
"status": "offline",
"tags": [
"string"
],
"type": "PERMANENT",
"unenrolled_at": "string",
"unenrollment_started_at": "string",
"unhealthy_reason": [
"input"
],
"upgrade_details": {
"action_id": "string",
"metadata": {
"download_percent": 42.0,
"download_rate": 42.0,
"error_msg": "string",
"failed_state": "UPG_REQUESTED",
"retry_error_msg": "string",
"retry_until": "string",
"scheduled_at": "string"
},
"state": "UPG_REQUESTED",
"target_version": "string"
},
"upgrade_started_at": "string",
"upgraded_at": "string",
"user_provided_metadata": {}
}
],
"page": 42.0,
"perPage": 42.0,
"statusSummary": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
},
"total": 42.0
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Get an agent by ID.
[Required authorization] Route required privileges: ALL of [fleet-agents-read].
Default value is false
.
curl \
--request GET https://<KIBANA_URL>/api/fleet/agents/{agentId}
{
"item": {
"access_api_key": "string",
"access_api_key_id": "string",
"active": true,
"agent": {
"id": "string",
"version": "string"
},
"audit_unenrolled_reason": "string",
"components": [
{
"id": "string",
"message": "string",
"status": "STARTING",
"type": "string",
"units": [
{
"id": "string",
"message": "string",
"payload": {},
"status": "STARTING",
"type": "input"
}
]
}
],
"default_api_key": "string",
"default_api_key_history": [
{
"id": "string",
"retired_at": "string"
}
],
"default_api_key_id": "string",
"enrolled_at": "string",
"id": "string",
"last_checkin": "string",
"last_checkin_message": "string",
"last_checkin_status": "error",
"local_metadata": {},
"metrics": {
"cpu_avg": 42.0,
"memory_size_byte_avg": 42.0
},
"namespaces": [
"string"
],
"outputs": {
"additionalProperty1": {
"api_key_id": "string",
"to_retire_api_key_ids": [
{
"id": "string",
"retired_at": "string"
}
],
"type": "string"
},
"additionalProperty2": {
"api_key_id": "string",
"to_retire_api_key_ids": [
{
"id": "string",
"retired_at": "string"
}
],
"type": "string"
}
},
"packages": [
"string"
],
"policy_id": "string",
"policy_revision": 42.0,
"sort": [
42.0
],
"status": "offline",
"tags": [
"string"
],
"type": "PERMANENT",
"unenrolled_at": "string",
"unenrollment_started_at": "string",
"unhealthy_reason": [
"input"
],
"upgrade_details": {
"action_id": "string",
"metadata": {
"download_percent": 42.0,
"download_rate": 42.0,
"error_msg": "string",
"failed_state": "UPG_REQUESTED",
"retry_error_msg": "string",
"retry_until": "string",
"scheduled_at": "string"
},
"state": "UPG_REQUESTED",
"target_version": "string"
},
"upgrade_started_at": "string",
"upgraded_at": "string",
"user_provided_metadata": {}
}
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Delete an agent by ID.
[Required authorization] Route required privileges: ALL of [fleet-agents-all].
curl \
--request DELETE https://<KIBANA_URL>/api/fleet/agents/{agentId} \
--header "kbn-xsrf: true"
{
"action": "deleted"
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Delete a file uploaded by an agent.
[Required authorization] Route required privileges: ALL of [fleet-agents-all].
curl \
--request DELETE https://<KIBANA_URL>/api/fleet/agents/files/{fileId} \
--header "kbn-xsrf: true"
{
"deleted": true,
"id": "string"
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ANY of [fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup].
curl \
--request GET https://<KIBANA_URL>/api/fleet/agents/setup
{
"is_secrets_storage_enabled": true,
"is_space_awareness_enabled": true,
"isReady": true,
"missing_optional_features": [
"encrypted_saved_object_encryption_key_required"
],
"missing_requirements": [
"security_required"
],
"package_verification_key_id": "string"
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ANY of [fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup].
curl \
--request POST https://<KIBANA_URL>/api/fleet/agents/setup \
--header "kbn-xsrf: true"
{
"isInitialized": true,
"nonFatalErrors": [
{
"message": "string",
"name": "string"
}
]
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ALL of [integrations-all, fleet-agent-policies-all].
Default value is false
.
Default value is false
.
Default value is false
.
Default value is false
.
curl \
--request POST https://<KIBANA_URL>/api/fleet/epm/packages/{pkgName}/{pkgVersion} \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"force":false,"ignore_constraints":false}'
# Headers
kbn-xsrf: true
# Payload
{
"force": false,
"ignore_constraints": false
}
{
"_meta": {
"install_source": "string"
},
"items": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
]
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ALL of [integrations-all, fleet-agent-policies-all].
curl \
--request DELETE https://<KIBANA_URL>/api/fleet/epm/packages/{pkgName}/{pkgVersion} \
--header "kbn-xsrf: true"
{
"items": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
]
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
curl \
--request POST https://<KIBANA_URL>/api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"transforms":[{"transformId":"string"}]}'
# Headers
kbn-xsrf: true
# Payload
{
"transforms": [
{
"transformId": "string"
}
]
}
[
{
"success": true,
"transformId": "string"
}
]
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ANY of [fleet-agents-all OR fleet-setup].
curl \
--request GET https://<KIBANA_URL>/api/fleet/enrollment_api_keys
{
"items": [
{
"active": true,
"api_key": "string",
"api_key_id": "string",
"created_at": "string",
"id": "string",
"name": "string",
"policy_id": "string"
}
],
"list": [
{
"active": true,
"api_key": "string",
"api_key_id": "string",
"created_at": "string",
"id": "string",
"name": "string",
"policy_id": "string"
}
],
"page": 42.0,
"perPage": 42.0,
"total": 42.0
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ALL of [fleet-agents-all].
curl \
--request POST https://<KIBANA_URL>/api/fleet/enrollment_api_keys \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"expiration":"string","name":"string","policy_id":"string"}'
# Headers
kbn-xsrf: true
# Payload
{
"expiration": "string",
"name": "string",
"policy_id": "string"
}
{
"action": "created",
"item": {
"active": true,
"api_key": "string",
"api_key_id": "string",
"created_at": "string",
"id": "string",
"name": "string",
"policy_id": "string"
}
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Get an enrollment API key by ID.
[Required authorization] Route required privileges: ANY of [fleet-agents-all OR fleet-setup].
curl \
--request GET https://<KIBANA_URL>/api/fleet/enrollment_api_keys/{keyId}
{
"item": {
"active": true,
"api_key": "string",
"api_key_id": "string",
"created_at": "string",
"id": "string",
"name": "string",
"policy_id": "string"
}
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Update a proxy by ID.
[Required authorization] Route required privileges: ALL of [fleet-settings-all].
curl \
--request PUT https://<KIBANA_URL>/api/fleet/proxies/{itemId} \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"certificate":"string","certificate_authorities":"string","certificate_key":"string","name":"string","proxy_headers":{},"url":"string"}'
# Headers
kbn-xsrf: true
# Payload
{
"certificate": "string",
"certificate_authorities": "string",
"certificate_key": "string",
"name": "string",
"proxy_headers": {},
"url": "string"
}
{
"item": {
"certificate": "string",
"certificate_authorities": "string",
"certificate_key": "string",
"id": "string",
"is_preconfigured": false,
"name": "string",
"proxy_headers": {},
"url": "string"
}
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
[Required authorization] Route required privileges: ANY of [fleet-agents-all OR fleet-settings-read].
curl \
--request GET https://<KIBANA_URL>/api/fleet/fleet_server_hosts
{
"items": [
{
"host_urls": [
"string"
],
"id": "string",
"is_default": false,
"is_internal": true,
"is_preconfigured": false,
"name": "string",
"proxy_id": "string"
}
],
"page": 42.0,
"perPage": 42.0,
"total": 42.0
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Delete a Fleet Server host by ID.
[Required authorization] Route required privileges: ALL of [fleet-settings-all].
curl \
--request DELETE https://<KIBANA_URL>/api/fleet/fleet_server_hosts/{itemId} \
--header "kbn-xsrf: true"
{
"id": "string"
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Get one decrypted uninstall token by its ID.
[Required authorization] Route required privileges: ALL of [fleet-agents-all].
curl \
--request GET https://<KIBANA_URL>/api/fleet/uninstall_tokens/{uninstallTokenId}
{
"item": {
"created_at": "string",
"id": "string",
"namespaces": [
"string"
],
"policy_id": "string",
"policy_name": "string",
"token": "string"
}
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Synchronizes Kibana saved objects for machine learning jobs and trained models. This API runs automatically when you start Kibana and periodically thereafter.
When true, simulates the synchronization by returning only the list of actions that would be performed.
curl \
--request GET https://<KIBANA_URL>/api/ml/saved_objects/sync
{
"datafeedsAdded": {},
"datafeedsRemoved": {},
"savedObjectsCreated": {
"anomaly-detector": {
"myjob1": {
"success": true
},
"myjob2": {
"success": true
}
}
},
"savedObjectsDeleted": {}
}
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
The role name.
Minimum length is 1
.
If true
and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.
curl \
--request GET https://<KIBANA_URL>/api/security/role/{name}
Create a new Kibana role or update the attributes of an existing role. Kibana roles are stored in the Elasticsearch native realm.
