This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

« Get Timelines or Timeline templates Get Timeline template by templateTimelineId »

› › ›

Get Timeline or Timeline template by savedObjectId

edit

Get Timeline or Timeline template by savedObjectId

edit

Retrieves details of a single Timeline or Timeline template using savedObjectId.

Request URL

edit

GET <kibana host>:<port>/api/timeline?id=<savedObjectId>

URL query parameters

edit

Name	Type	Description	Required
`id`	String	The `savedObjectId` of an existing Timeline or Timeline template.	Yes

Example requests

edit

Retrieves details of a Timeline template with the savedObjectId value of 9115e3bc-444c-4c91-b844-c62717253c4e:

GET /api/timeline?id=9115e3bc-444c-4c91-b844-c62717253c4e

Response code

edit

200: Indicates a successful call.

Example response

edit

{
  "data": {
    "getOneTimeline": {
      "savedObjectId": "9115e3bc-444c-4c91-b844-c62717253c4e",
      "version": "WzQwMjYsMV0=",
      "columns": [
        {
          "columnHeaderType": "not-filtered",
          "id": "@timestamp",
          "type": "date"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "signal.rule.name"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "message"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.category"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.action"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "host.name"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "user.name"
        }
      ],
      "dataProviders": [
        {
          "excluded": false,
          "and": [
            {
              "excluded": false,
              "kqlQuery": "",
              "name": "user.name",
              "queryMatch": {
                "displayValue": "{user.name}",
                "field": "user.name",
                "displayField": "user.name",
                "value": "{user.name}",
                "operator": ":"
              },
              "id": "timeline-1-6a1ffe5f-6188-4cf3-915d-e53c2563a1bf",
              "type": "template",
              "enabled": true
            }
          ],
          "kqlQuery": "",
          "name": "signal",
          "queryMatch": {
            "field": "event.kind",
            "value": "signal",
            "operator": ":"
          },
          "id": "timeline-1-ac9b7ab7-0fea-4724-864c-19122139b08f",
          "type": "default",
          "enabled": true
        }
      ],
      "dataViewId": null,
      "description": "",
      "eventType": "all",
      "excludedRowRendererIds": [],
      "favorite": [],
      "filters": [],
      "indexNames": [
        ".alerts-*"
      ],
      "kqlMode": "filter",
      "title": "Alerts Involving a Single User Timeline",
      "templateTimelineId": "3e827bab-838a-469f-bd1e-5e19a2bff2fd",
      "templateTimelineVersion": 1,
      "dateRange": {
        "start": "2024-02-19T15:42:52.325Z",
        "end": "2024-02-20T15:42:52.325Z"
      },
      "savedQueryId": null,
      "created": 1708443772325,
      "createdBy": "Elastic",
      "updated": 1708443772325,
      "updatedBy": "Elastic",
      "timelineType": "template",
      "status": "immutable",
      "sort": [
        {
          "esTypes": [
            "date"
          ],
          "columnType": "date",
          "sortDirection": "desc",
          "columnId": "@timestamp"
        }
      ],
      "eventIdToNoteIds": [],
      "noteIds": [],
      "notes": [],
      "pinnedEventIds": [],
      "pinnedEventsSaveObject": []
    }
  }
}

« Get Timelines or Timeline templates Get Timeline template by templateTimelineId »