Create a clean draft Timeline or Timeline template

Base URL
https://{kibana_url}
  • POST /api/timeline/_draft
Auth

Create a clean draft Timeline or Timeline template for the current user.

Note

If the user already has a draft Timeline, the existing draft Timeline is cleared and returned.

Request body

The type of Timeline to create. Valid values are default and template.

timelineType enum required

The type of Timeline.

Values: default template

Responses

Indicates a successful call.

application/json
created number nullable

The time the Timeline was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the Timeline.

dataViewId string nullable

ID of the Timeline's Data View

description string nullable

The Timeline's description

eventType string nullable deprecated

Event types displayed in the Timeline

excludedRowRendererIds enum[] nullable

A list of row renderers that should not be used when in Event renderers mode

Values: alert alerts auditd auditd_file library netflow plain registry suricata system system_dns system_endgame_process system_file system_fim system_security_event system_socket threat_match zeek
indexNames string[] nullable

A list of index names to use in the query (e.g. when the default data view has been modified)

kqlMode string nullable

Indicates whether the KQL bar filters the query results or searches for additional results, where:

  • filter: filters query results
  • search: displays additional search results
savedQueryId string nullable

The ID of the saved query that might be used in the Query tab

savedSearchId string nullable

The ID of the saved search that is used in the ES|QL tab

status enum

The status of the Timeline.

Values: active draft immutable
templateTimelineId string nullable

A unique ID (UUID) for Timeline templates. For Timelines, the value is null.

templateTimelineVersion number nullable

Timeline template version number. For Timelines, the value is null.

timelineType enum

The type of Timeline.

Values: default template
title string nullable

The Timeline's title.

updated number nullable

The last time the Timeline was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the Timeline

savedObjectId string required

The savedObjectId of the Timeline or Timeline template

version string required

The version of the Timeline or Timeline template

noteIds string[] nullable

A list of all the ids of notes that are associated to this Timeline.

pinnedEventIds string[] nullable

A list of all the ids of pinned events that are associated to this Timeline.

Base URL
https://{kibana_url}