更新时间线或时间线模板
edit更新时间线或时间线模板edit
更新现有时间线或时间线模板。
使用 timeline 对象的 timelineType 字段来指定您是要更新时间线还是时间线模板。
-
"timelineType": "default"更新现有时间线。 -
"timelineType": "template"更新现有时间线模板。
请求 URLedit
PATCH <kibana host>:<port>/api/timeline
请求正文edit
一个 JSON 对象，定义时间线或时间线模板的查询和时间过滤器。
有关时间线对象模式及其对应 UI 组件的详细信息，请参阅 时间线模式.
| 名称 | 类型 | 描述 | 必需 |
|---|---|---|---|
|
您要更新的时间线或时间线模板的 如果您要更新时间线模板，请提供这些字段，以便您可以轻松地 导入模板 更新。
|
是 |
|
|
字符串 |
您要更新的时间线或时间线模板的 |
是 |
|
字符串 |
您要更新的时间线或时间线模板的版本。 |
是 |
示例请求edit
示例 1
更新现有时间线。
PATCH api/timeline
{
"timeline": {
"columns": [
{
"columnHeaderType": "not-filtered",
"id": "@timestamp"
},
{
"columnHeaderType": "not-filtered",
"id": "message"
},
{
"columnHeaderType": "not-filtered",
"id": "event.category"
},
{
"columnHeaderType": "not-filtered",
"id": "event.action"
},
{
"columnHeaderType": "not-filtered",
"id": "host.name"
},
{
"columnHeaderType": "not-filtered",
"id": "source.ip"
},
{
"columnHeaderType": "not-filtered",
"id": "destination.ip"
},
{
"columnHeaderType": "not-filtered",
"id": "user.name"
}
],
"dataProviders": [],
"description": "",
"eventType": "all",
"filters": [],
"kqlMode": "filter",
"kqlQuery": {
"filterQuery": null
},
"title": "abd",
"dateRange": {
"start": 1587370079200,
"end": 1587456479201
},
"savedQueryId": null,
"sort": {
"columnId": "@timestamp",
"sortDirection": "desc"
},
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1587468588922,
"updatedBy": "casetester",
"timelineType": "default"
},
"timelineId": "4bc294e0-3516-11ee-9f62-49614d8a84fd",
"version": "WzE5MTUsMV0="
}
示例 2
更新现有时间线模板。
PATCH api/timeline
{
"timeline": {
"columns": [
{
"columnHeaderType": "not-filtered",
"id": "@timestamp"
},
{
"columnHeaderType": "not-filtered",
"id": "message"
},
{
"columnHeaderType": "not-filtered",
"id": "event.category"
},
{
"columnHeaderType": "not-filtered",
"id": "event.action"
},
{
"columnHeaderType": "not-filtered",
"id": "host.name"
},
{
"columnHeaderType": "not-filtered",
"id": "source.ip"
},
{
"columnHeaderType": "not-filtered",
"id": "destination.ip"
},
{
"columnHeaderType": "not-filtered",
"id": "user.name"
}
],
"dataProviders": [],
"description": "",
"eventType": "all",
"filters": [],
"kqlMode": "filter",
"kqlQuery": {
"filterQuery": null
},
"title": "abd",
"dateRange": {
"start": 1587370079200,
"end": 1587456479201
},
"savedQueryId": null,
"sort": {
"columnId": "@timestamp",
"sortDirection": "desc"
},
"timelineType": "template",
"created": 1587473119992,
"createdBy": "casetester",
"updated": 1587473119992,
"updatedBy": "casetester",
"templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1",
"templateTimelineVersion": 2
},
"timelineId": "7d7d4b60-3516-11ee-9f62-49614d8a84fd",
"version": "WzE5MTcsMV0="
}
响应代码edit
-
200 - 表示调用成功。
响应有效负载edit
一个 JSON 时间线对象，具有唯一的 savedObjectId 及其 version。
示例 1
更新的时间线的响应有效负载
{
"data": {
"persistTimeline": {
"code": 200,
"message": "success",
"timeline": {
"savedObjectId": "4bc294e0-3516-11ee-9f62-49614d8a84fd",
"version": "WzE5MTgsMV0=",
"columns": [
{
"columnHeaderType": "not-filtered",
"id": "@timestamp"
},
{
"columnHeaderType": "not-filtered",
"id": "message"
},
{
"columnHeaderType": "not-filtered",
"id": "event.category"
},
{
"columnHeaderType": "not-filtered",
"id": "event.action"
},
{
"columnHeaderType": "not-filtered",
"id": "host.name"
},
{
"columnHeaderType": "not-filtered",
"id": "source.ip"
},
{
"columnHeaderType": "not-filtered",
"id": "destination.ip"
},
{
"columnHeaderType": "not-filtered",
"id": "user.name"
}
],
"dataProviders": [],
"dataViewId": null,
"description": "",
"eventType": "all",
"excludedRowRendererIds": [],
"favorite": [],
"filters": [],
"kqlMode": "filter",
"kqlQuery": {
"filterQuery": null
},
"title": "abd",
"templateTimelineId": null,
"templateTimelineVersion": null,
"dateRange": {
"start": 1587370079200,
"end": 1587456479201
},
"savedQueryId": null,
"created": 1587468588922,
"createdBy": "casetester",
"updated": 1691408201273,
"updatedBy": "elastic",
"timelineType": "default",
"status": "active",
"sort": [
{
"sortDirection": "desc",
"columnId": "@timestamp"
}
],
"eventIdToNoteIds": [],
"noteIds": [],
"notes": [],
"pinnedEventIds": [],
"pinnedEventsSaveObject": []
}
}
}
}
示例 2
更新的时间线模板的响应有效负载
{
"data": {
"persistTimeline": {
"code": 200,
"message": "success",
"timeline": {
"savedObjectId": "7d7d4b60-3516-11ee-9f62-49614d8a84fd",
"version": "WzE5MTksMV0=",
"columns": [
{
"columnHeaderType": "not-filtered",
"id": "@timestamp"
},
{
"columnHeaderType": "not-filtered",
"id": "message"
},
{
"columnHeaderType": "not-filtered",
"id": "event.category"
},
{
"columnHeaderType": "not-filtered",
"id": "event.action"
},
{
"columnHeaderType": "not-filtered",
"id": "host.name"
},
{
"columnHeaderType": "not-filtered",
"id": "source.ip"
},
{
"columnHeaderType": "not-filtered",
"id": "destination.ip"
},
{
"columnHeaderType": "not-filtered",
"id": "user.name"
}
],
"dataProviders": [],
"dataViewId": null,
"description": "",
"eventType": "all",
"excludedRowRendererIds": [],
"favorite": [],
"filters": [],
"kqlMode": "filter",
"kqlQuery": {
"filterQuery": null
},
"title": "abd",
"templateTimelineId": "6f9a3480-bf4f-11ea-9fcd-ed4e5fd0dcd1",
"templateTimelineVersion": 2,
"dateRange": {
"start": 1587370079200,
"end": 1587456479201
},
"savedQueryId": null,
"created": 1587473119992,
"createdBy": "casetester",
"updated": 1691408702104,
"updatedBy": "elastic",
"timelineType": "template",
"status": "active",
"sort": [
{
"sortDirection": "desc",
"columnId": "@timestamp"
}
],
"eventIdToNoteIds": [],
"noteIds": [],
"notes": [],
"pinnedEventIds": [],
"pinnedEventsSaveObject": []
}
}
}
}