Create a Timeline or Timeline template

Base URL: https://{kibana_url}

POST /api/timeline
POST /s/{space_id}/api/timeline

Auth

Create a new Timeline or Timeline template.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Request body

The required Timeline fields used to create a new Timeline, along with optional fields that will be created if not provided.

status enum: The status of the Timeline.; Values: active draft immutable
templateTimelineId string nullable: A unique identifier for the Timeline template.
templateTimelineVersion number nullable: Timeline template version number.
timeline object required
timelineId string nullable: A unique identifier for the Timeline.
timelineType enum: The type of Timeline.; Values: default template
version string nullable

Responses

Indicates the Timeline was successfully created.

application/json

data object required

Indicates that there was an error in the Timeline creation.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/timeline
{
  "timeline": {}
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/timeline" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "timeline": {}
  }'

Generated from the API spec

Response

{
  "data": {
    "persistTimeline": {
      "timeline": {
        "columns": [
          {
            "columnHeaderType": "not-filtered",
            "id": "@timestamp"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "event.category"
          }
        ],
        "created": 1587468588922,
        "createdBy": "casetester",
        "dataProviders": [
          {
            "enabled": true,
            "excluded": false,
            "id": "id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
            "name": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b",
            "queryMatch": {
              "field": "_id,",
              "operator": ":",
              "value": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,"
            }
          }
        ],
        "dataViewId": "security-solution-default",
        "dateRange": {
          "end": 1587456479201,
          "start": 1587370079200
        },
        "description": "Investigating exposure of CVE XYZ",
        "eqlOptions": {
          "eventCategoryField": "event.category",
          "query": "sequence\\n[process where process.name == \u0022sudo\u0022]\\n[any where true]",
          "size": 100,
          "timestampField": "@timestamp"
        },
        "eventType": "all",
        "excludedRowRendererIds": [
          "alert"
        ],
        "favorite": [
          {
            "favoriteDate": 1741337636741,
            "userName": "elastic"
          }
        ],
        "filters": [
          {
            "meta": {
              "alias": "Custom filter name",
              "disabled": false,
              "index": ".alerts-security.alerts-default,logs-*",
              "key": "@timestamp",
              "negate": "false,",
              "type": "exists",
              "value": "exists"
            },
            "query": "{\u0022exists\u0022:{\u0022field\u0022:\u0022@timestamp\u0022}}"
          }
        ],
        "indexNames": [
          ".logs*"
        ],
        "kqlMode": "search",
        "kqlQuery": {
          "filterQuery": "null",
          "kuery": {
            "expression": "_id : *",
            "kind": "kuery"
          },
          "serializedQuery": "{\u0022bool\u0022:{\u0022should\u0022:[{\u0022exists\u0022:{\u0022field\u0022:\u0022_id\u0022}}],\u0022minimum_should_match\u0022:1}}"
        },
        "savedQueryId": "c7b16904-02d7-4f32-b8f2-cc20f9625d6e",
        "savedSearchId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
        "sort": {
          "columnId": "@timestamp",
          "sortDirection": "desc"
        },
        "status": "active",
        "templateTimelineId": "6ce1b592-84e3-4b4a-9552-f189d4b82075",
        "templateTimelineVersion": 12,
        "timelineType": "default",
        "title": "CVE XYZ investigation",
        "updated": 1741344876825,
        "updatedBy": "casetester",
        "savedObjectId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
        "version": "WzE0LDFd",
        "eventIdToNoteIds": [
          {
            "created": 1587468588922,
            "createdBy": "casetester",
            "updated": 1741344876825,
            "updatedBy": "casetester",
            "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
            "note": "This is an example text",
            "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
            "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
            "version": "WzQ2LDFd"
          }
        ],
        "noteIds": [
          "709f99c6-89b6-4953-9160-35945c8e174e"
        ],
        "notes": [
          {
            "created": 1587468588922,
            "createdBy": "casetester",
            "updated": 1741344876825,
            "updatedBy": "casetester",
            "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
            "note": "This is an example text",
            "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
            "noteId": "709f99c6-89b6-4953-9160-35945c8e174e",
            "version": "WzQ2LDFd"
          }
        ],
        "pinnedEventIds": [
          "983f99c6-89b6-4953-9160-35945c8a194f"
        ],
        "pinnedEventsSaveObject": [
          {
            "created": 1587468588922,
            "createdBy": "casetester",
            "updated": 1741344876825,
            "updatedBy": "casetester",
            "eventId": "d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc",
            "timelineId": "15c1929b-0af7-42bd-85a8-56e234cc7c4e",
            "pinnedEventId": "10r1929b-0af7-42bd-85a8-56e234f98h2f3",
            "version": "WzQ2LDFe"
          }
        ]
      }
    }
  }
}

Generated from the API spec

{
  "body": "update timeline error",
  "statusCode": 405
}

Generated from the API spec