The role name.
Minimum length is 1
, maximum length is 1024
.
When true, a role is not overwritten if it already exists.
Default value is false
.
A description for the role.
Maximum length is 2048
.
Additional properties are NOT allowed.
Additional properties are allowed.
curl \
--request PUT https://<KIBANA_URL>/api/security/role/{name} \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"description":"string","elasticsearch":{"cluster":["string"],"indices":[{"allow_restricted_indices":true,"field_security":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"names":["string"],"privileges":["string"],"query":"string"}],"remote_cluster":[{"clusters":["string"],"privileges":["string"]}],"remote_indices":[{"allow_restricted_indices":true,"clusters":["string"],"field_security":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"names":["string"],"privileges":["string"],"query":"string"}],"run_as":["string"]},"kibana":[{"base":[],"feature":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"spaces":["*"]}],"metadata":{}}'
# Headers
kbn-xsrf: true
# Payload
{
"description": "string",
"elasticsearch": {
"cluster": [
"string"
],
"indices": [
{
"allow_restricted_indices": true,
"field_security": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"names": [
"string"
],
"privileges": [
"string"
],
"query": "string"
}
],
"remote_cluster": [
{
"clusters": [
"string"
],
"privileges": [
"string"
]
}
],
"remote_indices": [
{
"allow_restricted_indices": true,
"clusters": [
"string"
],
"field_security": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"names": [
"string"
],
"privileges": [
"string"
],
"query": "string"
}
],
"run_as": [
"string"
]
},
"kibana": [
{
"base": [],
"feature": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"spaces": [
"*"
]
}
],
"metadata": {}
}
Retrieve sets of saved objects that you want to import into Kibana.
You must include type
or objects
in the request body.
Exported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.
NOTE: The savedObjects.maxImportExportSize
configuration setting limits the number of saved objects which may be exported.
Do not add export details entry at the end of the stream.
Default value is false
.
Includes all of the referenced objects in the exported objects.
A list of objects to export.
Additional properties are allowed.
The saved object types to include in the export. Use *
to export all the types.
curl \
--request POST https://<KIBANA_URL>/api/saved_objects/_export \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"objects":[{"id":"de71f4f0-1902-11e9-919b-ffe5949a18d2","type":"map"}],"excludeExportDetails":true,"includeReferencesDeep":false}'
{
"objects": [
{
"id": "de71f4f0-1902-11e9-919b-ffe5949a18d2",
"type": "map"
}
],
"excludeExportDetails": true,
"includeReferencesDeep": false
}
{
"id": "de71f4f0-1902-11e9-919b-ffe5949a18d2",
"type": "map",
"managed": false,
"version": "WzEzLDFd",
"attributes": {
"title": "[Logs] Total Requests and Bytes",
"description": "",
"uiStateJSON": "{\"isDarkMode\":false}",
"mapStateJSON": "{\"zoom\":3.64,\"center\":{\"lon\":-88.92107,\"lat\":42.16337},\"timeFilters\":{\"from\":\"now-7d\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"settings\":{\"autoFitToDataBounds\":false}}",
"layerListJSON": "[{\"id\":\"0hmz5\",\"alpha\":1,\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"visible\":true,\"style\":{},\"type\":\"EMS_VECTOR_TILE\",\"minZoom\":0,\"maxZoom\":24},{\"id\":\"edh66\",\"label\":\"Total Requests by Destination\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.5,\"sourceDescriptor\":{\"type\":\"EMS_FILE\",\"id\":\"world_countries\",\"tooltipProperties\":[\"name\",\"iso2\"]},\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"__kbnjoin__count__673ff994-fc75-4c67-909b-69fcb0e1060e\",\"origin\":\"join\"},\"color\":\"Greys\",\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":10}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}}}},\"type\":\"GEOJSON_VECTOR\",\"joins\":[{\"leftField\":\"iso2\",\"right\":{\"type\":\"ES_TERM_SOURCE\",\"id\":\"673ff994-fc75-4c67-909b-69fcb0e1060e\",\"indexPatternTitle\":\"kibana_sample_data_logs\",\"term\":\"geo.dest\",\"indexPatternRefName\":\"layer_1_join_0_index_pattern\",\"metrics\":[{\"type\":\"count\",\"label\":\"web logs count\"}],\"applyGlobalQuery\":true}}]},{\"id\":\"gaxya\",\"label\":\"Actual Requests\",\"minZoom\":9,\"maxZoom\":24,\"alpha\":1,\"sourceDescriptor\":{\"id\":\"b7486535-171b-4d3b-bb2e-33c1a0a2854c\",\"type\":\"ES_SEARCH\",\"geoField\":\"geo.coordinates\",\"limit\":2048,\"filterByMapBounds\":true,\"tooltipProperties\":[\"clientip\",\"timestamp\",\"host\",\"request\",\"response\",\"machine.os\",\"agent\",\"bytes\"],\"indexPatternRefName\":\"layer_2_source_index_pattern\",\"applyGlobalQuery\":true,\"scalingType\":\"LIMIT\"},\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#2200ff\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":2}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"bytes\",\"origin\":\"source\"},\"minSize\":1,\"maxSize\":23,\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}}}},\"type\":\"GEOJSON_VECTOR\"},{\"id\":\"tfi3f\",\"label\":\"Total Requests and Bytes\",\"minZoom\":0,\"maxZoom\":9,\"alpha\":1,\"sourceDescriptor\":{\"type\":\"ES_GEO_GRID\",\"resolution\":\"COARSE\",\"id\":\"8aaa65b5-a4e9-448b-9560-c98cb1c5ac5b\",\"geoField\":\"geo.coordinates\",\"requestType\":\"point\",\"metrics\":[{\"type\":\"count\",\"label\":\"web logs count\"},{\"type\":\"sum\",\"field\":\"bytes\"}],\"indexPatternRefName\":\"layer_3_source_index_pattern\",\"applyGlobalQuery\":true},\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"color\":\"Blues\",\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#cccccc\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"sum_of_bytes\",\"origin\":\"source\"},\"minSize\":7,\"maxSize\":25,\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"labelSize\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"minSize\":12,\"maxSize\":24,\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}}}},\"type\":\"GEOJSON_VECTOR\"}]"
},
"created_at": "2023-08-23T20:03:32.204Z",
"references": [
{
"id": "90943e30-9a47-11e8-b64d-95841ca0b247",
"name": "layer_1_join_0_index_pattern",
"type": "index-pattern"
},
{
"id": "90943e30-9a47-11e8-b64d-95841ca0b247",
"name": "layer_2_source_index_pattern",
"type": "index-pattern"
},
{
"id": "90943e30-9a47-11e8-b64d-95841ca0b247",
"name": "layer_3_source_index_pattern",
"type": "index-pattern"
}
],
"updated_at": "2023-08-23T20:03:32.204Z",
"coreMigrationVersion": "8.8.0",
"typeMigrationVersion": "8.4.0"
}
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}
Create a new Security AI Assistant conversation.
LLM API configuration.
Additional properties are allowed.
The conversation category.
Values are assistant
or insights
.
excludeFromLastConversationStorage.
The conversation id.
Is default conversation.
The conversation messages.
Replacements object used to anonymize/deanomymize messsages
The conversation title.
curl \
--request POST https://<KIBANA_URL>/api/security_ai_assistant/current_user/conversations \
--header "Content-Type: application/json" \
--data '{"apiConfig":{"actionTypeId":"string","connectorId":"string","defaultSystemPromptId":"string","model":"string","provider":"OpenAI"},"category":"assistant","excludeFromLastConversationStorage":true,"id":"string","isDefault":true,"messages":[{"content":"string","isError":true,"metadata":{"contentReferences":{}},"reader":{},"role":"system","timestamp":"string","traceData":{"traceId":"string","transactionId":"string"}}],"replacements":{"additionalProperty1":"string","additionalProperty2":"string"},"title":"string"}'
{
"apiConfig": {
"actionTypeId": "string",
"connectorId": "string",
"defaultSystemPromptId": "string",
"model": "string",
"provider": "OpenAI"
},
"category": "assistant",
"excludeFromLastConversationStorage": true,
"id": "string",
"isDefault": true,
"messages": [
{
"content": "string",
"isError": true,
"metadata": {
"contentReferences": {}
},
"reader": {},
"role": "system",
"timestamp": "string",
"traceData": {
"traceId": "string",
"transactionId": "string"
}
}
],
"replacements": {
"additionalProperty1": "string",
"additionalProperty2": "string"
},
"title": "string"
}
{
"apiConfig": {
"actionTypeId": "string",
"connectorId": "string",
"defaultSystemPromptId": "string",
"model": "string",
"provider": "OpenAI"
},
"category": "assistant",
"createdAt": "string",
"excludeFromLastConversationStorage": true,
"id": "string",
"isDefault": true,
"messages": [
{
"content": "string",
"isError": true,
"metadata": {
"contentReferences": {}
},
"reader": {},
"role": "system",
"timestamp": "string",
"traceData": {
"traceId": "string",
"transactionId": "string"
}
}
],
"namespace": "string",
"replacements": {
"additionalProperty1": "string",
"additionalProperty2": "string"
},
"summary": {
"confidence": "low",
"content": "string",
"public": true,
"timestamp": "string"
},
"timestamp": "string",
"title": "string",
"updatedAt": "string",
"users": [
{
"id": "string",
"name": "string"
}
]
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Update an existing conversation using the conversation ID.
