A list of filters that should be applied to the query
existsstringnullable
match_allstringnullable
metaobjectnullable
aliasstringnullable
controlledBystringnullable
disabledbooleannullable
fieldstringnullable
formattedValuestringnullable
indexstringnullable
keystringnullable
negatebooleannullable
paramsstringnullable
typestringnullable
valuestringnullable
missingstringnullable
querystringnullable
rangestringnullable
scriptstringnullable
indexNamesstring[]nullable
A list of index names to use in the query (e.g. when the default data view has been modified)
kqlModestringnullable
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query results
search: displays additional search results
kqlQueryobject
KQL bar query.
filterQueryobjectnullable
kueryobjectnullable
expressionstringnullable
kindstringnullable
serializedQuerystringnullable
savedQueryIdstringnullable
The ID of the saved query that might be used in the Query tab
savedSearchIdstringnullable
The ID of the saved search that is used in the ES|QL tab
sortuniononeOf
objectorobject[]
columnIdstringnullable
columnTypestringnullable
sortDirectionstringnullable
statusenum
The status of the Timeline.
Values:activedraftimmutable
templateTimelineIdstringnullable
A unique ID (UUID) for Timeline templates. For Timelines, the value is null.
templateTimelineVersionnumbernullable
Timeline template version number. For Timelines, the value is null.
timelineTypeenum
The type of Timeline.
Values:defaulttemplate
titlestringnullable
The Timeline's title.
updatednumbernullable
The last time the Timeline was updated, using a 13-digit Epoch timestamp
updatedBystringnullable
The user who last updated the Timeline
eventIdToNoteIdsobject[]nullable
creatednumbernullable
The time the note was created, using a 13-digit Epoch timestamp.
createdBystringnullable
The user who created the note.
updatednumbernullable
The last time the note was updated, using a 13-digit Epoch timestamp
updatedBystringnullable
The user who last updated the note
eventIdstringnullable
Elasticsearch document _id for the event or alert this note refers to. Same value as the documentIds query parameter when fetching notes via GET /api/note.
notestringnullable
The text of the note
timelineIdstringrequired
The savedObjectId of the Timeline this note belongs to (not the note's own ID).
noteIdstringrequired
The savedObjectId of the note
versionstringrequired
The version of the note
noteIdsstring[]nullable
notesobject[]nullable
creatednumbernullable
The time the note was created, using a 13-digit Epoch timestamp.
createdBystringnullable
The user who created the note.
updatednumbernullable
The last time the note was updated, using a 13-digit Epoch timestamp
updatedBystringnullable
The user who last updated the note
eventIdstringnullable
Elasticsearch document _id for the event or alert this note refers to. Same value as the documentIds query parameter when fetching notes via GET /api/note.
notestringnullable
The text of the note
timelineIdstringrequired
The savedObjectId of the Timeline this note belongs to (not the note's own ID).
noteIdstringrequired
The savedObjectId of the note
versionstringrequired
The version of the note
pinnedEventIdsstring[]nullable
pinnedEventsSaveObjectobject[]nullable
creatednumbernullable
The time the pinned event was created, using a 13-digit Epoch timestamp.
createdBystringnullable
The user who created the pinned event.
updatednumbernullable
The last time the pinned event was updated, using a 13-digit Epoch timestamp
updatedBystringnullable
The user who last updated the pinned event
eventIdstringrequired
The _id of the associated event for this pinned event.
timelineIdstringrequired
The savedObjectId of the timeline that this pinned event is associated with
A list of index names to use in the query (e.g. when the default data view has been modified)
kqlModestringnullable
Indicates whether the KQL bar filters the query results or searches for additional results, where:
filter: filters query results
search: displays additional search results
kqlQueryobject
KQL bar query.
filterQueryobjectnullable
kueryobjectnullable
expressionstringnullable
kindstringnullable
serializedQuerystringnullable
savedQueryIdstringnullable
The ID of the saved query that might be used in the Query tab
savedSearchIdstringnullable
The ID of the saved search that is used in the ES|QL tab
sortuniononeOf
objectorobject[]
columnIdstringnullable
columnTypestringnullable
sortDirectionstringnullable
statusenum
The status of the Timeline.
Values:activedraftimmutable
templateTimelineIdstringnullable
A unique ID (UUID) for Timeline templates. For Timelines, the value is null.
templateTimelineVersionnumbernullable
Timeline template version number. For Timelines, the value is null.
timelineTypeenum
The type of Timeline.
Values:defaulttemplate
titlestringnullable
The Timeline's title.
updatednumbernullable
The last time the Timeline was updated, using a 13-digit Epoch timestamp
updatedBystringnullable
The user who last updated the Timeline
eventNotesobject[]requirednullable
creatednumbernullable
The time the note was created, using a 13-digit Epoch timestamp.
createdBystringnullable
The user who created the note.
updatednumbernullable
The last time the note was updated, using a 13-digit Epoch timestamp
updatedBystringnullable
The user who last updated the note
eventIdstringnullable
Elasticsearch document _id for the event or alert this note refers to. Same value as the documentIds query parameter when fetching notes via GET /api/note.
notestringnullable
The text of the note
timelineIdstringrequired
The savedObjectId of the Timeline this note belongs to (not the note's own ID).
globalNotesobject[]requirednullable
creatednumbernullable
The time the note was created, using a 13-digit Epoch timestamp.
createdBystringnullable
The user who created the note.
updatednumbernullable
The last time the note was updated, using a 13-digit Epoch timestamp
updatedBystringnullable
The user who last updated the note
eventIdstringnullable
Elasticsearch document _id for the event or alert this note refers to. Same value as the documentIds query parameter when fetching notes via GET /api/note.
notestringnullable
The text of the note
timelineIdstringrequired
The savedObjectId of the Timeline this note belongs to (not the note's own ID).