Get an existing saved Timeline or Timeline template

Base URL
https://{kibana_url}
  • GET /api/timeline/resolve
  • GET /s/{space_id}/api/timeline/resolve
Auth

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

template_timeline_id string

The ID of the template timeline to resolve

id string

The ID of the timeline to resolve

Responses

The (template) Timeline has been found

application/json
One of:
data object required
alias_purpose enum
Values: savedObjectConversion savedObjectImport
alias_target_id string
outcome enum required
Values: exactMatch aliasMatch conflict
timeline object required
created number nullable

The time the Timeline was created, using a 13-digit Epoch timestamp.

createdBy string nullable

The user who created the Timeline.

dataViewId string nullable

ID of the Timeline's Data View

description string nullable

The Timeline's description

eventType string nullable deprecated

Event types displayed in the Timeline

excludedRowRendererIds enum[] nullable

A list of row renderers that should not be used when in Event renderers mode

Values: alert alerts auditd auditd_file library netflow plain registry suricata system system_dns system_endgame_process system_file system_fim system_security_event system_socket threat_match zeek
indexNames string[] nullable

A list of index names to use in the query (e.g. when the default data view has been modified)

kqlMode string nullable

Indicates whether the KQL bar filters the query results or searches for additional results, where:

  • filter: filters query results
  • search: displays additional search results
savedQueryId string nullable

The ID of the saved query that might be used in the Query tab

savedSearchId string nullable

The ID of the saved search that is used in the ES|QL tab

status enum

The status of the Timeline.

Values: active draft immutable
templateTimelineId string nullable

A unique ID (UUID) for Timeline templates. For Timelines, the value is null.

templateTimelineVersion number nullable

Timeline template version number. For Timelines, the value is null.

timelineType enum

The type of Timeline.

Values: default template
title string nullable

The Timeline's title.

updated number nullable

The last time the Timeline was updated, using a 13-digit Epoch timestamp

updatedBy string nullable

The user who last updated the Timeline

noteIds string[] nullable
pinnedEventIds string[] nullable
savedObjectId string required
version string required
400

The request is missing parameters

404

The (template) Timeline was not found

Base URL
https://{kibana_url}