openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana APIs Actions streams API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: streams
  description: "Streams provide a unified data management layer for ingestion, routing, and processing. There are three stream types:\n* **Wired** streams are managed by Kibana. They route documents to child streams based on\n  field conditions and support custom field mappings and processing steps.\n\n* **Classic** streams map to existing Elasticsearch data streams. You can add processing\n  steps to classic streams without changing their underlying index template.\n\n* **Query** streams are virtual aggregations backed by an ES|QL expression. They aggregate\n  data from multiple streams into a single logical view without duplicating documents.\n"
  x-displayName: Streams
  externalDocs:
    description: Streams documentation
    url: https://www.elastic.co/docs/solutions/observability/streams
paths:
  /api/streams:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches list of all streams<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                listStreams:
                  value:
                    streams:
                    - description: Root logs stream
                      ingest:
                        failure_store:
                          inherit: {}
                        lifecycle:
                          inherit: {}
                        processing:
                          steps: []
                          updated_at: '2025-01-10T08:00:00.000Z'
                        settings: {}
                        wired:
                          fields:
                            '@timestamp':
                              type: date
                            log.level:
                              type: keyword
                            message:
                              type: match_only_text
                          routing:
                          - destination: logs.nginx
                            status: enabled
                            where:
                              eq: nginx
                              field: host.name
                      name: logs
                      type: wired
                      updated_at: '2025-01-10T08:00:00.000Z'
                    - description: Web server access logs, routed by severity
                      ingest:
                        failure_store:
                          inherit: {}
                        lifecycle:
                          inherit: {}
                        processing:
                          steps: []
                          updated_at: '2025-01-15T10:30:00.000Z'
                        settings: {}
                        wired:
                          fields:
                            host.name:
                              type: keyword
                            http.response.status_code:
                              type: long
                            message:
                              type: match_only_text
                          routing:
                          - destination: logs.nginx.errors
                            status: enabled
                            where:
                              field: http.response.status_code
                              gte: 500
                      name: logs.nginx
                      type: wired
                      updated_at: '2025-01-15T10:30:00.000Z'
                    - description: Legacy application logs
                      ingest:
                        classic: {}
                        failure_store:
                          disabled: {}
                        lifecycle:
                          dsl:
                            data_retention: 30d
                        processing:
                          steps:
                          - action: grok
                            from: message
                            ignore_missing: true
                            patterns:
                            - '%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}'
                          updated_at: '2024-12-01T09:00:00.000Z'
                        settings: {}
                      name: logs-myapp-default
                      type: classic
                      updated_at: '2024-12-01T09:00:00.000Z'
                    - description: All error-level logs across every stream
                      name: logs.errors
                      query:
                        esql: FROM logs* | WHERE log.level == "error"
                        view: logs.errors-view
                      type: query
                      updated_at: '2025-01-20T14:00:00.000Z'
      summary: Get stream list
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/_disable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_disable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Disables wired streams and deletes all existing stream definitions. The data of wired streams is deleted, but the data of classic streams is preserved.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-disable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses: {}
      summary: Disable streams
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/_enable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_enable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Enables wired streams<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-enable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses: {}
      summary: Enable streams
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/_resync:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_resync</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Resyncs all streams, making sure that Elasticsearch assets are up to date<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-resync
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses: {}
      summary: Resync streams
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Deletes a stream definition and the underlying data stream<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: delete-streams-name
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          description: The stream was deleted successfully.
