Get Timelines or Timeline templates
editGet Timelines or Timeline templates
editRetrieves a list of all Timelines or Timeline templates.
Request URL
editGET <kibana host>:<port>/api/timelines
URL query parameters
editName | Type | Description | Required |
---|---|---|---|
|
Boolean |
If set to |
No |
|
Number |
The page number to return. Defaults to |
No |
|
Number |
The number of items to return per page. Defaults to |
No |
|
String |
The keyword in the Timeline / Timeline template title or description to filter the results by. |
No |
|
String |
The field to sort the results by. Valid values are:
|
No |
|
String |
The order to sort the results in. Valid values are:
|
No |
|
String |
Defines whether to return custom Timeline / Timeline templates or Elastic prebuilt templates. Valid values are:
|
No |
|
String |
Defines whether to return Timelines or Timeline templates. Valid values are:
|
No |
Example requests
editRetrieves a list of all Timelines, sorted by the updated
field in descending order:
GET api/timelines?page_size=10&page_index=1&sort_field=updated&sort_order=desc&timeline_type=default
Response code
edit-
200
- Indicates a successful call.
Example response
edit{ "totalCount": 2, "timeline": [ { "savedObjectId": "a3f145ed-262f-488d-b550-334fb16fc4d5", "version": "WzEyMTQzLDFd", "columns": [ { "columnHeaderType": "not-filtered", "id": "@timestamp", "type": "date" }, { "columnHeaderType": "not-filtered", "id": "message" }, { "columnHeaderType": "not-filtered", "id": "event.category" }, { "columnHeaderType": "not-filtered", "id": "event.action" }, { "columnHeaderType": "not-filtered", "id": "host.name" }, { "columnHeaderType": "not-filtered", "id": "source.ip" }, { "columnHeaderType": "not-filtered", "id": "destination.ip" }, { "columnHeaderType": "not-filtered", "id": "user.name" } ], "dataProviders": [], "dataViewId": "security-solution-default", "description": "", "eqlOptions": { "eventCategoryField": "event.category", "tiebreakerField": "", "timestampField": "@timestamp", "query": "", "size": 100 }, "eventType": "all", "excludedRowRendererIds": [], "favorite": [], "filters": [], "indexNames": [ ".alerts-security.alerts-default", "logs-*" ], "kqlMode": "filter", "kqlQuery": { "filterQuery": null }, "title": "Another timeline", "templateTimelineId": null, "templateTimelineVersion": null, "dateRange": { "start": "2023-12-08T00:00:00.000Z", "end": "2024-03-07T11:10:21.475Z" }, "savedQueryId": null, "created": 1709810442736, "createdBy": "docsuser", "updated": 1709810443384, "updatedBy": "docsuser", "timelineType": "default", "status": "active", "sort": [ { "columnId": "@timestamp", "columnType": "date", "esTypes": [ "date" ], "sortDirection": "desc" } ], "savedSearchId": null, "eventIdToNoteIds": [], "noteIds": [], "notes": [], "pinnedEventIds": [], "pinnedEventsSaveObject": [] }, { "savedObjectId": "cbe6c180-7ef9-414b-b362-748ff7d96b1b", "version": "WzEyMTQxLDFd", "columns": [ { "columnHeaderType": "not-filtered", "id": "@timestamp", "type": "date" }, { "columnHeaderType": "not-filtered", "id": "message" }, { "columnHeaderType": "not-filtered", "id": "event.category" }, { "columnHeaderType": "not-filtered", "id": "event.action" }, { "columnHeaderType": "not-filtered", "id": "host.name" }, { "columnHeaderType": "not-filtered", "id": "source.ip" }, { "columnHeaderType": "not-filtered", "id": "destination.ip" }, { "columnHeaderType": "not-filtered", "id": "user.name" } ], "dataProviders": [ { "and": [], "id": "send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-timeline-1-alert-id-493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584", "name": "493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584", "enabled": true, "excluded": false, "kqlQuery": "", "queryMatch": { "field": "_id", "value": "493f15b2301c94720720fb670a22092f1cc3fd42b0600c6f179f714b1a5b2584", "operator": ":" } } ], "dataViewId": null, "description": "", "eqlOptions": { "eventCategoryField": "event.category", "tiebreakerField": "", "timestampField": "@timestamp", "query": "", "size": 100 }, "eventType": "all", "excludedRowRendererIds": [], "favorite": [], "filters": [], "indexNames": [], "kqlMode": "filter", "kqlQuery": { "filterQuery": { "kuery": { "kind": "kuery", "expression": "" }, "serializedQuery": "" } }, "title": "Test timeline", "templateTimelineId": null, "templateTimelineVersion": null, "dateRange": { "start": "2024-02-20T15:36:41.196Z", "end": "2024-02-20T15:46:41.196Z" }, "savedQueryId": null, "created": 1709809866827, "createdBy": "docsuser", "updated": 1709809868011, "updatedBy": "docsuser", "timelineType": "default", "status": "active", "sort": [ { "columnId": "@timestamp", "columnType": "date", "esTypes": [ "date" ], "sortDirection": "desc" } ], "savedSearchId": null, "eventIdToNoteIds": [], "noteIds": [], "notes": [], "pinnedEventIds": [], "pinnedEventsSaveObject": [] } ], "defaultTimelineCount": 2, "templateTimelineCount": 10, "elasticTemplateTimelineCount": 10, "customTemplateTimelineCount": 0, "favoriteCount": 0 }