Timeline schema
editTimeline schema
editThe Timeline schema lists all the JSON fields and objects required to create a Timeline or a Timeline template using the Create timeline API.
All column, dropzone, and filter fields must be ECS fields.
This screenshot maps the Timeline UI components to their JSON objects:
-
Title (
title
) -
Description (
description
) -
Global notes (
globalNotes
) -
Time filter (
dateRange
) -
Dropzone (each clause is contained in
its own
dataProviders
object) -
KQL bar mode (
kqlMode
) -
KQL bar query (
kqlQuery
) -
Event types included in Timeline results
(
eventType
) -
Additional filters (
filters
) -
Column headers (
columns
) -
Event-specific notes (
eventNotes
)
Name | Type | Description |
---|---|---|
The timeline’s columns. |
||
|
Float |
The time the timeline was created, using a 13-digit Epoch timestamp. |
|
String |
The user who created the timeline. |
Object containing dropzone query clauses. |
||
dateRange |
The timeline’s search period:
|
|
String |
The timeline’s description. |
|
Notes added to specific events in the timeline. |
||
String |
Event types displayed in the timeline, which can be:
|
|
|
Indicates when and who marked a timeline as a favorite. |
|
Filters used in addition to the dropzone query. |
||
Global notes added to the timeline. |
||
String |
Indicates whether the KQL bar filters the dropzone query results or searches for additional results, where:
|
|
KQL bar query. |
||
|
pinnedEventIds[] |
IDs of events pinned to the timeline’s search results. |
|
String |
The timeline’s saved object ID. |
|
String |
If used, the saved query ID used to filter or search dropzone query results. |
|
sort |
Object indicating how rows are sorted in the timeline’s grid:
|
|
String |
A unique ID (UUID) for Timeline templates. For
timelines, the value is |
|
Integer |
Timeline template version number. For
timelines, the value is |
String |
Indicates whether the timeline is a template or not, where:
|
|
String |
The timeline’s title. |
|
|
Float |
The last time the timeline was updated, using a 13-digit Epoch timestamp. |
|
String |
The user who last updated the timeline. |
|
String |
The timeline’s version. |
columns object
editName | Type | Description |
---|---|---|
|
Boolean |
Indicates whether the field can be aggregated across all indices (used to sort columns in the UI). |
|
String |
The ECS field set to which the field belongs. |
|
String |
UI column field description tooltip. |
|
String |
UI column field example tooltip. |
|
String |
Security indices in which the field exists and has the same
Elasticsearch type. |
|
String |
ECS field name, displayed as the column header in the UI. |
|
String |
The field’s type. |
dataProviders object
editName | Type | Description |
---|---|---|
|
dataProviders[] |
Array containing dropzone query clauses using |
|
Boolean |
Indicates if the dropzone query clause is enabled. |
|
Boolean |
Indicates if the dropzone query clause uses |
|
String |
The dropzone query clause’s unique ID. |
|
String |
The dropzone query clause’s name (the clause’s value when timelines are exported from the UI). |
|
queryMatch |
The dropzone query clause:
|
eventNotes object
editName | Type | Description |
---|---|---|
|
Float |
The time the note was created, using a 13-digit Epoch timestamp. |
|
String |
The user who added the note. |
|
String |
The ID of the event to which the note was added. |
|
String |
The note’s text. |
|
String |
The note’s ID |
|
String |
The ID of the timeline to which the note was added. |
|
Float |
The last time the note was updated, using a 13-digit Epoch timestamp. |
|
String |
The user who last updated the note. |
|
String |
The note’s version. |
favorite object
editName | Type | Description |
---|---|---|
|
Float |
The time the timeline was marked as a favorite, using a 13-digit Epoch timestamp. |
|
String |
The full name of the user who marked the timeline as a favorite. |
|
String |
|
|
String |
The Kibana username of the user who marked the timeline as a favorite. |
filters object
editName | Type | Description |
---|---|---|
|
String |
Exists term query for the
specified field ( |
|
meta |
Filter details:
|
|
String |
Match all term query
for the specified field ( |
|
String |
DSL query ( |
|
String |
Range query ( |
globalNotes object
editName | Type | Description |
---|---|---|
|
Float |
The time the note was created, using a 13-digit Epoch timestamp. |
|
String |
The user who added the note. |
|
String |
The note’s text. |
|
String |
The note’s ID |
|
String |
The ID of the timeline to which the note was added. |
|
Float |
The last time the note was updated, using a 13-digit Epoch timestamp. |
|
String |
The user who last updated the note. |
|
String |
The note’s version. |
kqlQuery object
editName | Type | Description |
---|---|---|
|
filterQuery |
Object containing query details:
|