Create or update a stream

Base URL
https://{kibana_url}
Auth

Creates or updates a stream definition. Classic streams can not be created through this API, only updated

Required privileges

Privileges manage_stream

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

name string · max length: 200 required

The name of the stream.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

Any of:
dashboards string[] required
rules string[] required
stream object required
description string required
ingest object required
failure_store union anyOf required
Any of:
inherit object required
lifecycle union anyOf required
Any of:
dsl object required
data_retention string · min length: 1

A non-empty string.

frozen_after string · min length: 1

A non-empty string.

processing object required
steps union anyOf[] required
Any of:

Grok processor - Extract fields from text using grok patterns

action enum required
Values: grok
customIdentifier string · min length: 1

Custom identifier to correlate this processor across outputs

description string

Human-readable notes about this processor step

from string · min length: 1 required

Source field to parse with grok patterns

ignore_failure boolean

Continue pipeline execution if this processor fails

ignore_missing boolean

Skip processing when source field is missing

pattern_definitions map string to string
patterns string[] · min items: 1 required

Grok patterns applied in order to extract fields

where union anyOf

The root condition object. It can be a simple filter or a combination of other conditions.

Any of:

A basic filter condition, either unary or binary.

Any of:

A condition that compares a field to a value or range using an operator as the key.

contains boolean | number | string

Contains comparison value.

endsWith boolean | number | string

Ends-with comparison value.

eq boolean | number | string

Equality comparison value.

field string · min length: 1 required

The document field to filter on.

gt boolean | number | string

Greater-than comparison value.

gte boolean | number | string

Greater-than-or-equal comparison value.

includes boolean | number | string

Checks if multivalue field includes the value.

lt boolean | number | string

Less-than comparison value.

lte boolean | number | string

Less-than-or-equal comparison value.

neq boolean | number | string

Inequality comparison value.

startsWith boolean | number | string

Starts-with comparison value.

settings object required
wired object required
draft boolean
fields map string to anyOf required
<string> union anyOf
Any of:
description string
format string · min length: 1

A non-empty string.

type enum required
Values: keyword match_only_text long double date boolean ip geo_point integer short byte float half_float text wildcard version unsigned_long date_nanos
routing object[] required
destination string · min length: 1 required

A non-empty string.

draft boolean
status enum
Values: enabled disabled
where union anyOf required

The root condition object. It can be a simple filter or a combination of other conditions.

Same options as where in action: grok
type enum required
Values: wired

Response

200

The stream was created or updated successfully.

Base URL
https://{kibana_url}