This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

« Timeline API Get Timeline or Timeline template by savedObjectId »

› › ›

Get Timelines or Timeline templates

edit

Get Timelines or Timeline templates

edit

Retrieves a list of all Timelines or Timeline templates.

Request URL

edit

GET <kibana host>:<port>/api/timelines

URL query parameters

edit

Name	Type	Description	Required
`only_user_favorite`	Boolean	If set to `true`, returns only favorite Timelines / Timeline templates. Defaults to `false`.	No
`page_index`	Number	The page number to return. Defaults to `1`.	No
`page_size`	Number	The number of items to return per page. Defaults to `10`.	No
`search`	String	The keyword in the Timeline / Timeline template title or description to filter the results by.	No
`sort_field`	String	The field to sort the results by. Valid values are: `title` `description` `updated` `created`	No
`sort_order`	String	The order to sort the results in. Valid values are: `asc` `desc`	No
`status`	String	Defines whether to return custom Timeline / Timeline templates or Elastic prebuilt templates. Valid values are: `active`: Returns custom Timelines / Timeline templates `immutable`: Returns Elastic prebuilt templates	No
`timeline_type`	String	Defines whether to return Timelines or Timeline templates. Valid values are: `default`: Returns Timelines `template`: Returns Timeline templates	No

Example requests

edit

Retrieves a list of all Timelines, sorted by the updated field in descending order:

GET api/timelines?page_size=10&page_index=1&sort_field=updated&sort_order=desc&timeline_type=default

Response code

edit

200: Indicates a successful call.

Example response

edit

{
  "totalCount": 2,
  "timeline": [
    {
      "savedObjectId": "a3f145ed-262f-488d-b550-334fb16fc4d5",
      "version": "WzEyMTQzLDFd",
      "columns": [
        {
          "columnHeaderType": "not-filtered",
          "id": "@timestamp",
          "type": "date"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "message"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.category"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.action"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "host.name"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "source.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "destination.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "user.name"
        }
      ],
      "dataProviders": [],
      "dataViewId": "security-solution-default",
      "description": "",
      "eqlOptions": {
        "eventCategoryField": "event.category",
        "tiebreakerField": "",
        "timestampField": "@timestamp",
        "query": "",
        "size": 100
      },
      "eventType": "all",
      "excludedRowRendererIds": [],
      "favorite": [],
      "filters": [],
      "indexNames": [
        ".alerts-security.alerts-default",
        "logs-*"
      ],
      "kqlMode": "filter",
      "kqlQuery": {
        "filterQuery": null
      },
      "title": "Another timeline",
      "templateTimelineId": null,
      "templateTimelineVersion": null,
      "dateRange": {
        "start": "2023-12-08T00:00:00.000Z",
        "end": "2024-03-07T11:10:21.475Z"
      },
      "savedQueryId": null,
      "created": 1709810442736,
      "createdBy": "docsuser",
      "updated": 1709810443384,
      "updatedBy": "docsuser",
      "timelineType": "default",
      "status": "active",
      "sort": [
        {
          "columnId": "@timestamp",
          "columnType": "date",
          "esTypes": [
            "date"
          ],
          "sortDirection": "desc"
        }
      ],
      "savedSearchId": null,
      "eventIdToNoteIds": [],
      "noteIds": [],
      "notes": [],
      "pinnedEventIds": [],
      "pinnedEventsSaveObject": []
    },
    {
      "savedObjectId": "cbe6c180-7ef9-414b-b362-748ff7d96b1b",
      "version": "WzEyMTQxLDFd",
      "columns": [
        {
          "columnHeaderType": "not-filtered",
          "id": "@timestamp",
          "type": "date"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "message"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.category"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "event.action"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "host.name"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "source.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "destination.ip"
        },
        {
          "columnHeaderType": "not-filtered",
          "id": "user.name"
        }
      ],
      "dataProviders": [
        {
          "and": [],
          "id": "send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-alert-id-493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584",
          "name": "493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584",
          "enabled": true,
          "excluded": false,
          "kqlQuery": "",
          "queryMatch": {
            "field": "_id",
            "value": "493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584",
            "operator": ":"
          }
        }
      ],
      "dataViewId": null,
      "description": "",
      "eqlOptions": {
        "eventCategoryField": "event.category",
        "tiebreakerField": "",
        "timestampField": "@timestamp",
        "query": "",
        "size": 100
      },
      "eventType": "all",
      "excludedRowRendererIds": [],
      "favorite": [],
      "filters": [],
      "indexNames": [],
      "kqlMode": "filter",
      "kqlQuery": {
        "filterQuery": {
          "kuery": {
            "kind": "kuery",
            "expression": ""
          },
          "serializedQuery": ""
        }
      },
      "title": "Test timeline",
      "templateTimelineId": null,
      "templateTimelineVersion": null,
      "dateRange": {
        "start": "2024-02-20T15:36:41.196Z",
        "end": "2024-02-20T15:46:41.196Z"
      },
      "savedQueryId": null,
      "created": 1709809866827,
      "createdBy": "docsuser",
      "updated": 1709809868011,
      "updatedBy": "docsuser",
      "timelineType": "default",
      "status": "active",
      "sort": [
        {
          "columnId": "@timestamp",
          "columnType": "date",
          "esTypes": [
            "date"
          ],
          "sortDirection": "desc"
        }
      ],
      "savedSearchId": null,
      "eventIdToNoteIds": [],
      "noteIds": [],
      "notes": [],
      "pinnedEventIds": [],
      "pinnedEventsSaveObject": []
    }
  ],
  "defaultTimelineCount": 2,
  "templateTimelineCount": 10,
  "elasticTemplateTimelineCount": 10,
  "customTemplateTimelineCount": 0,
  "favoriteCount": 0
}

« Timeline API Get Timeline or Timeline template by savedObjectId »