The conversation's id
value.
Minimum length is 1
.
LLM API configuration.
Additional properties are allowed.
The conversation category.
Values are assistant
or insights
.
excludeFromLastConversationStorage.
A string that does not contain only whitespace characters
Minimum length is 1
.
The conversation messages.
Replacements object used to anonymize/deanomymize messsages
Additional properties are allowed.
The conversation title.
curl \
--request PUT https://<KIBANA_URL>/api/security_ai_assistant/current_user/conversations/{id} \
--header "Content-Type: application/json" \
--data '{"apiConfig":{"actionTypeId":"string","connectorId":"string","defaultSystemPromptId":"string","model":"string","provider":"OpenAI"},"category":"assistant","excludeFromLastConversationStorage":true,"id":"string","messages":[{"content":"string","isError":true,"metadata":{"contentReferences":{}},"reader":{},"role":"system","timestamp":"string","traceData":{"traceId":"string","transactionId":"string"}}],"replacements":{"additionalProperty1":"string","additionalProperty2":"string"},"summary":{"confidence":"low","content":"string","public":true,"timestamp":"string"},"title":"string"}'
{
"apiConfig": {
"actionTypeId": "string",
"connectorId": "string",
"defaultSystemPromptId": "string",
"model": "string",
"provider": "OpenAI"
},
"category": "assistant",
"excludeFromLastConversationStorage": true,
"id": "string",
"messages": [
{
"content": "string",
"isError": true,
"metadata": {
"contentReferences": {}
},
"reader": {},
"role": "system",
"timestamp": "string",
"traceData": {
"traceId": "string",
"transactionId": "string"
}
}
],
"replacements": {
"additionalProperty1": "string",
"additionalProperty2": "string"
},
"summary": {
"confidence": "low",
"content": "string",
"public": true,
"timestamp": "string"
},
"title": "string"
}
{
"apiConfig": {
"actionTypeId": "string",
"connectorId": "string",
"defaultSystemPromptId": "string",
"model": "string",
"provider": "OpenAI"
},
"category": "assistant",
"createdAt": "string",
"excludeFromLastConversationStorage": true,
"id": "string",
"isDefault": true,
"messages": [
{
"content": "string",
"isError": true,
"metadata": {
"contentReferences": {}
},
"reader": {},
"role": "system",
"timestamp": "string",
"traceData": {
"traceId": "string",
"transactionId": "string"
}
}
],
"namespace": "string",
"replacements": {
"additionalProperty1": "string",
"additionalProperty2": "string"
},
"summary": {
"confidence": "low",
"content": "string",
"public": true,
"timestamp": "string"
},
"timestamp": "string",
"title": "string",
"updatedAt": "string",
"users": [
{
"id": "string",
"name": "string"
}
]
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
The KnowledgeBase resource
value.
curl \
--request GET https://<KIBANA_URL>/api/security_ai_assistant/knowledge_base/{resource}
{
"elser_exists": true,
"index_exists": true,
"is_setup_available": true,
"is_setup_in_progress": true,
"pipeline_exists": true,
"security_labs_exists": true,
"user_data_exists": true
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Finds Knowledge Base Entries that match the given query.
Search query
Field to sort by
Values are created_at
, is_default
, title
, or updated_at
.
Sort order
Values are asc
or desc
.
Page number
Minimum value is 1
. Default value is 1
.
Knowledge Base Entries per page
Minimum value is 0
. Default value is 20
.
curl \
--request GET https://<KIBANA_URL>/api/security_ai_assistant/knowledge_base/entries/_find
{
"data": [
{
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"kbResource": "string",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}
],
"page": 42,
"perPage": 42,
"total": 42
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Read a Knowledge Base Entry
The Knowledge Base Entry's id
value.
Minimum length is 1
.
curl \
--request GET https://<KIBANA_URL>/api/security_ai_assistant/knowledge_base/entries/{id}
{
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"kbResource": "string",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}
{
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"description": "string",
"field": "string",
"index": "string",
"queryDescription": "string",
"type": "index",
"inputSchema": [
{
"description": "string",
"fieldName": "string",
"fieldType": "string"
}
],
"outputFields": [
"string"
]
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Update a Knowledge Base Entry
The Knowledge Base Entry's id
value
Minimum length is 1
.
A string that does not contain only whitespace characters
Minimum length is 1
.
Name of the Knowledge Base Entry
Kibana Space, defaults to 'default' space
Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Knowledge Base resource name for grouping entries, e.g. 'esql', 'lens-docs', etc
Source document name or filepath
Knowledge Base Entry content
Entry type
Value is document
.
Whether this resource should always be included, defaults to false
Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings
Additional properties are allowed.
curl \
--request PUT https://<KIBANA_URL>/api/security_ai_assistant/knowledge_base/entries/{id} \
--header "Content-Type: application/json" \
--data '{"id":"string","name":"string","namespace":"string","users":[{"id":"string","name":"string"}],"kbResource":"string","source":"string","text":"string","type":"document","required":true,"vector":{"modelId":"string","tokens":{"additionalProperty1":42.0,"additionalProperty2":42.0}}}'
{
"id": "string",
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"kbResource": "string",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}
{
"id": "string",
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"description": "string",
"field": "string",
"index": "string",
"queryDescription": "string",
"type": "index",
"inputSchema": [
{
"description": "string",
"fieldName": "string",
"fieldType": "string"
}
],
"outputFields": [
"string"
]
}
{
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"kbResource": "string",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}
{
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"description": "string",
"field": "string",
"index": "string",
"queryDescription": "string",
"type": "index",
"inputSchema": [
{
"description": "string",
"fieldName": "string",
"fieldType": "string"
}
],
"outputFields": [
"string"
]
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
Search query
Field to sort by
Values are created_at
, is_default
, name
, or updated_at
.
Sort order
Values are asc
or desc
.
Page number
Minimum value is 1
. Default value is 1
.
Prompts per page
Minimum value is 0
. Default value is 20
.
curl \
--request GET https://<KIBANA_URL>/api/security_ai_assistant/prompts/_find
{
"data": [
{
"categories": [
"string"
],
"color": "string",
"consumer": "string",
"content": "string",
"createdAt": "string",
"createdBy": "string",
"id": "string",
"isDefault": true,
"isNewConversationDefault": true,
"name": "string",
"namespace": "string",
"promptType": "system",
"timestamp": "string",
"updatedAt": "string",
"updatedBy": "string",
"users": [
{
"id": "string",
"name": "string"
}
]
}
],
"page": 42,
"perPage": 42,
"total": 42
}
{
"error": "string",
"message": "string",
"statusCode": 42.0
}
And tags to detection alerts, and remove them from alerts.
You cannot add and remove the same alert tag in the same request.
curl \
--request POST https://<KIBANA_URL>/api/detection_engine/signals/tags \
--header "Content-Type: application/json" \
--data '{"ids":["549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e"],"tags":{"tags_to_add":["Duplicate"],"tags_to_remove":[]}}'
{
"ids": [
"549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e"
],
"tags": {
"tags_to_add": [
"Duplicate"
],
"tags_to_remove": []
}
}
{
"ids": [
"549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e"
],
"tags": {
"tags_to_add": [],
"tags_to_remove": [
"Duplicate"
]
}
}
{
"took": "68,",
"noops": 0,
"total": "1,",
"batches": "1,",
"deleted": 0,
"retries": {
"bulk": 0,
"search": 0
},
"updated": "1,",
"failures": [],
"timed_out": "false,",
"throttled_millis": 0,
"version_conflicts": 0,
"requests_per_second": "-1,",
"throttled_until_millis": 0
}
{
"error": "string",
"message": "string",
"statusCode": 42
}
{
"message": "string",
"status_code": 42
}
{
"error": "string",
"message": "string",
"statusCode": 42
}
{
"message": "string",
"status_code": 42
}
Endpoint Exceptions API allows you to manage detection rule endpoint exceptions to prevent a rule from generating an alert from incoming events even when the rule's other criteria are met.
Additional properties are allowed.
curl \
--request GET https://<KIBANA_URL>/api/endpoint/action?query=%7B%7D
{}
Get the details of a response action using the action ID.
curl \
--request GET https://<KIBANA_URL>/api/endpoint/action/{action_id}
{}
The host agent type (optional). Defaults to endpoint.
Values are endpoint
, sentinel_one
, crowdstrike
, or microsoft_defender_endpoint
.
A list of alerts id
s.
At least 1
element. Minimum length of each is 1
.
Case IDs to be updated (cannot contain empty strings)
At least 1
element. Minimum length of each is 1
.
Optional comment
List of endpoint IDs (cannot contain empty strings)
At least 1
element. Minimum length of each is 1
.
Additional properties are allowed.
curl \
--request POST https://<KIBANA_URL>/api/endpoint/action/execute \
--header "Content-Type: application/json" \
--data '{"agent_type":"endpoint","alert_ids":["string"],"case_ids":["string"],"comment":"string","endpoint_ids":["string"],"parameters":{"command":"isolate","timeout":42}}'
{
"agent_type": "endpoint",
"alert_ids": [
"string"
],
"case_ids": [
"string"
],
"comment": "string",
"endpoint_ids": [
"string"
],
"parameters": {
"command": "isolate",
"timeout": 42
}
}
{}
Terminate a running process on an endpoint.