      summary: Delete a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches a stream definition and associated dashboards<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name
      parameters:
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                getWiredStream:
                  value:
                    dashboards: []
                    data_stream_exists: true
                    effective_failure_store:
                      disabled: {}
                      from: logs
                    effective_lifecycle:
                      dsl:
                        data_retention: 7d
                      from: logs
                    effective_settings: {}
                    inherited_fields:
                      '@timestamp':
                        from: logs
                        type: date
                      log.level:
                        from: logs
                        type: keyword
                    privileges:
                      create_snapshot_repository: false
                      lifecycle: true
                      manage: true
                      manage_failure_store: true
                      monitor: true
                      read_failure_store: true
                      simulate: true
                      text_structure: true
                      view_index_metadata: true
                    queries: []
                    rules: []
                    stream:
                      description: Web server access logs, routed by severity
                      ingest:
                        failure_store:
                          inherit: {}
                        lifecycle:
                          inherit: {}
                        processing:
                          steps: []
                          updated_at: '2025-01-15T10:30:00.000Z'
                        settings: {}
                        wired:
                          fields:
                            host.name:
                              type: keyword
                            http.response.status_code:
                              type: long
                            message:
                              type: match_only_text
                          routing:
                          - destination: logs.nginx.errors
                            status: enabled
                            where:
                              field: http.response.status_code
                              gte: 500
                      name: logs.nginx
                      type: wired
                      updated_at: '2025-01-15T10:30:00.000Z'
          description: Stream definition and associated metadata.
      summary: Get a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates or updates a stream definition. Classic streams can not be created through this API, only updated<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-name
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createQueryStream:
                value:
                  dashboards: []
                  queries: []
                  rules: []
                  stream:
                    description: All error-level logs across every stream
                    query:
                      esql: FROM logs* | WHERE log.level == "error"
                      view: logs.errors-view
                    type: query
              createWiredStream:
                value:
                  dashboards: []
                  queries: []
                  rules: []
                  stream:
                    description: Web server access logs, routed by severity
                    ingest:
                      failure_store:
                        inherit: {}
                      lifecycle:
                        inherit: {}
                      processing:
                        steps: []
                      settings: {}
                      wired:
                        fields:
                          host.name:
                            type: keyword
                          http.response.status_code:
                            type: long
                          message:
                            type: match_only_text
                        routing:
                        - destination: logs.nginx.errors
                          status: enabled
                          where:
                            field: http.response.status_code
                            gte: 500
                    type: wired
              updateClassicStream:
                value:
                  dashboards: []
                  queries: []
                  rules: []
                  stream:
                    description: Legacy application logs managed as a classic data stream
                    ingest:
                      classic: {}
                      failure_store:
                        disabled: {}
                      lifecycle:
                        dsl:
                          data_retention: 30d
                      processing:
                        steps:
                        - action: grok
                          from: message
                          ignore_missing: true
                          patterns:
                          - '%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}'
                      settings: {}
                    type: classic
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamUpsertRequest'
      responses:
        '200':
          description: The stream was created or updated successfully.
      summary: Create or update a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/_fork:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_fork</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Forks a wired stream and creates a child stream<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-name-fork
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the parent stream to fork from.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              forkStream:
                value:
                  status: enabled
                  stream:
                    name: logs.nginx.errors
                  where:
                    eq: '500'
                    field: http.response.status_code
            schema:
              additionalProperties: false
              type: object
              properties:
                draft:
                  type: boolean
                status:
                  enum:
                  - enabled
                  - disabled
                  type: string
                stream:
                  additionalProperties: false
                  type: object
                  properties:
                    name:
                      type: string
                  required:
                  - name
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              required:
              - stream
              - where
      responses:
        '200':
          description: The stream was forked successfully.
      summary: Fork a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/_ingest:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_ingest</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches the ingest settings of an ingest stream definition<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name-ingest
      parameters:
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                getWiredIngest:
                  value:
                    ingest:
                      failure_store:
                        inherit: {}
                      lifecycle:
                        inherit: {}
                      processing:
                        steps:
                        - action: grok
                          from: message
                          ignore_missing: false
                          patterns:
                          - '%{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:@timestamp}\] "%{WORD:http.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}" %{NUMBER:http.response.status_code:int} (?:%{NUMBER:http.response.body.bytes:int}|-)'
                        updated_at: '2025-01-15T10:30:00.000Z'
                      settings: {}
                      wired:
                        fields:
                          client.ip:
                            type: ip
                          http.method:
                            type: keyword
                          http.response.body.bytes:
                            type: long
                          http.response.status_code:
                            type: long
                          url.original:
                            type: wildcard
                        routing:
                        - destination: logs.nginx.errors
                          status: enabled
                          where:
                            field: http.response.status_code
                            gte: 500
          description: Ingest settings for the stream.
