Pin an event to an existing Timeline

Console supports only Elasticsearch APIs. Console doesn’t allow interactions with Kibana APIs. You must use curl or another HTTP tool instead. For more information, refer to Run Elasticsearch API requests.

Request URL

edit

PATCH <kibana host>:<port>/api/pinned_event

Request body

edit

Name	Type	Description	Required
`eventId`	String	Each document has an `_id` to uniquely identify it	Yes
`pinnedEventId`	String	A pinned event `savedObjectId`	No
`timelineId`	String	The `savedObjectId` of an existing Timeline the pinned event is linked to	Yes

Example requests

edit

Example 1

Pin an event to an existing Timeline:

PATCH api/pinned_event
{
  "eventId":"LRuPFXkBVs8glbN0jXtI",
  "timelineId":"b2c103b0-a79d-11eb-9dce-0f3114099868"
}

Example 2

Unpin an event:

PATCH api/pinned_event
{
  "eventId":"LRuPFXkBVs8glbN0jXtI",
  "pinnedEventId":"9bc11e40-b312-11eb-8078-5b983613cc0f",
  "timelineId":"b2c103b0-a79d-11eb-9dce-0f3114099868"
}

« Add a note to an existing Timeline Delete Timelines or Timeline templates »