The host agent type (optional). Defaults to endpoint.
Values are endpoint
, sentinel_one
, crowdstrike
, or microsoft_defender_endpoint
.
A list of alerts id
s.
At least 1
element. Minimum length of each is 1
.
Case IDs to be updated (cannot contain empty strings)
At least 1
element. Minimum length of each is 1
.
Optional comment
List of endpoint IDs (cannot contain empty strings)
At least 1
element. Minimum length of each is 1
.
curl \
--request POST https://<KIBANA_URL>/api/endpoint/action/kill_process \
--header "Content-Type: application/json" \
--data '{"agent_type":"endpoint","alert_ids":["string"],"case_ids":["string"],"comment":"string","endpoint_ids":["string"],"parameters":{"pid":42}}'
{
"agent_type": "endpoint",
"alert_ids": [
"string"
],
"case_ids": [
"string"
],
"comment": "string",
"endpoint_ids": [
"string"
],
"parameters": {
"pid": 42
}
}
{}
Exactly one of 'Raw', 'HostPath', or 'CloudFile' must be provided. CommandLine and Timeout are optional for all.
curl \
--request POST https://<KIBANA_URL>/api/endpoint/action/runscript \
--header "Content-Type: application/json" \
--data '{"parameters":{"commandLine":"string","raw":"string","timeout":42}}'
{
"parameters": {
"commandLine": "string",
"raw": "string",
"timeout": 42
}
}
{}
curl \
--request GET https://<KIBANA_URL>/api/endpoint/metadata/{id}
{}
curl \
--request GET https://<KIBANA_URL>/api/endpoint/protection_updates_note/{package_policy_id}
{
"note": "string"
}
curl \
--request GET https://<KIBANA_URL>/api/entity_store/engines
{
"count": 42,
"engines": [
{
"delay": "1m",
"docsPerSecond": 42,
"error": {},
"fieldHistoryLength": 42,
"filter": "string",
"frequency": "1m",
"indexPattern": "string",
"lookbackPeriod": "24h",
"status": "installing",
"timeout": "180s",
"timestampField": "string",
"type": "user"
}
]
}
The entity type of the engine (either 'user' or 'host').
Values are user
, host
, service
, or universal
.
curl \
--request GET https://<KIBANA_URL>/api/entity_store/engines/{entityType}
{
"delay": "1m",
"docsPerSecond": 42,
"error": {},
"fieldHistoryLength": 42,
"filter": "string",
"frequency": "1m",
"indexPattern": "string",
"lookbackPeriod": "24h",
"status": "installing",
"timeout": "180s",
"timestampField": "string",
"type": "user"
}
The entity type of the engine (either 'user' or 'host').
Values are user
, host
, service
, or universal
.
Control flag to also delete the entity data.
curl \
--request DELETE https://<KIBANA_URL>/api/entity_store/engines/{entityType}
{
"deleted": true
}
The entity type of the engine
Values are user
, host
, service
, or universal
.
curl \
--request POST https://<KIBANA_URL>/api/entity_store/engines/{entityType}/start
{
"started": true
}
If true returns a detailed status of the engine including all it's components
curl \
--request GET https://<KIBANA_URL>/api/entity_store/status
{
"engines": [
{
"delay": "1m",
"docsPerSecond": 42,
"error": {},
"fieldHistoryLength": 42,
"filter": "string",
"frequency": "1m",
"indexPattern": "string",
"lookbackPeriod": "24h",
"status": "installing",
"timeout": "180s",
"timestampField": "string",
"type": "user",
"components": [
{
"errors": [
{
"message": "string",
"title": "string"
}
],
"health": "green",
"id": "string",
"installed": true,
"resource": "entity_engine"
}
]
}
],
"status": "not_installed"
}
An exception list groups exception items and can be associated with detection rules. You can assign exception lists to multiple detection rules.
All exception items added to the same list are evaluated using OR
logic. That is, if any of the items in a list evaluate to true
, the exception prevents the rule from generating an alert. Likewise, OR
logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the AND
operator, you can define multiple clauses (entries
) in a single exception item.
Exception list's properties
Describes the exception list.
Exception list's human readable string identifier, e.g. trusted-linux-processes
.
Minimum length is 1
.
Placeholder for metadata about the list container.
Additional properties are allowed.
The name of the exception list.
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single
: Only available in the Kibana space in which it is created.agnostic
: Available in all Kibana spaces.Values are agnostic
or single
. Default value is single
.
Use this field to specify the operating system.
Values are linux
, macos
, or windows
.
The type of exception list to be created. Different list types may denote where they can be utilized.
Values are detection
, rule_default
, endpoint
, endpoint_trusted_apps
, endpoint_events
, endpoint_host_isolation_exceptions
, or endpoint_blocklists
.
The document version, automatically increasd on updates.
Minimum value is 1
.
Successful response
Invalid input data response
Unsuccessful authentication response
Not enough privileges response
Exception list already exists response
Internal server error response
curl \
--request POST https://<KIBANA_URL>/api/exception_lists \
--header "Content-Type: application/json" \
--data '{"name":"Sample Detection Exception List","tags":["malware"],"type":"detection","list_id":"simple_list","os_types":["linux"],"description":"This is a sample detection type exception list.","namespace_type":"single"}'
{
"name": "Sample Detection Exception List",
"tags": [
"malware"
],
"type": "detection",
"list_id": "simple_list",
"os_types": [
"linux"
],
"description": "This is a sample detection type exception list.",
"namespace_type": "single"
}
{
"id": "28243c2f-624a-4443-823d-c0b894880931",
"name": "Sample Detection Exception List",
"tags": [
"malware"
],
"type": "detection",
"list_id": "8c1aae4c-1ef5-4bce-a2e3-16584b501783",
"version": 1,
"_version": "WzMsMV0=",
"os_types": [],
"immutable": false,
"created_at": "2025-01-09T01:05:23.019Z",
"created_by": "elastic",
"updated_at": "2025-01-09T01:05:23.020Z",
"updated_by": "elastic",
"description": "This is a sample detection type exception with an autogenerated list_id.",
"namespace_type": "single",
"tie_breaker_id": "ad94de31-39f7-4ad7-b8e4-988bfa95f338"
}
{
"id": "1a744e77-22ca-4b6b-9085-54f55275ebe5",
"name": "Sample Agnostic Endpoint Exception List",
"tags": [
"malware"
],
"type": "endpoint",
"list_id": "b935eb55-7b21-4c1c-b235-faa1df23b3d6",
"version": 1,
"_version": "WzUsMV0=",
"os_types": [
"linux"
],
"immutable": false,
"created_at": "2025-01-09T01:10:36.369Z",
"created_by": "elastic",
"updated_at": "2025-01-09T01:10:36.369Z",
"updated_by": "elastic",
"description": "This is a sample agnostic endpoint type exception.",
"namespace_type": "agnostic",
"tie_breaker_id": "49ea0adc-a2b8-4d83-a8f3-2fb98301dea3"
}
{
"id": "9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85",
"name": "Sample Detection Exception List",
"tags": [
"malware"
],
"type": "detection",
"list_id": "simple_list",
"version": 1,
"_version": "WzIsMV0=",
"os_types": [
"linux"
],
"immutable": false,
"created_at": "2025-01-07T19:34:27.942Z",
"created_by": "elastic",
"updated_at": "2025-01-07T19:34:27.942Z",
"updated_by": "elastic",
"description": "This is a sample detection type exception list.",
"namespace_type": "single",
"tie_breaker_id": "78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3"
}
{
"id": "a79f4730-6e32-4278-abfc-349c0add7d54",
"name": "Sample Endpoint Exception List",
"tags": [
"malware"
],
"type": "endpoint",
"list_id": "endpoint_list",
"version": 1,
"_version": "WzQsMV0=",
"os_types": [
"linux"
],
"immutable": false,
"created_at": "2025-01-09T01:07:49.658Z",
"created_by": "elastic",
"updated_at": "2025-01-09T01:07:49.658Z",
"updated_by": "elastic",
"description": "This is a sample endpoint type exception list.",
"namespace_type": "single",
"tie_breaker_id": "94a028af-8f47-427a-aca5-ffaf829e64ee"
}
{
"error": "Bad Request",
"message": "[request body]: list_id: Expected string, received number",
"statusCode": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [POST /api/exception_lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
{
"message": "exception list id: \"simple_list\" already exists",
"status_code": 409
}
{
"message": "Internal Server Error",
"status_code": 500
}
Import an exception list and its associated items from an NDJSON file.
Determines whether existing exception lists with the same list_id
are overwritten.
If any exception items have the same item_id
, those are also overwritten.
Default value is false
.
Determines whether the list being imported will have a new list_id
generated.
Additional item_id
's are generated for each exception item. Both the exception
list and its items are overwritten.
