Timeline schema
editTimeline schema
edit[preview] This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
The Timeline schema lists all the JSON fields and objects required to create a Timeline or a Timeline template using the Create Timeline API.
All column, dropzone, and filter fields must be ECS fields.
This screenshot maps the Timeline UI components to their JSON objects:
-
Title (
title
) -
Global notes (
globalNotes
) -
Data view (
dataViewId
) -
KQL bar query (
kqlQuery
) -
Time filter (
dateRange
) -
Additional filters (
filters
) -
KQL bar mode (
kqlMode
) -
Dropzone (each clause is contained in its own
dataProviders
object) -
Column headers (
columns
) -
Event-specific notes (
eventNotes
)
Name | Type | Description |
---|---|---|
|
The Timeline’s columns. |
|
|
Float |
The time the Timeline was created, using a 13-digit Epoch timestamp. |
|
String |
The user who created the Timeline. |
Object containing dropzone query clauses. |
||
|
String |
ID of the Timeline’s Data View, for example: |
|
dateRange |
The Timeline’s search period:
|
|
String |
The Timeline’s description. |
|
Notes added to specific events in the Timeline. |
|
|
String |
Event types displayed in the Timeline, which can be:
|
|
Indicates when and who marked a Timeline as a favorite. |
|
|
Filters used in addition to the dropzone query. |
|
Global notes added to the Timeline. |
||
|
String |
Indicates whether the KQL bar filters the dropzone query results or searches for additional results, where:
|
|
KQL bar query. |
|
|
pinnedEventIds[] |
IDs of events pinned to the Timeline’s search results. |
|
String |
The Timeline’s saved object ID. |
|
String |
If used, the saved query ID used to filter or search dropzone query results. |
|
sort |
Object indicating how rows are sorted in the Timeline’s grid:
|
|
String |
A unique ID (UUID) for Timeline templates. For
Timelines, the value is |
|
Integer |
Timeline template version number. For
Timelines, the value is |
|
String |
Indicates whether the Timeline is a template or not, where:
|
|
String |
The Timeline’s title. |
|
Float |
The last time the Timeline was updated, using a 13-digit Epoch timestamp. |
|
String |
The user who last updated the Timeline. |
|
String |
The Timeline’s version. |
columns object
editName | Type | Description |
---|---|---|
|
Boolean |
Indicates whether the field can be aggregated across all indices (used to sort columns in the UI). |
|
String |
The ECS field set to which the field belongs. |
|
String |
UI column field description tooltip. |
|
String |
UI column field example tooltip. |
|
String |
Security indices in which the field exists and has the same
Elasticsearch type. |
|
String |
ECS field name, displayed as the column header in the UI. |
|
String |
The field’s type. |
dataProviders object
editName | Type | Description |
---|---|---|
|
dataProviders[] |
Array containing dropzone query clauses using |
|
Boolean |
Indicates if the dropzone query clause is enabled. |
|
Boolean |
Indicates if the dropzone query clause uses |
|
String |
The dropzone query clause’s unique ID. |
|
String |
The dropzone query clause’s name (the clause’s value when Timelines are exported from the UI). |
|
queryMatch |
The dropzone query clause:
|
eventNotes object
editName | Type | Description |
---|---|---|
|
Float |
The time the note was created, using a 13-digit Epoch timestamp. |
|
String |
The user who added the note. |
|
String |
The ID of the event to which the note was added. |
|
String |
The note’s text. |
|
String |
The note’s ID |
|
String |
The ID of the Timeline to which the note was added. |
|
Float |
The last time the note was updated, using a 13-digit Epoch timestamp. |
|
String |
The user who last updated the note. |
|
String |
The note’s version. |
favorite object
editName | Type | Description |
---|---|---|
|
Float |
The time the Timeline was marked as a favorite, using a 13-digit Epoch timestamp. |
|
String |
The full name of the user who marked the Timeline as a favorite. |
|
String |
|
|
String |
The username of the user who marked the Timeline as a favorite. |
filters object
editName | Type | Description |
---|---|---|
|
String |
Exists term query for the
specified field ( |
|
meta |
Filter details:
|
|
String |
Match all term query
for the specified field ( |
|
String |
DSL query ( |
|
String |
Range query ( |
globalNotes object
editName | Type | Description |
---|---|---|
|
Float |
The time the note was created, using a 13-digit Epoch timestamp. |
|
String |
The user who added the note. |
|
String |
The note’s text. |
|
String |
The note’s ID |
|
String |
The ID of the Timeline to which the note was added. |
|
Float |
The last time the note was updated, using a 13-digit Epoch timestamp. |
|
String |
The user who last updated the note. |
|
String |
The note’s version. |
kqlQuery object
editName | Type | Description |
---|---|---|
|
filterQuery |
Object containing query details:
|