-
Notifications
You must be signed in to change notification settings - Fork 205
Adds missing Update Timeline & Timeline template API docs #3692
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from 1 commit
Commits
Show all changes
19 commits
Select commit
Hold shift + click to select a range
4734360
Adds missing Update Timeline & Timeline template API docs
natasha-moore-elastic bed2245
Fixes incorrect info
natasha-moore-elastic 1befe81
Renames asciidoc file
natasha-moore-elastic cad52e5
Update docs/events/api/timeline-template-api-update.asciidoc
natasha-moore-elastic 2a5f5c7
Update docs/events/api/timeline-template-api-update.asciidoc
natasha-moore-elastic d288c35
Update docs/events/api/timeline-template-api-update.asciidoc
natasha-moore-elastic bd0c286
Update docs/events/api/timeline-template-api-update.asciidoc
natasha-moore-elastic 3b3e0ac
Update docs/events/api/timeline-template-api-update.asciidoc
natasha-moore-elastic 7543d49
Update docs/events/api/timeline-template-api-update.asciidoc
natasha-moore-elastic 5f4f84c
Update docs/events/api/timeline-template-api-update.asciidoc
natasha-moore-elastic 385130f
Update docs/events/api/timeline-template-api-update.asciidoc
natasha-moore-elastic f4240a8
TW feedback
natasha-moore-elastic b6acc92
Update docs/events/api/timeline-template-api-update.asciidoc
natasha-moore-elastic ecc509e
TW review updates
natasha-moore-elastic 172d66c
Merge branch 'main' into bug-3686-update-timeline-API
natasha-moore-elastic 6b4bf58
Merge branch 'main' into bug-3686-update-timeline-API
natasha-moore-elastic ffae741
Merge branch 'main' into bug-3686-update-timeline-API
natasha-moore-elastic 704bfb6
Merge branch 'main' into bug-3686-update-timeline-API
natasha-moore-elastic 85e8c02
Merge branch 'main' into bug-3686-update-timeline-API
natasha-moore-elastic File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,385 @@ | ||
| [[timeline-api-update-2]] | ||
natasha-moore-elastic marked this conversation as resolved.
Outdated
Show resolved
Hide resolved
|
||
| === Update Timeline or Timeline template | ||
|
|
||
| Updates an existing Timeline or Timeline template. | ||
|
|
||
| Use the `timeline` object's <<timeline-object-typeField, `timelineType`>> field | ||
| to specify whether a Timeline or a Timeline template is updated, where: | ||
|
|
||
| * `"timelineType": "default"` updates an existing Timeline | ||
| * `"timelineType": "template"` updates an existing Timeline template | ||
|
|
||
| ==== Request URL | ||
|
|
||
| `PATCH <kibana host>:<port>/api/timeline` | ||
|
|
||
| ==== Request body | ||
|
|
||
| A JSON object defining the Timeline or Timeline template query and time filter. | ||
|
|
||
| NOTE: For detailed information about the Timeline object schema and its | ||
| corresponding UI components, see <<timeline-object-schema>>. | ||
|
|
||
| [width="100%",options="header"] | ||
| |============================================== | ||
| |Name |Type |Description |Required | ||
|
|
||
| |`timeline` |<<timeline-object-schema, timeline>> a|The timeline object, which | ||
| defines the search criteria and time range. The only required field is `title`. | ||
|
|
||
| When you are updating a Timeline template, provide these fields so you can | ||
| easily <<timeline-api-import, import template>> updates: | ||
|
|
||
| * `templateTimelineId`: Unique identifier (UUID, for Timeline templates only). This must match the existing Timeline template version. | ||
| * `templateTimelineVersion`: Template version number (for Timeline templates only). This must be a Timeline template version greater than the existing one. | ||
|
|
||
| |Yes | ||
| |`timelineId` |String |The `savedObjectId` of an existing Timeline that you're updating. | ||
| |Yes | ||
| |`version` |String |The version of an existing Timeline that you're updating. | ||
| |Yes | ||
| |============================================== | ||
|
|
||
| ===== Example requests | ||
|
|
||
| *Example 1* | ||
|
|
||