      summary: Get ingest stream settings
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_ingest</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Upserts the ingest settings of an ingest stream definition<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-name-ingest
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              upsertWiredIngest:
                value:
                  ingest:
                    failure_store:
                      inherit: {}
                    lifecycle:
                      inherit: {}
                    processing:
                      steps:
                      - action: grok
                        from: message
                        ignore_missing: false
                        patterns:
                        - '%{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:@timestamp}\] "%{WORD:http.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}" %{NUMBER:http.response.status_code:int} (?:%{NUMBER:http.response.body.bytes:int}|-)'
                    settings: {}
                    wired:
                      fields:
                        client.ip:
                          type: ip
                        http.method:
                          type: keyword
                        http.response.body.bytes:
                          type: long
                        http.response.status_code:
                          type: long
                        url.original:
                          type: wildcard
                      routing:
                      - destination: logs.nginx.errors
                        status: enabled
                        where:
                          eq: '500'
                          field: http.response.status_code
            schema:
              additionalProperties: false
              type: object
              properties:
                ingest:
                  anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      failure_store:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_FailureStore'
                      lifecycle:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle'
                      processing:
                        additionalProperties: false
                        type: object
                        properties:
                          steps:
                            items:
                              $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
                            type: array
                          updated_at: {}
                        required:
                        - steps
                      settings:
                        additionalProperties: false
                        type: object
                        properties:
                          index.number_of_replicas:
                            additionalProperties: false
                            type: object
                            properties:
                              value:
                                type: number
                            required:
                            - value
                          index.number_of_shards:
                            additionalProperties: false
                            type: object
                            properties:
                              value:
                                type: number
                            required:
                            - value
                          index.refresh_interval:
                            additionalProperties: false
                            type: object
                            properties:
                              value:
                                anyOf:
                                - type: string
                                - enum:
                                  - -1
                                  type: number
                            required:
                            - value
                      wired:
                        additionalProperties: false
                        type: object
                        properties:
                          draft:
                            type: boolean
                          fields:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_FieldDefinition'
                          routing:
                            items:
                              type: object
                              properties:
                                destination:
                                  description: A non-empty string.
                                  minLength: 1
                                  type: string
                                draft:
                                  type: boolean
                                status:
                                  enum:
                                  - enabled
                                  - disabled
                                  type: string
                                where:
                                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
                              required:
                              - destination
                              - where
                            type: array
                        required:
                        - fields
                        - routing
                    required:
                    - lifecycle
                    - processing
                    - settings
                    - failure_store
                    - wired
                  - additionalProperties: false
                    type: object
                    properties:
                      classic:
                        additionalProperties: false
                        type: object
                        properties:
                          field_overrides:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_ClassicFieldDefinition'
                      failure_store:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_FailureStore'
                      lifecycle:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle'
                      processing:
                        additionalProperties: false
                        type: object
                        properties:
                          steps:
                            items:
                              $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
                            type: array
                          updated_at: {}
                        required:
                        - steps
                      settings:
                        additionalProperties: false
                        type: object
                        properties:
                          index.number_of_replicas:
                            additionalProperties: false
                            type: object
                            properties:
                              value:
                                type: number
                            required:
                            - value
                          index.number_of_shards:
                            additionalProperties: false
                            type: object
                            properties:
                              value:
                                type: number
                            required:
                            - value
                          index.refresh_interval:
                            additionalProperties: false
                            type: object
                            properties:
                              value:
                                anyOf:
                                - type: string
                                - enum:
                                  - -1
                                  type: number
                            required:
                            - value
                    required:
                    - lifecycle
                    - processing
                    - settings
                    - failure_store
                    - classic
              required:
              - ingest
      responses:
        '200':
          description: The ingest settings were updated successfully.
      summary: Update ingest stream settings
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/_query:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_query</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches the query settings of a query stream definition<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name-query
      parameters:
      - description: The name of the query stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          description: Query settings for the stream.
