Update Timeline or Timeline template
editUpdate Timeline or Timeline template
editUpdates an existing Timeline or Timeline template.
Use the timeline
object’s timelineType
field
to specify whether you’re updating a Timeline or a Timeline template:
-
"timelineType": "default"
updates an existing Timeline. -
"timelineType": "template"
updates an existing Timeline template.
Request URL
editPATCH <kibana host>:<port>/api/timeline
Request body
editA JSON object defining the Timeline or Timeline template query and time filter.
For detailed information about the Timeline object schema and its corresponding UI components, refer to Timeline schema.
Name | Type | Description | Required |
---|---|---|---|
|
The If you’re updating a Timeline template, provide these fields so you can easily import template updates:
|
Yes |
|
|
String |
The |
Yes |
|
String |
The version of the Timeline or Timeline template that you’re updating. |
Yes |
Example requests
editExample 1
Updates an existing Timeline.
PATCH api/timeline { "timeline": { "columns": [ { "columnHeaderType": "not-filtered", "id": "@timestamp" }, { "columnHeaderType": "not-filtered", "id": "message" }, { "columnHeaderType": "not-filtered", "id": "event.category" }, { "columnHeaderType": "not-filtered", "id": "event.action" }, { "columnHeaderType": "not-filtered", "id": "host.name" }, { "columnHeaderType": "not-filtered", "id": "source.ip" }, { "columnHeaderType": "not-filtered", "id": "destination.ip" }, { "columnHeaderType": "not-filtered", "id": "user.name" } ], "dataProviders": [], "description": "", "eventType": "all", "filters": [], "kqlMode": "filter", "kqlQuery": { "filterQuery": null }, "title": "abd", "dateRange": { "start": 1587370079200, "end": 1587456479201 }, "savedQueryId": null, "sort": { "columnId": "@timestamp", "sortDirection": "desc" }, "created": 1587468588922, "createdBy": "casetester", "updated": 1587468588922, "updatedBy": "casetester", "timelineType": "default" }, "timelineId": "4bc294e0-3516-11ee-9f62-49614d8a84fd", "version": "WzE5MTUsMV0=" }
|
|
|
Example 2
Updates an existing Timeline template.
PATCH api/timeline { "timeline": { "columns": [ { "columnHeaderType": "not-filtered", "id": "@timestamp" }, { "columnHeaderType": "not-filtered", "id": "message" }, { "columnHeaderType": "not-filtered", "id": "event.category" }, { "columnHeaderType": "not-filtered", "id": "event.action" }, { "columnHeaderType": "not-filtered", "id": "host.name" }, { "columnHeaderType": "not-filtered", "id": "source.ip" }, { "columnHeaderType": "not-filtered", "id": "destination.ip" }, { "columnHeaderType": "not-filtered", "id": "user.name" } ], "dataProviders": [], "description": "", "eventType": "all", "filters": [], "kqlMode": "filter", "kqlQuery": { "filterQuery": null }, "title": "abd", "dateRange": { "start": 1587370079200, "end": 1587456479201 }, "savedQueryId": null, "sort": { "columnId": "@timestamp", "sortDirection": "desc" }, "timelineType": "template", "created": 1587473119992, "createdBy": "casetester", "updated": 1587473119992, "updatedBy": "casetester", "templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1", "templateTimelineVersion": 2 }, "timelineId": "7d7d4b60-3516-11ee-9f62-49614d8a84fd", "version": "WzE5MTcsMV0=" }
|
|
|
|
|
|
|
Response code
edit-
200
- Indicates a successful call.
Response payload
editA JSON Timeline object with a unique savedObjectId
and its version
.
Example 1
Response payload of an updated Timeline:
{ "data": { "persistTimeline": { "code": 200, "message": "success", "timeline": { "savedObjectId": "4bc294e0-3516-11ee-9f62-49614d8a84fd", "version": "WzE5MTgsMV0=", "columns": [ { "columnHeaderType": "not-filtered", "id": "@timestamp" }, { "columnHeaderType": "not-filtered", "id": "message" }, { "columnHeaderType": "not-filtered", "id": "event.category" }, { "columnHeaderType": "not-filtered", "id": "event.action" }, { "columnHeaderType": "not-filtered", "id": "host.name" }, { "columnHeaderType": "not-filtered", "id": "source.ip" }, { "columnHeaderType": "not-filtered", "id": "destination.ip" }, { "columnHeaderType": "not-filtered", "id": "user.name" } ], "dataProviders": [], "dataViewId": null, "description": "", "eventType": "all", "excludedRowRendererIds": [], "favorite": [], "filters": [], "kqlMode": "filter", "kqlQuery": { "filterQuery": null }, "title": "abd", "templateTimelineId": null, "templateTimelineVersion": null, "dateRange": { "start": 1587370079200, "end": 1587456479201 }, "savedQueryId": null, "created": 1587468588922, "createdBy": "casetester", "updated": 1691408201273, "updatedBy": "elastic", "timelineType": "default", "status": "active", "sort": [ { "sortDirection": "desc", "columnId": "@timestamp" } ], "eventIdToNoteIds": [], "noteIds": [], "notes": [], "pinnedEventIds": [], "pinnedEventsSaveObject": [] } } } }
Example 2
Response payload of an updated Timeline template:
{ "data": { "persistTimeline": { "code": 200, "message": "success", "timeline": { "savedObjectId": "7d7d4b60-3516-11ee-9f62-49614d8a84fd", "version": "WzE5MTksMV0=", "columns": [ { "columnHeaderType": "not-filtered", "id": "@timestamp" }, { "columnHeaderType": "not-filtered", "id": "message" }, { "columnHeaderType": "not-filtered", "id": "event.category" }, { "columnHeaderType": "not-filtered", "id": "event.action" }, { "columnHeaderType": "not-filtered", "id": "host.name" }, { "columnHeaderType": "not-filtered", "id": "source.ip" }, { "columnHeaderType": "not-filtered", "id": "destination.ip" }, { "columnHeaderType": "not-filtered", "id": "user.name" } ], "dataProviders": [], "dataViewId": null, "description": "", "eventType": "all", "excludedRowRendererIds": [], "favorite": [], "filters": [], "kqlMode": "filter", "kqlQuery": { "filterQuery": null }, "title": "abd", "templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1", "templateTimelineVersion": 2, "dateRange": { "start": 1587370079200, "end": 1587456479201 }, "savedQueryId": null, "created": 1587473119992, "createdBy": "casetester", "updated": 1691408702104, "updatedBy": "elastic", "timelineType": "template", "status": "active", "sort": [ { "sortDirection": "desc", "columnId": "@timestamp" } ], "eventIdToNoteIds": [], "noteIds": [], "notes": [], "pinnedEventIds": [], "pinnedEventsSaveObject": [] } } } }