| Updates an existing Timeline. | ||
|
|
||
| [source,console] | ||
| -------------------------------------------------- | ||
| PATCH api/timeline | ||
| { | ||
| "timeline": { | ||
| "columns": [ | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "@timestamp" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "message" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "event.category" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "event.action" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "host.name" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "source.ip" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "destination.ip" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "user.name" | ||
| } | ||
| ], | ||
| "dataProviders": [], | ||
| "description": "", | ||
| "eventType": "all", | ||
| "filters": [], | ||
| "kqlMode": "filter", | ||
| "kqlQuery": { | ||
| "filterQuery": null | ||
| }, | ||
| "title": "abd", | ||
| "dateRange": { | ||
| "start": 1587370079200, | ||
| "end": 1587456479201 | ||
| }, | ||
| "savedQueryId": null, | ||
| "sort": { | ||
| "columnId": "@timestamp", | ||
| "sortDirection": "desc" | ||
| }, | ||
| "created": 1587468588922, | ||
| "createdBy": "casetester", | ||
| "updated": 1587468588922, | ||
| "updatedBy": "casetester", | ||
| "timelineType": "default" | ||
| }, | ||
| "timelineId": "4bc294e0-3516-11ee-9f62-49614d8a84fd", <1> | ||
| "version": "WzE5MTUsMV0=" <2> | ||
| } | ||
| -------------------------------------------------- | ||
|
|
||
| <1> `timelineId` must match the existing Timeline's `savedObjectId`. | ||
| <2> `version` must match the existing Timeline version. | ||
|
|
||
| *Example 2* | ||
|
|
||
| Updates an existing Timeline template. | ||
|
|
||
| [source,console] | ||
| -------------------------------------------------- | ||
| PATCH api/timeline | ||
| { | ||
| "timeline": { | ||
| "columns": [ | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "@timestamp" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "message" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "event.category" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "event.action" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "host.name" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "source.ip" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "destination.ip" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "user.name" | ||
| } | ||
| ], | ||
| "dataProviders": [], | ||
| "description": "", | ||
| "eventType": "all", | ||
| "filters": [], | ||
| "kqlMode": "filter", | ||
| "kqlQuery": { | ||
| "filterQuery": null | ||
| }, | ||
| "title": "abd", | ||
| "dateRange": { | ||
| "start": 1587370079200, | ||
| "end": 1587456479201 | ||
| }, | ||
| "savedQueryId": null, | ||
| "sort": { | ||
| "columnId": "@timestamp", | ||
| "sortDirection": "desc" | ||
| }, | ||
| "timelineType": "template", | ||
| "created": 1587473119992, | ||
| "createdBy": "casetester", | ||
| "updated": 1587473119992, | ||
| "updatedBy": "casetester", | ||
| "templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1", <1> | ||
| "templateTimelineVersion": 2 <2> | ||
| }, | ||
| "timelineId": "7d7d4b60-3516-11ee-9f62-49614d8a84fd", <3> | ||
| "version": "WzE5MTcsMV0=" <4> | ||
| } | ||
| -------------------------------------------------- | ||
| <1> `templateTimelineId` must match the existing Timeline template version. | ||
| <2> `templateTimelineVersion` must be a Timeline template version greater than the existing one. | ||
| <3> `timelineId` must match the existing Timeline's `savedObjectId`. | ||
| <4> `version` must match the existing Timeline version. | ||
|
|
||
| ==== Response code | ||
|
|
||
| `200`:: | ||
| Indicates a successful call. | ||
|
|
||
| ==== Response payload | ||
|
|
||
| A JSON Timeline object with a unique `savedObjectId` and its `version`. | ||
|
|
||
| *Example 1* | ||
|
|
||
| Update Timeline response payload: | ||
|
|
||
| [source,json] | ||