Default value is false
.
curl \
--request POST https://<KIBANA_URL>/api/exception_lists/_import \
--header "Content-Type: multipart/form-data" \
--form "file={"_version":"WzExNDU5LDFd","created_at":"2025-01-09T16:18:17.757Z","created_by":"elastic","description":"This is a sample detection type exception","id":"c86c2da0-2ab6-4343-b81c-216ef27e8d75","immutable":false,"list_id":"simple_list","name":"Sample Detection Exception List","namespace_type":"single","os_types":[],"tags":["user added string for a tag","malware"],"tie_breaker_id":"cf4a7b92-732d-47f0-a0d5-49a35a1736bf","type":"detection","updated_at":"2025-01-09T16:18:17.757Z","updated_by":"elastic","version":1}
{"_version":"WzExNDYxLDFd","comments":[],"created_at":"2025-01-09T16:18:42.308Z","created_by":"elastic","description":"This is a sample endpoint type exception","entries":[{"type":"exists","field":"actingProcess.file.signer","operator":"excluded"},{"type":"match_any","field":"host.name","value":["some host","another host"],"operator":"included"}],"id":"f37597ce-eaa7-4b64-9100-4301118f6806","item_id":"simple_list_item","list_id":"simple_list","name":"Sample Endpoint Exception List","namespace_type":"single","os_types":["linux"],"tags":["user added string for a tag","malware"],"tie_breaker_id":"4ca3ef3e-9721-42c0-8107-cf47e094d40f","type":"simple","updated_at":"2025-01-09T16:18:42.308Z","updated_by":"elastic"}
"
{
"errors": [
{
"error": {
"message": "Error found importing exception list: Invalid value \\\"4\\\" supplied to \\\"list_id\\\"",
"status_code": 400
},
"list_id": "(unknown list_id)"
},
{
"error": {
"message": "Found that item_id: \\\"f7fd00bb-dba8-4c93-9d59-6cbd427b6330\\\" already exists. Import of item_id: \\\"f7fd00bb-dba8-4c93-9d59-6cbd427b6330\\\" skipped.",
"status_code": 409
},
"item_id": "f7fd00bb-dba8-4c93-9d59-6cbd427b6330",
"list_id": "7d7cccb8-db72-4667-b1f3-648efad7c1ee"
}
],
"success": "false,",
"success_count": 0,
"success_exception_lists": "false,",
"success_exception_list_items": "false,",
"success_count_exception_lists": 0,
"success_count_exception_list_items": 0
}
{
"errors": [],
"success": true,
"success_count": 2,
"success_exception_lists": "true,",
"success_exception_list_items": true,
"success_count_exception_lists": 1,
"success_count_exception_list_items": 1
}
{
"error": "string",
"message": "string",
"statusCode": 42
}
{
"message": "string",
"status_code": 42
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [POST /api/exception_lists/_import] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
{
"message": "Internal Server Error",
"status_code": 500
}
Delete an exception list item using the id
or item_id
field.
Exception item's identifier. Either id
or item_id
must be specified
Minimum length is 1
.
Human readable exception item string identifier, e.g. trusted-linux-processes
. Either id
or item_id
must be specified
Minimum length is 1
.
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single
: Only available in the Kibana space in which it is created.agnostic
: Available in all Kibana spaces.Values are agnostic
or single
. Default value is single
.
Successful response
Invalid input data response
Unsuccessful authentication response
Not enough privileges response
Exception list item not found response
Internal server error response
curl \
--request DELETE https://<KIBANA_URL>/api/exception_lists/items
{
"id": "71a9f4b2-c85c-49b4-866f-c71eb9e67da2",
"name": "Sample Exception List Item",
"tags": [
"malware"
],
"type": "simple",
"entries": [
{
"type": "exists",
"field": "actingProcess.file.signer",
"operator": "excluded"
},
{
"type": "match_any",
"field": "host.name",
"value": [
"saturn",
"jupiter"
],
"operator": "included"
}
],
"item_id": "simple_list_item",
"list_id": "simple_list",
"_version": "WzQsMV0=",
"comments": [],
"os_types": [
"linux"
],
"created_at": "2025-01-07T20:07:33.119Z",
"created_by": "elastic",
"updated_at": "2025-01-07T20:07:33.119Z",
"updated_by": "elastic",
"description": "This is a sample detection type exception item.",
"namespace_type": "single",
"tie_breaker_id": "09434836-9db9-4942-a234-5a9268e0b34c"
}
{
"error": "Bad Request",
"message": "[request query]: namespace_type.0: Invalid enum value. Expected 'agnostic' | 'single', received 'blob'",
"statusCode": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [DELETE /api/exception_lists/items?item_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
{
"message": "exception list item item_id: \\\"foo\\\" does not exist",
"status_code": 404
}
{
"message": "Internal Server Error",
"status_code": 500
}
Get a list of all exception list items in the specified list.
The list_id
s of the items to fetch.
Minimum length of each is 1
.
Filters the returned results according to the value of the specified field,
using the <field name>:<field value>
syntax.
Minimum length of each is 1
. Default value is []
(empty).
Determines whether the returned containers are Kibana associated with a Kibana space
or available in all spaces (agnostic
or single
)
Values are agnostic
or single
. Default value is ["single"]
.
The page number to return
Minimum value is 0
.
The number of exception list items to return per page
Minimum value is 0
.
Determines which field is used to sort the results.
Minimum length is 1
.
Determines the sort order, which can be desc
or asc
.
Values are desc
or asc
.
Successful response
Invalid input data response
Unsuccessful authentication response
Not enough privileges response
Exception list not found response
Internal server error response
curl \
--request GET https://<KIBANA_URL>/api/exception_lists/items/_find?list_id=simple_list
{
"data": [
{
"id": "459c5e7e-f8b2-4f0b-b136-c1fc702f72da",
"name": "Sample Exception List Item",
"tags": [
"malware"
],
"type": "simple",
"entries": [
{
"type": "exists",
"field": "actingProcess.file.signer",
"operator": "excluded"
},
{
"type": "match_any",
"field": "host.name",
"value": [
"jupiter",
"saturn"
],
"operator": "included"
}
],
"item_id": "simple_list_item",
"list_id": "simple_list",
"_version": "WzgsMV0=",
"comments": [],
"os_types": [
"linux"
],
"created_at": "2025-01-07T21:12:25.512Z",
"created_by": "elastic",
"updated_at": "2025-01-07T21:12:25.512Z",
"updated_by": "elastic",
"description": "This is a sample exception item.",
"namespace_type": "single",
"tie_breaker_id": "ad0754ff-7b19-49ca-b73e-e6aff6bfa2d0"
}
],
"page": 1,
"total": 1,
"per_page": 20
}
{
"error": "Bad Request",
"message": "[request query]: namespace_type.0: Invalid enum value. Expected 'agnostic' | 'single', received 'blob'",
"statusCode": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [GET /api/exception_lists/items/_find?list_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]",
"statusCode": 403
}
{
"message": "exception list list_id: \"foo\" does not exist",
"status_code": 404
}
{
"message": "Internal Server Error",
"status_code": 500
}
Get a summary of the specified exception list.
Exception list's identifier generated upon creation.
Minimum length is 1
.
Exception list's human readable identifier.
Minimum length is 1
.
Determines whether the exception container is available in all Kibana spaces or just the space in which it is created, where:
single
: Only available in the Kibana space in which it is created.agnostic
: Available in all Kibana spaces.Values are agnostic
or single
. Default value is single
.
Search filter clause
Successful response
Invalid input data response
Unsuccessful authentication response
Not enough privileges response
Exception list not found response
Internal server error response
curl \
--request GET https://<KIBANA_URL>/api/exception_lists/summary
{
"linux": 0,
"macos": 0,
"total": 0,
"windows": 0
}
{
"error": "Bad Request",
"message": "[request query]: namespace_type.0: Invalid enum value. Expected 'agnostic' | 'single', received 'blob'",
"statusCode": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [GET /api/exception_lists/summary?list_id=simple_list&namespace_type=agnostic] is unauthorized for user, this action is granted by the Kibana privileges [lists-summary]",
"statusCode": 403
}
{
"message\"": "exception list id: \"foo\" does not exist",
"status_code\"": 404
}
{
"message": "Internal Server Error",
"status_code": 500
}
An exception list groups exception items and can be associated with detection rules. A shared exception list can apply to multiple detection rules.
All exception items added to the same list are evaluated using OR
logic. That is, if any of the items in a list evaluate to true
, the exception prevents the rule from generating an alert. Likewise, OR
logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the AND
operator, you can define multiple clauses (entries
) in a single exception item.
curl \
--request POST https://<KIBANA_URL>/api/exceptions/shared \
--header "Content-Type: application/json" \
--data '{"name":"Sample Detection Exception List","tags":["malware"],"list_id":"simple_list","os_types":["linux"],"description":"This is a sample detection type exception list.","namespace_type":"single"}'
{
"name": "Sample Detection Exception List",
"tags": [
"malware"
],
"list_id": "simple_list",
"os_types": [
"linux"
],
"description": "This is a sample detection type exception list.",
"namespace_type": "single"
}
{
"id": "9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85",
"name": "Sample Detection Exception List",
"tags": [
"malware"
],
"type": "detection",
"list_id": "simple_list",
"version": 1,
"_version": "WzIsMV0=",
"os_types": [
"linux"
],
"immutable": false,
"created_at": "2025-01-07T19:34:27.942Z",
"created_by": "elastic",
"updated_at": "2025-01-07T19:34:27.942Z",
"updated_by": "elastic",
"description": "This is a sample detection type exception list.",
"namespace_type": "single",
"tie_breaker_id": "78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3"
}
{
"error": "Bad Request",
"message": "[request body]: list_id: Expected string, received number",
"statusCode": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"message": "Unable to create exception-list",
"status_code": 403
}
{
"message": "exception list id: \"simple_list\" already exists",
"status_code": 409
}
{
"message": "Internal Server Error",
"status_code": 500
}
Update a value list using the list id
. The original list is replaced, and all unspecified fields are deleted.
