IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Create Timeline or Timeline template Add a note to an existing Timeline »
Elastic Docs ›Elastic Security Solution [8.11] ›Elastic Security APIs ›Timeline API

Update Timeline or Timeline template

edit

Update Timeline or Timeline template

edit

Updates an existing Timeline or Timeline template.

Use the timeline object’s timelineType field to specify whether you’re updating a Timeline or a Timeline template:

  • "timelineType": "default" updates an existing Timeline.
  • "timelineType": "template" updates an existing Timeline template.

Request URL

edit

PATCH <kibana host>:<port>/api/timeline

Request body

edit

A JSON object defining the Timeline or Timeline template query and time filter.

For detailed information about the Timeline object schema and its corresponding UI components, refer to Timeline schema.

Name Type Description Required

timeline

timeline

The timeline object of the Timeline or Timeline template that you’re updating.

If you’re updating a Timeline template, provide these fields so you can easily import template updates:

  • templateTimelineId: Use the unique identifier (UUID) of the Timeline template that you’re updating.
  • templateTimelineVersion: Specify a new version number for the template. It must be greater than the existing version number.

Yes

timelineId

String

The savedObjectId of the Timeline or Timeline template that you’re updating.

Yes

version

String

The version of the Timeline or Timeline template that you’re updating.

Yes

Example requests

edit

Example 1

Updates an existing Timeline.

PATCH api/timeline
{
  "timeline": {
    "columns": [
      {
        "columnHeaderType": "not-filtered",
        "id": "@timestamp"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "message"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "event.category"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "event.action"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "host.name"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "source.ip"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "destination.ip"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "user.name"
      }
    ],
    "dataProviders": [],
    "description": "",
    "eventType": "all",
    "filters": [],
    "kqlMode": "filter",
    "kqlQuery": {
      "filterQuery": null
    },
    "title": "abd",
    "dateRange": {
      "start": 1587370079200,
      "end": 1587456479201
    },
    "savedQueryId": null,
    "sort": {
      "columnId": "@timestamp",
      "sortDirection": "desc"
    },
    "created": 1587468588922,
    "createdBy": "casetester",
    "updated": 1587468588922,
    "updatedBy": "casetester",
    "timelineType": "default"
  },
  "timelineId": "4bc294e0-3516-11ee-9f62-49614d8a84fd", 
  "version": "WzE5MTUsMV0=" 
}

timelineId must match the savedObjectId of the Timeline that you’re updating.

version must match the version of the Timeline that you’re updating.

Example 2

Updates an existing Timeline template.

PATCH api/timeline
{
  "timeline": {
    "columns": [
      {
        "columnHeaderType": "not-filtered",
        "id": "@timestamp"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "message"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "event.category"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "event.action"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "host.name"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "source.ip"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "destination.ip"
      },
      {
        "columnHeaderType": "not-filtered",
        "id": "user.name"
      }
    ],
    "dataProviders": [],
    "description": "",
    "eventType": "all",
    "filters": [],
    "kqlMode": "filter",
    "kqlQuery": {
      "filterQuery": null
    },
    "title": "abd",
    "dateRange": {
      "start": 1587370079200,
      "end": 1587456479201
    },
    "savedQueryId": null,
    "sort": {
      "columnId": "@timestamp",
      "sortDirection": "desc"
    },
    "timelineType": "template",
    "created": 1587473119992,
    "createdBy": "casetester",
    "updated": 1587473119992,
    "updatedBy": "casetester",
    "templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1", 
    "templateTimelineVersion": 2 
  },
  "timelineId": "7d7d4b60-3516-11ee-9f62-49614d8a84fd", 
  "version": "WzE5MTcsMV0=" 
}

templateTimelineId must match the templateTimelineId of the Timeline template that you’re updating.

templateTimelineVersion must be a Timeline template version greater than the existing one.

timelineId must match the savedObjectId of the Timeline template that you’re updating.

version must match the version of the Timeline template that you’re updating.

Response code

edit
200
Indicates a successful call.

Response payload

edit

A JSON Timeline object with a unique savedObjectId and its version.

Example 1

Response payload of an updated Timeline:

{
  "data": {
    "persistTimeline": {
      "code": 200,
      "message": "success",
      "timeline": {
        "savedObjectId": "4bc294e0-3516-11ee-9f62-49614d8a84fd",
        "version": "WzE5MTgsMV0=",
        "columns": [
          {
            "columnHeaderType": "not-filtered",
            "id": "@timestamp"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "message"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "event.category"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "event.action"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "host.name"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "source.ip"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "destination.ip"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "user.name"
          }
        ],
        "dataProviders": [],
        "dataViewId": null,
        "description": "",
        "eventType": "all",
        "excludedRowRendererIds": [],
        "favorite": [],
        "filters": [],
        "kqlMode": "filter",
        "kqlQuery": {
          "filterQuery": null
        },
        "title": "abd",
        "templateTimelineId": null,
        "templateTimelineVersion": null,
        "dateRange": {
          "start": 1587370079200,
          "end": 1587456479201
        },
        "savedQueryId": null,
        "created": 1587468588922,
        "createdBy": "casetester",
        "updated": 1691408201273,
        "updatedBy": "elastic",
        "timelineType": "default",
        "status": "active",
        "sort": [
          {
            "sortDirection": "desc",
            "columnId": "@timestamp"
          }
        ],
        "eventIdToNoteIds": [],
        "noteIds": [],
        "notes": [],
        "pinnedEventIds": [],
        "pinnedEventsSaveObject": []
      }
    }
  }
}

Example 2

Response payload of an updated Timeline template:

{
  "data": {
    "persistTimeline": {
      "code": 200,
      "message": "success",
      "timeline": {
        "savedObjectId": "7d7d4b60-3516-11ee-9f62-49614d8a84fd",
        "version": "WzE5MTksMV0=",
        "columns": [
          {
            "columnHeaderType": "not-filtered",
            "id": "@timestamp"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "message"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "event.category"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "event.action"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "host.name"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "source.ip"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "destination.ip"
          },
          {
            "columnHeaderType": "not-filtered",
            "id": "user.name"
          }
        ],
        "dataProviders": [],
        "dataViewId": null,
        "description": "",
        "eventType": "all",
        "excludedRowRendererIds": [],
        "favorite": [],
        "filters": [],
        "kqlMode": "filter",
        "kqlQuery": {
          "filterQuery": null
        },
        "title": "abd",
        "templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1",
        "templateTimelineVersion": 2,
        "dateRange": {
          "start": 1587370079200,
          "end": 1587456479201
        },
        "savedQueryId": null,
        "created": 1587473119992,
        "createdBy": "casetester",
        "updated": 1691408702104,
        "updatedBy": "elastic",
        "timelineType": "template",
        "status": "active",
        "sort": [
          {
            "sortDirection": "desc",
            "columnId": "@timestamp"
          }
        ],
        "eventIdToNoteIds": [],
        "noteIds": [],
        "notes": [],
        "pinnedEventIds": [],
        "pinnedEventsSaveObject": []
      }
    }
  }
}
« Create Timeline or Timeline template Add a note to an existing Timeline »