| -------------------------------------------------- | ||
| { | ||
| "data": { | ||
| "persistTimeline": { | ||
| "code": 200, | ||
| "message": "success", | ||
| "timeline": { | ||
| "savedObjectId": "4bc294e0-3516-11ee-9f62-49614d8a84fd", | ||
| "version": "WzE5MTgsMV0=", | ||
| "columns": [ | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "@timestamp" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "message" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "event.category" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "event.action" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "host.name" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "source.ip" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "destination.ip" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "user.name" | ||
| } | ||
| ], | ||
| "dataProviders": [], | ||
| "dataViewId": null, | ||
| "description": "", | ||
| "eventType": "all", | ||
| "excludedRowRendererIds": [], | ||
| "favorite": [], | ||
| "filters": [], | ||
| "kqlMode": "filter", | ||
| "kqlQuery": { | ||
| "filterQuery": null | ||
| }, | ||
| "title": "abd", | ||
| "templateTimelineId": null, | ||
| "templateTimelineVersion": null, | ||
| "dateRange": { | ||
| "start": 1587370079200, | ||
| "end": 1587456479201 | ||
| }, | ||
| "savedQueryId": null, | ||
| "created": 1587468588922, | ||
| "createdBy": "casetester", | ||
| "updated": 1691408201273, | ||
| "updatedBy": "elastic", | ||
| "timelineType": "default", | ||
| "status": "active", | ||
| "sort": [ | ||
| { | ||
| "sortDirection": "desc", | ||
| "columnId": "@timestamp" | ||
| } | ||
| ], | ||
| "eventIdToNoteIds": [], | ||
| "noteIds": [], | ||
| "notes": [], | ||
| "pinnedEventIds": [], | ||
| "pinnedEventsSaveObject": [] | ||
| } | ||
| } | ||
| } | ||
| } | ||
| -------------------------------------------------- | ||
|
|
||
| *Example 2* | ||
|
|
||
| Update Timeline template response payload: | ||
|
|
||
| [source,json] | ||
| -------------------------------------------------- | ||
| { | ||
| "data": { | ||
| "persistTimeline": { | ||
| "code": 200, | ||
| "message": "success", | ||
| "timeline": { | ||
| "savedObjectId": "7d7d4b60-3516-11ee-9f62-49614d8a84fd", | ||
| "version": "WzE5MTksMV0=", | ||
| "columns": [ | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "@timestamp" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "message" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "event.category" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "event.action" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "host.name" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "source.ip" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "destination.ip" | ||
| }, | ||
| { | ||
| "columnHeaderType": "not-filtered", | ||
| "id": "user.name" | ||
| } | ||
| ], | ||
| "dataProviders": [], | ||
| "dataViewId": null, | ||
| "description": "", | ||
| "eventType": "all", | ||
| "excludedRowRendererIds": [], | ||
| "favorite": [], | ||
| "filters": [], | ||
| "kqlMode": "filter", | ||
| "kqlQuery": { | ||
| "filterQuery": null | ||
| }, | ||
| "title": "abd", | ||
| "templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1", | ||
| "templateTimelineVersion": 2, | ||
| "dateRange": { | ||
| "start": 1587370079200, | ||
| "end": 1587456479201 | ||
| }, | ||
| "savedQueryId": null, | ||
| "created": 1587473119992, | ||
| "createdBy": "casetester", | ||
| "updated": 1691408702104, | ||
| "updatedBy": "elastic", | ||
| "timelineType": "template", | ||
| "status": "active", | ||
| "sort": [ | ||
| { | ||
| "sortDirection": "desc", | ||
| "columnId": "@timestamp" | ||
| } | ||
| ], | ||
| "eventIdToNoteIds": [], | ||
| "noteIds": [], | ||
| "notes": [], | ||
| "pinnedEventIds": [], | ||
| "pinnedEventsSaveObject": [] | ||
| } | ||
| } | ||
| } | ||
| } | ||
| -------------------------------------------------- | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.