You cannot modify the id
value.
Value list's properties
The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
Describes the value list.
Minimum length is 1
.
Value list's identifier.
Minimum length is 1
.
Placeholder for metadata about the value list.
Additional properties are allowed.
Value list's name.
Minimum length is 1
.
The document version number.
Minimum value is 1
.
curl \
--request PUT https://<KIBANA_URL>/api/lists \
--header "Content-Type: application/json" \
--data '{"id":"ip_list","name":"Bad ips - updated","description":"Latest list of bad ips"}'
{
"id": "ip_list",
"name": "Bad ips - updated",
"description": "Latest list of bad ips"
}
{
"id": "ip_list",
"name": "Bad ips - updated",
"type": "ip",
"version": 3,
"_version": "WzIsMV0=",
"immutable": false,
"@timestamp": "2025-01-08T04:47:34.273Z",
"created_at": "2025-01-08T04:47:34.273Z",
"created_by": "elastic",
"updated_at": "2025-01-08T05:39:39.292Z",
"updated_by": "elastic",
"description": "Latest list of bad ips",
"tie_breaker_id": "f5508188-b1e9-4e6e-9662-d039a7d89899"
}
{
"error": "Bad Request",
"message": "[request body]: id: Expected string, received number",
"statusCode": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [PUT /api/lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
{
"message": "list id: \\\"foo\\\" not found",
"status_code": 404
}
{
"message": "Internal Server Error",
"status_code": 500
}
Value list's properties
Describes the value list.
Minimum length is 1
.
Determines how retrieved list item values are presented. By default list items are presented using these Handelbar expressions:
{{{value}}}
- Single value item types, such as ip
, long
, date
, keyword
, and text
.{{{gte}}}-{{{lte}}}
- Range value item types, such as ip_range
, double_range
, float_range
, integer_range
, and long_range
.{{{gte}}},{{{lte}}}
- Date range values.Value list's identifier.
Minimum length is 1
.
Placeholder for metadata about the value list.
Additional properties are allowed.
Value list's name.
Minimum length is 1
.
Determines how uploaded list item values are parsed. By default, list items are parsed using these named regex groups:
(?<value>.+)
- Single value item types, such as ip, long, date, keyword, and text.(?<gte>.+)-(?<lte>.+)|(?<value>.+)
- Range value item types, such as date_range
, ip_range
, double_range
, float_range
, integer_range
, and long_range
.Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:
keyword
: Many ECS fields are Elasticsearch keywordsip
: IP addressesip_range
: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)Values are binary
, boolean
, byte
, date
, date_nanos
, date_range
, double
, double_range
, float
, float_range
, geo_point
, geo_shape
, half_float
, integer
, integer_range
, ip
, ip_range
, keyword
, long
, long_range
, shape
, short
, or text
.
Minimum value is 1
. Default value is 1
.
Successful response
Invalid input data response
Unsuccessful authentication response
Not enough privileges response
List already exists response
Internal server error response
curl \
--request POST https://<KIBANA_URL>/api/lists \
--header "Content-Type: application/json" \
--data '{"id":"ip_list","name":"Simple list with ips","type":"ip","description":"This list describes bad internet ips"}'
{
"id": "ip_list",
"name": "Simple list with ips",
"type": "ip",
"description": "This list describes bad internet ips"
}
{
"id": "ip_range_list",
"name": "Simple list with ip ranges",
"type": "ip_range",
"description": "This list has ip ranges"
}
{
"id": "keyword_list",
"name": "Simple list with a keyword",
"type": "keyword",
"description": "This list describes bad host names"
}
{
"id": "keyword_custom_format_list",
"name": "Simple list with a keyword using a custom format",
"type": "keyword",
"serializer": "(?<value>((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))",
"description": "This parses the first found ipv4 only",
"deserializer": "{{value}}"
}
{
"id": "ip_list",
"name": "Simple list with ips",
"type": "ip",
"version": 1,
"_version": "WzAsMV0=",
"immutable": false,
"@timestamp": "2025-01-08T04:47:34.273Z",
"created_at": "2025-01-08T04:47:34.273Z",
"created_by": "elastic",
"updated_at": "2025-01-08T04:47:34.273Z",
"updated_by": "elastic",
"description": "This list describes bad internet ips",
"tie_breaker_id": "f5508188-b1e9-4e6e-9662-d039a7d89899"
}
{
"id": "ip_range_list",
"name": "Simple list with ip ranges",
"type": "ip_range",
"version": 1,
"_version": "WzAsMV0=",
"immutable": false,
"@timestamp": "2025-01-09T18:23:52.241Z",
"created_at": "2025-01-09T18:23:52.241Z",
"created_by": "elastic",
"updated_at": "2025-01-09T18:23:52.241Z",
"updated_by": "elastic",
"description": "This list has ip ranges",
"tie_breaker_id": "74aebdaf-601f-4940-b351-155728ff7003"
}
{
"id": "keyword_list",
"name": "Simple list with a keyword",
"type": "keyword",
"version": 1,
"_version": "WzEsMV0=",
"immutable": false,
"@timestamp": "2025-01-09T18:24:55.786Z",
"created_at": "2025-01-09T18:24:55.786Z",
"created_by": "elastic",
"updated_at": "2025-01-09T18:24:55.786Z",
"updated_by": "elastic",
"description": "This list describes bad host names",
"tie_breaker_id": "f7e7dbaa-daf7-4c9a-a3dc-56643923ef68"
}
{
"id": "keyword_custom_format_list",
"name": "Simple list with a keyword using a custom format",
"type": "keyword",
"version": 1,
"_version": "WzIsMV0=",
"immutable": false,
"@timestamp": "2025-01-09T18:25:39.604Z",
"created_at": "2025-01-09T18:25:39.604Z",
"created_by": "elastic",
"serializer": "(?<value>((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?).){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))",
"updated_at": "2025-01-09T18:25:39.604Z",
"updated_by": "elastic",
"description": "This parses the first found ipv4 only",
"deserializer": "{{value}}",
"tie_breaker_id": "8247ae63-b780-47b8-9a89-948b643e9ec2"
}
{
"message": "To create a list, the data stream must exist first. Data stream \\\".lists-default\\\" does not exist",
"status_code": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [POST /api/lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
{
"message": "list id: \"keyword_custom_format_list\" already exists",
"status_code": 409
}
{
"message": "Internal Server Error",
"status_code": 500
}
Delete a value list using the list ID.
When you delete a list, all of its list items are also deleted.
Value list's identifier.
Minimum length is 1
.
Determines whether exception items referencing this value list should be deleted.
Default value is false
.
Determines whether to delete value list without performing any additional checks of where this list may be utilized.
Default value is false
.
curl \
--request DELETE https://<KIBANA_URL>/api/lists?id=21b01cfb-058d-44b9-838c-282be16c91cd
{
"id": "21b01cfb-058d-44b9-838c-282be16c91cd",
"name": "Bad ips",
"type": "ip",
"version": 3,
"_version": "WzIsMV0=",
"immutable": false,
"@timestamp": "2025-01-08T04:47:34.273Z",
"created_at": "2025-01-08T04:47:34.273Z",
"created_by": "elastic",
"updated_at": "2025-01-08T05:39:39.292Z",
"updated_by": "elastic",
"description": "List of bad internet ips.",
"tie_breaker_id": "f5508188-b1e9-4e6e-9662-d039a7d89899"
}
{
"error": "Bad Request",
"message": "[request query]: id: Required",
"statusCode": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [DELETE /api/lists?id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
{
"message": "list id: \\\"ip_list\\\" was not found",
"status_code": 404
}
{
"message": "Internal Server Error",
"status_code": 500
}
Delete the .lists
and .items
data streams.
Successful response
Invalid input data response
Unsuccessful authentication response
Not enough privileges response
List data stream not found response
Internal server error response
curl \
--request DELETE https://<KIBANA_URL>/api/lists/index
{
"acknowledged": true
}
{
"error": "string",
"message": "string",
"statusCode": 42
}
{
"message": "string",
"status_code": 42
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "string",
"message": "string",
"statusCode": 42
}
{
"message": "string",
"status_code": 42
}
{
"message": "Internal Server Error",
"status_code": 500
}
Update a value list item using the list item ID. The original list item is replaced, and all unspecified fields are deleted.
You cannot modify the id
value.
Value list item's properties
The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
Value list item's identifier.
Minimum length is 1
.
Placeholder for metadata about the value list item.
Additional properties are allowed.
The value used to evaluate exceptions.
Minimum length is 1
.