      summary: Get query stream settings
      tags:
      - streams
      x-state: Technical Preview; added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_query</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Upserts the query settings of a query stream definition<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-name-query
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the query stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              upsertQueryStream:
                value:
                  query:
                    esql: FROM logs* | WHERE log.level == "error" | KEEP @timestamp, message, host.name, log.level
            schema:
              additionalProperties: false
              type: object
              properties:
                field_descriptions:
                  additionalProperties:
                    type: string
                  type: object
                query:
                  additionalProperties: false
                  type: object
                  properties:
                    esql:
                      type: string
                  required:
                  - esql
              required:
              - query
      responses:
        '200':
          description: The query stream settings were updated successfully.
      summary: Upsert query stream settings
      tags:
      - streams
      x-state: Technical Preview; added in 9.4.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/content/export:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/content/export</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Exports the content associated to a stream.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-name-content-export
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream to export content from.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              exportContent:
                value:
                  description: Nginx stream content pack
                  include:
                    objects:
                      all: {}
                  name: nginx-pack
                  version: 1.0.0
            schema:
              additionalProperties: false
              type: object
              properties:
                description:
                  type: string
                include:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_ContentPackIncludedObjects'
                name:
                  type: string
                version:
                  type: string
              required:
              - name
              - description
              - version
              - include
      responses:
        '200':
          description: Content pack archive for the stream.
      summary: Export stream content
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/content/import:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/content/import</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Links content objects to a stream.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-name-content-import
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream to import content into.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          multipart/form-data:
            examples:
              importContent:
                value:
                  content: <binary zip archive>
                  include: '{"objects":{"all":{}}}'
            schema:
              additionalProperties: false
              type: object
              properties:
                content: {}
                include:
                  type: string
              required:
              - include
              - content
      responses:
        '200':
          description: Content was imported into the stream successfully.
      summary: Import content into a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/queries:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/queries</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches all queries linked to a stream that are visible to the current user in the current space.<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name-queries
      parameters:
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                listQueries:
                  value:
                    queries:
                    - description: Count error-level log events grouped by host name
                      esql:
                        query: FROM logs.nginx | WHERE log.level == "error" | STATS count = COUNT(*) BY host.name
                      id: error-count-by-host
                      severity_score: 75
                      title: Error count by host
                      type: match
                    - description: Requests with response time above 2 seconds
                      esql:
                        query: FROM logs.nginx | WHERE http.response_time > 2000
                      id: high-latency-requests
                      severity_score: 50
                      title: High latency requests
                      type: match
          description: List of queries linked to the stream.
      summary: Get stream queries
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/queries/_bulk:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/queries/_bulk</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Bulk update queries of a stream. Can add new queries and delete existing ones.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-name-queries-bulk
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkQueries:
                value:
                  operations:
                  - index:
                      description: Count error-level log events grouped by host name
                      esql:
                        query: FROM logs* | WHERE log.level == "error" | STATS count = COUNT(*) BY host.name
                      id: error-count-by-host
                      title: Error count by host
                  - delete:
                      id: old-query-id
            schema:
              additionalProperties: false
              type: object
              properties:
                operations:
                  items:
                    anyOf:
                    - type: object
                      properties:
                        index:
                          type: object
                          properties:
                            description:
                              default: ''
                              type: string
                            esql:
                              type: object
                              properties:
                                query:
                                  type: string
                              required:
                              - query
                            evidence:
                              items:
                                type: string
                              type: array
                            id:
                              description: A non-empty string.
                              minLength: 1
                              type: string
                            severity_score:
                              type: number
                            title:
                              description: A non-empty string.
