- Kibana Guide: other versions:
- What is Kibana?
- What’s new in 8.7
- Kibana concepts
- Quick start
- Set up
- Install Kibana
- Configure Kibana
- Alerting and action settings
- APM settings
- Banners settings
- Enterprise Search settings
- Fleet settings
- i18n settings
- Logging settings
- Logs settings
- Metrics settings
- Monitoring settings
- Reporting settings
- Search sessions settings
- Secure settings
- Security settings
- Spaces settings
- Task Manager settings
- Telemetry settings
- URL drilldown settings
- Start and stop Kibana
- Access Kibana
- Securing access to Kibana
- Add data
- Upgrade Kibana
- Configure security
- Configure reporting
- Configure logging
- Configure monitoring
- Command line tools
- Production considerations
- Discover
- Dashboard and visualizations
- Canvas
- Maps
- Build a map to compare metrics by country or region
- Track, visualize, and alert on assets in real time
- Map custom regions with reverse geocoding
- Heat map layer
- Tile layer
- Vector layer
- Plot big data
- Search geographic data
- Configure map settings
- Connect to Elastic Maps Service
- Import geospatial data
- Troubleshoot
- Reporting and sharing
- Machine learning
- Graph
- Alerting
- Observability
- APM
- Security
- Dev Tools
- Fleet
- Osquery
- Stack Monitoring
- Stack Management
- REST API
- Get features API
- Kibana spaces APIs
- Kibana role management APIs
- User session management APIs
- Saved objects APIs
- Data views API
- Index patterns APIs
- Alerting APIs
- Action and connector APIs
- Cases APIs
- Add comment
- Create case
- Delete cases
- Delete comments
- Find case activity
- Find cases
- Find connectors
- Get alerts
- Get case activity
- Get case
- Get case status
- Get cases by alert
- Get comments
- Get configuration
- Get reporters
- Get tags
- Push case
- Set configuration
- Update cases
- Update comment
- Update configuration
- Import and export dashboard APIs
- Logstash configuration management APIs
- Machine learning APIs
- Osquery manager API
- Short URLs APIs
- Get Task Manager health
- Upgrade assistant APIs
- Kibana plugins
- Troubleshooting
- Accessibility
- Release notes
- Developer guide
IMPORTANT: No additional bug fixes or documentation updates
will be released for this version. For the latest information, see the
current release documentation.
Create pack API
editCreate pack API
edit[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features. Create packs.
Request
editPOST <kibana host>:<port>/api/osquery/packs
POST <kibana host>:<port>/s/<space_id>/api/osquery/packs
Path parameters
edit-
space_id
-
(Optional, string) The space identifier. When
space_id
is not provided in the URL, the default space is used.
Request body
edit-
name
- (Required, string) The pack name.
-
description
- (Optional, string) The pack description.
-
enabled
- (Optional, boolean) Enables the pack.
-
policy_ids
- (Optional, array) A list of agents policy IDs.
-
shards
- (Required, object) An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.
-
queries
- (Required, object) An object of queries.
Response code
edit-
200
- Indicates a successful call.
Examples
editCreate a pack:
$ curl -X POST api/osquery/packs \ { "name": "my_pack", "description": "My pack", "enabled": true, "policy_ids": [ "my_policy_id", "fleet-server-policy" ], "shards": { "my_policy_id": 35, "fleet-server-policy": 58 }, "queries": { "my_query": { "query": "SELECT * FROM listening_ports;", "interval": 60, "ecs_mapping": { "client.port": { "field": "port" }, "tags": { "value": [ "tag1", "tag2" ] } } } } }
The API returns the pack object:
{ "data": {...} }
Was this helpful?
Thank you for your feedback.