Successful response
Invalid input data response
Unsuccessful authentication response
Not enough privileges response
List item not found response
Internal server error response
curl \
--request PUT https://<KIBANA_URL>/api/lists/items \
--header "Content-Type: application/json" \
--data '{"id":"ip_item","value":"255.255.255.255"}'
{
"id": "ip_item",
"value": "255.255.255.255"
}
{
"id": "pd1WRJQBs4HAK3VQeHFI",
"type": "ip",
"value": "255.255.255.255",
"list_id": "ip_list",
"_version": "WzIwLDFd",
"@timestamp": "2025-01-08T05:15:05.159Z",
"created_at": "2025-01-08T05:15:05.159Z",
"created_by": "elastic",
"updated_at": "2025-01-08T05:44:14.009Z",
"updated_by": "elastic",
"tie_breaker_id": "eee41dc7-1666-4876-982f-8b0f7b59eca3"
}
{
"error": "Bad Request",
"message": "[request body]: id: Expected string, received number",
"statusCode": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [PATCH /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
{
"message": "list item id: \\\"foo\\\" not found",
"status_code": 404
}
{
"message": "Internal Server Error",
"status_code": 500
}
Delete a value list item using its id
, or its list_id
and value
fields.
Value list item's identifier. Required if list_id
and value
are not specified.
Minimum length is 1
.
Value list's identifier. Required if id
is not specified.
Minimum length is 1
.
The value used to evaluate exceptions. Required if id
is not specified.
Determines when changes made by the request are made visible to search.
Values are true
, false
, or wait_for
. Default value is false
.
Successful response
Invalid input data response
Unsuccessful authentication response
Not enough privileges response
List item not found response
Internal server error response
curl \
--request DELETE https://<KIBANA_URL>/api/lists/items
{
"id": "pd1WRJQBs4HAK3VQeHFI",
"type": "ip",
"value": "255.255.255.255",
"list_id": "ip_list",
"_version": "WzIwLDFd",
"@timestamp": "2025-01-08T05:15:05.159Z",
"created_at": "2025-01-08T05:15:05.159Z",
"created_by": "elastic",
"updated_at": "2025-01-08T05:44:14.009Z",
"updated_by": "elastic",
"tie_breaker_id": "eee41dc7-1666-4876-982f-8b0f7b59eca3"
}
{
"message": "Either \\\"list_id\\\" or \\\"id\\\" needs to be defined in the request",
"status_code": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [DELETE /api/lists/items?id=pd1WRJQBs4HAK3VQeHFI] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
{
"message": "list item with id: \\\"pd1WRJQBs4HAK3VQeHFI\\\" not found",
"status_code": 404
}
{
"message": "Internal Server Error",
"status_code": 500
}
Update specific fields of an existing value list item using the item id
.
Value list item's properties
The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.
Value list item's identifier.
Minimum length is 1
.
Placeholder for metadata about the value list item.
Additional properties are allowed.
Determines when changes made by the request are made visible to search.
Values are true
, false
, or wait_for
.
The value used to evaluate exceptions.
Minimum length is 1
.
Successful response
Invalid input data response
Unsuccessful authentication response
Not enough privileges response
List item not found response
Internal server error response
curl \
--request PATCH https://<KIBANA_URL>/api/lists/items \
--header "Content-Type: application/json" \
--data '{"id":"pd1WRJQBs4HAK3VQeHFI","value":"255.255.255.255"}'
{
"id": "pd1WRJQBs4HAK3VQeHFI",
"value": "255.255.255.255"
}
{
"id": "pd1WRJQBs4HAK3VQeHFI",
"type": "ip",
"value": "255.255.255.255",
"list_id": "ip_list",
"_version": "WzE5LDFd",
"@timestamp": "2025-01-08T05:15:05.159Z",
"created_at": "2025-01-08T05:15:05.159Z",
"created_by": "elastic",
"updated_at": "2025-01-08T05:23:37.602Z",
"updated_by": "elastic",
"tie_breaker_id": "eee41dc7-1666-4876-982f-8b0f7b59eca3"
}
{
"message": "{\"took\":15,\"timed_out\":false,\"total\":1,\"updated\":0,\"deleted\":0,\"batches\":1,\"version_conflicts\":0,\"noops\":0,\"retries\":{\"bulk\":0,\"search\":0},\"throttled_millis\":0,\"requests_per_second\":-1,\"throttled_until_millis\":0,\"failures\":[{\"index\":\".ds-.items-default-2025.01.09-000001\",\"id\":\"ip_item\",\"cause\":{\"type\":\"document_parsing_exception\",\"reason\":\"[1:107] failed to parse field [ip] of type [ip] in document with id ip_item. Preview of fields value: 2\",\"caused_by\":{\"type\":\"illegal_argument_exception\",\"reason\":\"2 is not an IP string literal.\"}},\"status\":400}]}",
"status_code": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [PATCH /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
{
"message": "list item id: \\\"foo\\\" not found",
"status_code": 404
}
{
"message": "Internal Server Error",
"status_code": 500
}
Get all value list items in the specified list.
Value list's identifier.
Minimum length is 1
.
The page number to return.
The number of list items to return per page.
Determines which field is used to sort the results.
Minimum length is 1
.
Determines the sort order, which can be desc
or asc
Values are desc
or asc
.
Returns the items that come after the last item returned in the previous call (use the cursor
value returned in the previous call). This parameter uses the tie_breaker_id
field to ensure all items are sorted and returned correctly.
Minimum length is 1
.
Filters the returned results according to the value of the specified field, using the : syntax.
curl \
--request GET https://<KIBANA_URL>/api/lists/items/_find?list_id=21b01cfb-058d-44b9-838c-282be16c91cd
{
"data": [
{
"id": "21b01cfb-058d-44b9-838c-282be16c91cc",
"type": "ip",
"value": "127.0.0.1",
"list_id": "ip_list",
"_version": "WzAsMV0=",
"@timestamp": "2025-01-08T04:59:06.154Z",
"created_at": "2025-01-08T04:59:06.154Z",
"created_by": "elastic",
"updated_at": "2025-01-08T04:59:06.154Z",
"updated_by": "elastic",
"tie_breaker_id": "b57c762c-3036-465c-9bfb-7bfb5e6e515a"
}
],
"page": 1,
"total": 1,
"cursor": "WzIwLFsiYjU3Yzc2MmMtMzAzNi00NjVjLTliZmItN2JmYjVlNmU1MTVhIl1d",
"per_page": 20
}
{
"error": "Bad Request,",
"message": "[request query]: list_id: Required",
"statusCode": "400,"
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [GET /api/lists/items/_find?list_id=ip_list&page=1&per_page=20] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]",
"statusCode": 403
}
{
"message": "Internal Server Error",
"status_code": 500
}
Import value list items from a TXT or CSV file. The maximum file size is 9 million bytes.
You can import items to a new or existing list.
List's id.
Required when importing to an existing list.
Minimum length is 1
.
Type of the importing list.
Required when importing a new list whose list id
is not specified.
Values are binary
, boolean
, byte
, date
, date_nanos
, date_range
, double
, double_range
, float
, float_range
, geo_point
, geo_shape
, half_float
, integer
, integer_range
, ip
, ip_range
, keyword
, long
, long_range
, shape
, short
, or text
.
Determines how uploaded list item values are parsed. By default, list items are parsed using these named regex groups:
(?<value>.+)
- Single value item types, such as ip, long, date, keyword, and text.(?<gte>.+)-(?<lte>.+)|(?<value>.+)
- Range value item types, such as date_range
, ip_range
, double_range
, float_range
, integer_range
, and long_range
.Determines how retrieved list item values are presented. By default list items are presented using these Handelbar expressions:
{{{value}}}
- Single value item types, such as ip
, long
, date
, keyword
, and text
.{{{gte}}}-{{{lte}}}
- Range value item types, such as ip_range
, double_range
, float_range
, integer_range
, and long_range
.{{{gte}}},{{{lte}}}
- Date range values.Determines when changes made by the request are made visible to search.
Values are true
, false
, or wait_for
.
Successful response
Invalid input data response
Unsuccessful authentication response
Not enough privileges response
List with specified list_id does not exist response
Internal server error response
curl \
--request POST https://<KIBANA_URL>/api/lists/items/_import \
--header "Content-Type: multipart/form-data" \
--form "file=127.0.0.1
127.0.0.2
127.0.0.3
127.0.0.4
127.0.0.5
127.0.0.6
127.0.0.7
127.0.0.8
127.0.0.9
"
{
"id": "ip_list",
"name": "Simple list with an ip",
"type": "ip",
"version": 1,
"_version": "WzAsMV0=",
"immutable": false,
"@timestamp": "2025-01-08T04:47:34.273Z",
"created_at": "2025-01-08T04:47:34.273Z",
"created_by": "elastic",
"updated_at": "2025-01-08T04:47:34.273Z",
"updated_by": "elastic",
"description": "This list describes bad internet ip",
"tie_breaker_id": "f5508188-b1e9-4e6e-9662-d039a7d89899"
}
{
"message": "Either type or list_id need to be defined in the query",
"status_code": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [POST /api/lists/items/_import?list_id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
"statusCode": 403
}
{
"message": "string",
"status_code": 42
}
{
"message": "Internal Server Error",
"status_code": 500
}
curl \
--request GET https://<KIBANA_URL>/api/lists/privileges
{
"lists": {
"index": {
".lists-default": {
"all": true,
"read": true,
"index": true,
"write": true,
"create": true,
"delete": true,
"manage": true,
"monitor": true,
"create_doc": true,
"maintenance": true,
"create_index": true,
"delete_index": true,
"view_index_metadata": true
}
},
"cluster": {
"all": true,
"manage": true,
"monitor": true,
"manage_ml": true,
"monitor_ml": true,
"manage_api_key": true,
"manage_pipeline": true,
"manage_security": true,
"manage_transform": true,
"monitor_transform": true,
"manage_own_api_key": true,
"manage_index_templates": true
},
"username": "elastic",
"application": {},
"has_all_requested": true
},
"listItems": {
"index": {
".items-default": {
"all": true,
"read": true,
"index": true,
"write": true,
"create": true,
"delete": true,
"manage": true,
"monitor": true,
"create_doc": true,
"maintenance": true,
"create_index": true,
"delete_index": true,
"view_index_metadata": true
}
},
"cluster": {
"all": true,
"manage": true,
"monitor": true,
"manage_ml": true,
"monitor_ml": true,
"manage_api_key": true,
"manage_pipeline": true,
"manage_security": true,
"manage_transform": true,
"monitor_transform": true,
"manage_own_api_key": true,
"manage_index_templates": true
},
"username": "elastic",
"application": {},
"has_all_requested": true
},
"is_authenticated": true
}
{
"error": "string",
"message": "string",
"statusCode": 42
}
{
"message": "string",
"status_code": 42
}
{
"error": "Unauthorized",
"message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Forbidden",
"message": "API [GET /api/lists/privileges] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]",
"statusCode": 403
}
{
"message": "Internal Server Error",
"status_code": 500
}
Additional properties are allowed.