                              minLength: 1
                              type: string
                          required:
                          - title
                          - esql
                          - id
                      required:
                      - index
                    - type: object
                      properties:
                        delete:
                          type: object
                          properties:
                            id:
                              type: string
                          required:
                          - id
                      required:
                      - delete
                  type: array
              required:
              - operations
      responses:
        '200':
          description: Bulk operation completed successfully.
      summary: Bulk update queries
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/queries/{queryId}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/queries/{queryId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Remove a query from a stream. Noop if the query is not found on the stream.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: delete-streams-name-queries-queryid
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      - description: The identifier of the query to remove.
        in: path
        name: queryId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          description: The query was removed successfully.
      summary: Remove a query from a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/queries/{queryId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Adds a query to a stream. Noop if the query is already present on the stream.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-name-queries-queryid
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      - description: The identifier of the query.
        in: path
        name: queryId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              upsertQuery:
                value:
                  description: Count error-level log events grouped by host name
                  esql:
                    query: FROM logs* | WHERE log.level == "error" | STATS count = COUNT(*) BY host.name
                  title: Error count by host
            schema:
              additionalProperties: false
              type: object
              properties:
                description:
                  default: ''
                  type: string
                esql:
                  additionalProperties: false
                  type: object
                  properties:
                    query:
                      type: string
                  required:
                  - query
                evidence:
                  items:
                    type: string
                  type: array
                severity_score:
                  type: number
                title:
                  description: A non-empty string.
                  minLength: 1
                  type: string
              required:
              - title
              - esql
      responses:
        '200':
          description: The query was added or updated successfully.
      summary: Upsert a query to a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/significant_events:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/significant_events</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Read the significant events<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name-significant-events
      parameters:
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      - in: query
        name: from
        required: true
        schema:
          type: string
      - in: query
        name: to
        required: true
        schema:
          type: string
      - description: The bucket size for aggregating events (e.g. "1m", "1h").
        in: query
        name: bucketSize
        required: true
        schema:
          type: string
      - description: Query string to filter significant events on metadata fields
        in: query
        name: query
        required: false
        schema:
          type: string
      - description: 'Search mode: keyword (BM25), semantic (vector), or hybrid (RRF). When omitted, defaults to hybrid with a silent keyword fallback on failure. When set explicitly, failures propagate as errors.'
        in: query
        name: searchMode
        required: false
        schema:
          enum:
          - keyword
          - semantic
          - hybrid
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                significantEvents:
                  value:
                    aggregated_occurrences:
                    - count: 42
                      date: '2025-01-15T10:00:00.000Z'
                    - count: 18
                      date: '2025-01-15T11:00:00.000Z'
                    - count: 7
                      date: '2025-01-15T12:00:00.000Z'
                    significant_events:
                    - change_points:
                        type:
                          spike:
                            change_point: 1
                            p_value: 0.002
                      description: Count error-level log events grouped by host name
                      esql:
                        query: FROM logs.nginx | WHERE log.level == "error" | STATS count = COUNT(*) BY host.name
                      id: error-count-by-host
                      occurrences:
                      - count: 42
                        date: '2025-01-15T10:00:00.000Z'
                      - count: 18
                        date: '2025-01-15T11:00:00.000Z'
                      - count: 7
                        date: '2025-01-15T12:00:00.000Z'
                      rule_backed: false
                      severity_score: 75
                      stream_name: logs.nginx
                      title: Error count by host
                      type: match
          description: Significant events for the stream.
      summary: Read the significant events
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/significant_events/_generate:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/significant_events/_generate</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Generate significant events queries based on the stream data<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: post-streams-name-significant-events-generate
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      - description: Optional connector ID. If not provided, the default AI connector from settings will be used.
        in: query
        name: connectorId
        required: false
        schema:
          type: string
      - in: query
        name: from
        required: true
        schema:
          type: string
      - in: query
        name: to
        required: true
        schema:
          type: string
      - description: Number of sample documents to use for generation from the current data of stream
        in: query
        name: sampleDocsSize
        required: false
        schema:
          type: number
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          description: Generated significant event query definitions.
      summary: Generate significant events
      tags:
      - streams
      x-state: Technical Preview; added in 9.2.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/significant_events/_preview:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/significant_events/_preview</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Preview significant event results based on a given query<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: post-streams-name-significant-events-preview
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      - in: query
        name: from
        required: true
        schema:
          type: string
      - in: query
        name: to
        required: true
        schema:
          type: string
      - description: The bucket size for aggregating events (e.g. "1m", "1h").
