Streams
Streams provide a unified data management layer for ingestion, routing, and processing. There are three stream types:
Wired streams are managed by Kibana. They route documents to child streams based on field conditions and support custom field mappings and processing steps.
Classic streams map to existing Elasticsearch data streams. You can add processing steps to classic streams without changing their underlying index template.
Query streams are virtual aggregations backed by an ES|QL expression. They aggregate data from multiple streams into a single logical view without duplicating documents.
-
Get stream list
Stack
Experimental
9.1+
- GET /api/streams
-
Disable streams
Stack
Experimental
9.1+
- POST /api/streams/_disable
-
Enable streams
Stack
Experimental
9.1+
- POST /api/streams/_enable
-
Resync streams
Stack
Experimental
9.1+
- POST /api/streams/_resync
-
Get a stream
Stack
Experimental
9.1+
- GET /api/streams/{name}
-
Create or update a stream
Stack
Experimental
9.1+
- PUT /api/streams/{name}
-
Delete a stream
Stack
Experimental
9.1+
- DELETE /api/streams/{name}
-
Fork a stream
Stack
Experimental
9.1+
- POST /api/streams/{name}/_fork
-
Get ingest stream settings
Stack
Experimental
9.1+
- GET /api/streams/{name}/_ingest
-
Update ingest stream settings
Stack
Experimental
9.1+
- PUT /api/streams/{name}/_ingest
-
Get query stream settings
Stack
Experimental
9.4+
- GET /api/streams/{name}/_query
-
Upsert query stream settings
Stack
Experimental
9.4+
- PUT /api/streams/{name}/_query
-
Export stream content
Stack
Experimental
9.1+
- POST /api/streams/{name}/content/export
-
Import content into a stream
Stack
Experimental
9.1+
- POST /api/streams/{name}/content/import
-
Get stream attachments
Stack
Experimental
9.3+
- GET /api/streams/{streamName}/attachments
-
Bulk update attachments
Stack
Experimental
9.3+
- POST /api/streams/{streamName}/attachments/_bulk
-
Link an attachment to a stream
Stack
Experimental
9.3+
- PUT /api/streams/{streamName}/attachments/{attachmentType}/{attachmentId}
-
Unlink an attachment from a stream
Stack
Experimental
9.3+
- DELETE /api/streams/{streamName}/attachments/{attachmentType}/{attachmentId}