curl \
--request GET https://<KIBANA_URL>/api/osquery/packs?query=%7B%7D
{}
curl \
--request POST https://<KIBANA_URL>/api/osquery/packs \
--header "Content-Type: application/json" \
--data '{"description":"string","enabled":true,"name":"string","policy_ids":["string"],"queries":{"additionalProperty1":{"ecs_mapping":{"additionalProperty1":{"field":"string","value":"string"},"additionalProperty2":{"field":"string","value":"string"}},"id":"string","platform":"string","query":"string","removed":true,"saved_query_id":"string","snapshot":true,"version":"string"},"additionalProperty2":{"ecs_mapping":{"additionalProperty1":{"field":"string","value":"string"},"additionalProperty2":{"field":"string","value":"string"}},"id":"string","platform":"string","query":"string","removed":true,"saved_query_id":"string","snapshot":true,"version":"string"}},"shards":{"additionalProperty1":42.0,"additionalProperty2":42.0}}'
{
"description": "string",
"enabled": true,
"name": "string",
"policy_ids": [
"string"
],
"queries": {
"additionalProperty1": {
"ecs_mapping": {
"additionalProperty1": {
"field": "string",
"value": "string"
},
"additionalProperty2": {
"field": "string",
"value": "string"
}
},
"id": "string",
"platform": "string",
"query": "string",
"removed": true,
"saved_query_id": "string",
"snapshot": true,
"version": "string"
},
"additionalProperty2": {
"ecs_mapping": {
"additionalProperty1": {
"field": "string",
"value": "string"
},
"additionalProperty2": {
"field": "string",
"value": "string"
}
},
"id": "string",
"platform": "string",
"query": "string",
"removed": true,
"saved_query_id": "string",
"snapshot": true,
"version": "string"
}
},
"shards": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
{}
Get the details of a query pack using the pack ID.
curl \
--request GET https://<KIBANA_URL>/api/osquery/packs/{id}
{}
Additional properties are allowed.
curl \
--request GET https://<KIBANA_URL>/api/osquery/saved_queries?query=%7B%7D
{}
Delete a saved query using the query ID.
curl \
--request DELETE https://<KIBANA_URL>/api/osquery/saved_queries/{id}
{}
The pinned event to add or update, along with additional metadata.
curl \
--request PATCH https://<KIBANA_URL>/api/pinned_event \
--header "Content-Type: application/json" \
--data '{"eventId":"string","pinnedEventId":"string","timelineId":"string"}'
{
"eventId": "string",
"pinnedEventId": "string",
"timelineId": "string"
}
{
"created": 42.0,
"createdBy": "string",
"eventId": "string",
"timelineId": "string",
"updated": 42.0,
"updatedBy": "string",
"pinnedEventId": "string",
"version": "string"
}
{
"unpinned": true
}
Get a list of all saved Timelines or Timeline templates.
If true, only timelines that are marked as favorites by the user are returned.
Values are true
or false
.
The type of timeline to create. Valid values are default
and template
.
Values are default
or template
.
The field to sort the timelines by.
Values are title
, description
, updated
, or created
.
Values are asc
or desc
.
The status of the timeline. Valid values are active
, draft
, and immutable
.
Values are active
, draft
, or immutable
.
curl \
--request GET https://<KIBANA_URL>/api/timelines
{
"customTemplateTimelineCount": 42.0,
"defaultTimelineCount": 42.0,
"elasticTemplateTimelineCount": 42.0,
"favoriteCount": 42.0,
"templateTimelineCount": 42.0,
"timeline": [
{
"columns": [
{
"aggregatable": true,
"category": "string",
"columnHeaderType": "string",
"description": "string",
"example": "string",
"id": "string",
"indexes": [
"string"
],
"name": "string",
"placeholder": "string",
"searchable": true,
"type": "string"
}
],
"created": 42.0,
"createdBy": "string",
"dataProviders": [
{
"and": [
{
"enabled": true,
"excluded": true,
"id": "string",
"kqlQuery": "string",
"name": "string",
"queryMatch": {
"displayField": "string",
"displayValue": "string",
"field": "string",
"operator": "string",
"value": "string"
},
"type": "default"
}
],
"enabled": true,
"excluded": true,
"id": "string",
"kqlQuery": "string",
"name": "string",
"queryMatch": {
"displayField": "string",
"displayValue": "string",
"field": "string",
"operator": "string",
"value": "string"
},
"type": "default"
}
],
"dataViewId": "string",
"dateRange": {
"end": "string",
"start": "string"
},
"description": "string",
"eqlOptions": {
"eventCategoryField": "string",
"query": "string",
"size": "string",
"tiebreakerField": "string",
"timestampField": "string"
},
"eventType": "string",
"excludedRowRendererIds": [
"alert"
],
"favorite": [
{
"favoriteDate": 42.0,
"fullName": "string",
"userName": "string"
}
],
"filters": [
{
"exists": "string",
"match_all": "string",
"meta": {
"alias": "string",
"controlledBy": "string",
"disabled": true,
"field": "string",
"formattedValue": "string",
"index": "string",
"key": "string",
"negate": true,
"params": "string",
"type": "string",
"value": "string"
},
"missing": "string",
"query": "string",
"range": "string",
"script": "string"
}
],
"indexNames": [
"string"
],
"kqlMode": "string",
"kqlQuery": {
"filterQuery": {
"kuery": {
"expression": "string",
"kind": "string"
},
"serializedQuery": "string"
}
},
"savedQueryId": "string",
"savedSearchId": "string",
"sort": {
"columnId": "string",
"columnType": "string",
"sortDirection": "string"
},
"status": "active",
"templateTimelineId": "string",
"templateTimelineVersion": 42.0,
"timelineType": "default",
"title": "string",
"updated": 42.0,
"updatedBy": "string",
"savedObjectId": "string",
"version": "string",
"eventIdToNoteIds": [
{
"created": 42.0,
"createdBy": "string",
"eventId": "string",
"note": "string",
"timelineId": "string",
"updated": 42.0,
"updatedBy": "string",
"noteId": "string",
"version": "string"
}
],
"noteIds": [
"string"
],
"notes": [
{
"created": 42.0,
"createdBy": "string",
"eventId": "string",
"note": "string",
"timelineId": "string",
"updated": 42.0,
"updatedBy": "string",
"noteId": "string",
"version": "string"
}
],
"pinnedEventIds": [
"string"
],
"pinnedEventsSaveObject": [
{
"created": 42.0,
"createdBy": "string",
"eventId": "string",
"timelineId": "string",
"updated": 42.0,
"updatedBy": "string",
"pinnedEventId": "string",
"version": "string"
}
]
}
],
"totalCount": 42.0
}
{
"body": "string",
"statusCode": 42.0
}
SLO APIs enable you to define, manage and track service-level objectives
The deletion occurs for the specified list of sloId
and instanceId
. You must have all
privileges for the SLOs feature in the Observability section of the Kibana feature privileges.
An identifier for the space. If /s/
and the identifier are omitted from the path, the default space is used.
curl \
--request POST https://<KIBANA_URL>/s/default/api/observability/slos/_delete_instances \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"list":[{"instanceId":"8853df00-ae2e-11ed-90af-09bb6422b258","sloId":"8853df00-ae2e-11ed-90af-09bb6422b258"}]}'
# Headers
kbn-xsrf: string
# Payload
{
"list": [
{
"instanceId": "8853df00-ae2e-11ed-90af-09bb6422b258",
"sloId": "8853df00-ae2e-11ed-90af-09bb6422b258"
}
]
}
{
"error": "Bad Request",
"message": "Invalid value 'foo' supplied to: [...]",
"statusCode": 400
}
{
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastics] for REST request [/_security/_authenticate]]: unable to authenticate user [elastics] for REST request [/_security/_authenticate]",
"statusCode": 401
}
{
"error": "Unauthorized",
"message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastics] for REST request [/_security/_authenticate]]: unable to authenticate user [elastics] for REST request [/_security/_authenticate]",
"statusCode": 403
}