        in: query
        name: bucketSize
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              type: object
              properties:
                query:
                  additionalProperties: false
                  type: object
                  properties:
                    esql:
                      additionalProperties: false
                      type: object
                      properties:
                        query:
                          type: string
                      required:
                      - query
                  required:
                  - esql
              required:
              - query
      responses:
        '200':
          description: Significant event preview results.
      summary: Preview significant events
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{streamName}/attachments:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{streamName}/attachments</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches all attachments linked to a stream that are visible to the current user in the current space. Optionally filter by attachment types, search query, and tags.<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-streamname-attachments
      parameters:
      - description: The name of the stream
        in: path
        name: streamName
        required: true
        schema:
          type: string
      - description: Search query to filter attachments by title
        in: query
        name: query
        required: false
        schema:
          type: string
      - description: Filter by attachment types (single value or array)
        in: query
        name: attachmentTypes
        required: false
        schema:
          items:
            enum:
            - dashboard
            - rule
            - slo
            type: string
          type: array
      - description: Filter by tags (single value or array)
        in: query
        name: tags
        required: false
        schema:
          items:
            type: string
          type: array
      requestBody:
        content:
          application/json:
            examples:
              listAttachmentsExample:
                value: {}
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                listAttachmentsResponse:
                  value:
                    attachments:
                    - createdAt: '2023-02-23T16:15:47.275Z'
                      description: Dashboard for monitoring production services
                      id: dashboard-123
                      streamNames:
                      - logs.awsfirehose
                      - logs.nginx
                      tags:
                      - monitoring
                      - production
                      title: My Dashboard
                      type: dashboard
                      updatedAt: '2023-03-24T14:39:17.636Z'
          description: Successfully retrieved attachments
      summary: Get stream attachments
      tags:
      - streams
      x-state: Technical Preview; added in 9.3.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{streamName}/attachments/_bulk:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{streamName}/attachments/_bulk</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Bulk update attachments linked to a stream. Can link new attachments and delete existing ones. Supports mixed attachment types in a single request.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-streamname-attachments-bulk
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream
        in: path
        name: streamName
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkAttachmentsExample:
                value:
                  operations:
                  - index:
                      id: dashboard-123
                      type: dashboard
                  - delete:
                      id: rule-456
                      type: rule
            schema:
              additionalProperties: false
              type: object
              properties:
                operations:
                  items:
                    anyOf:
                    - type: object
                      properties:
                        index:
                          type: object
                          properties:
                            id:
                              type: string
                            type:
                              enum:
                              - dashboard
                              - rule
                              - slo
                              type: string
                          required:
                          - id
                          - type
                      required:
                      - index
                    - type: object
                      properties:
                        delete:
                          type: object
                          properties:
                            id:
                              type: string
                            type:
                              enum:
                              - dashboard
                              - rule
                              - slo
                              type: string
                          required:
                          - id
                          - type
                      required:
                      - delete
                  type: array
              required:
              - operations
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkAttachmentsResponse:
                  value:
                    acknowledged: true
          description: Successfully performed bulk operations
      summary: Bulk update attachments
      tags:
      - streams
      x-state: Technical Preview; added in 9.3.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{streamName}/attachments/{attachmentType}/{attachmentId}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{streamName}/attachments/{attachmentType}/{attachmentId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Unlinks an attachment from a stream. Noop if the attachment is not linked to the stream.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: delete-streams-streamname-attachments-attachmenttype-attachmentid
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream
        in: path
        name: streamName
        required: true
        schema:
          type: string
      - description: The type of the attachment
        in: path
        name: attachmentType
        required: true
        schema:
          enum:
          - dashboard
          - rule
          - slo
          type: string
      - description: The ID of the attachment
        in: path
        name: attachmentId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              unlinkAttachmentExample:
                value: {}
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                unlinkAttachmentResponse:
                  value:
                    acknowledged: true
          description: Successfully unlinked attachment
      summary: Unlink an attachment from a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.3.0
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{streamName}/attachments/{attachmentType}/{attachmentId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Links an attachment to a stream. Noop if the attachment is already linked to the stream.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-streamname-attachments-attachmenttype-attachmentid
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream
        in: path
        name: streamName
        required: true
        schema:
          type: string
      - description: The type of the attachment
        in: path
        name: attachmentType
        required: true
        schema:
          enum:
          - dashboard
          - rule
          - slo
          type: string
      - description: The ID of the attachment
        in: path
        name: attachmentId
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              linkAttachmentExample:
                value: {}
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                linkAttachmentResponse:
                  value:
                    acknowledged: true
          description: Successfully linked attachment
      summary: Link an attachment to a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.3.0
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Kibana_HTTP_APIs_FailureStore:
      anyOf:
      - additionalProperties: false
        type: object
        properties:
          inherit:
            additionalProperties: false
            type: object
            properties: {}
        required:
        - inherit
      - additionalProperties: false
        type: object
        properties:
          disabled:
            additionalProperties: false
            type: object
            properties: {}
        required:
        - disabled
      - additionalProperties: false
        type: object
        properties:
          lifecycle:
            additionalProperties: false
            type: object
            properties:
              enabled:
                additionalProperties: false
                type: object
                properties:
                  data_retention:
                    description: A non-empty string.
                    minLength: 1
                    type: string
            required:
            - enabled
        required:
        - lifecycle
      - additionalProperties: false
        type: object
        properties:
          lifecycle:
            additionalProperties: false
            type: object
            properties:
              disabled:
                additionalProperties: false
                type: object
                properties: {}
            required:
            - disabled
        required:
        - lifecycle
    Kibana_HTTP_APIs_ClassicStreamUpsertRequest:
      additionalProperties: false
      type: object
      properties:
        dashboards:
          items:
            type: string
          type: array
        queries:
          items:
            type: object
            properties:
              description:
                type: string
              esql:
                type: object
                properties:
                  query:
                    type: string
                required:
                - query
              evidence:
                items:
                  type: string
                type: array
              id:
                description: A non-empty string.
                minLength: 1
                type: string
              severity_score:
                type: number
              title:
                description: A non-empty string.
                minLength: 1
                type: string
              type:
                default: match
                enum:
                - match
                - stats
                type: string
            required:
            - id
            - title
            - description
            - esql
          type: array
        rules:
          items:
            type: string
          type: array
        stream:
          additionalProperties: false
          type: object
          properties:
            description:
              type: string
            ingest:
              additionalProperties: false
              type: object
              properties:
                classic:
                  additionalProperties: false
                  type: object
                  properties:
                    field_overrides:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_ClassicFieldDefinition'
                failure_store:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_FailureStore'
                lifecycle:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle'
                processing:
                  additionalProperties: false
                  type: object
                  properties:
                    steps:
                      items:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
                      type: array
                    updated_at: {}
                  required:
                  - steps
                settings:
                  additionalProperties: false
                  type: object
                  properties:
                    index.number_of_replicas:
                      additionalProperties: false
                      type: object
                      properties:
                        value:
                          type: number
                      required:
                      - value
                    index.number_of_shards:
                      additionalProperties: false
                      type: object
                      properties:
                        value:
                          type: number
                      required:
                      - value
                    index.refresh_interval:
                      additionalProperties: false
                      type: object
                      properties:
                        value:
                          anyOf:
                          - type: string
                          - enum:
                            - -1
                            type: number
                      required:
                      - value
              required:
              - lifecycle
              - processing
              - settings
              - failure_store
              - classic
            query_streams:
              items:
                type: object
                properties:
                  name:
                    type: string
                required:
                - name
              type: array
            type:
              enum:
              - classic
              type: string
          required:
          - description
          - ingest
          - type
      required:
      - dashboards
      - rules
      - queries
      - stream
    Kibana_HTTP_APIs_StreamUpsertRequest:
      anyOf:
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_WiredStreamUpsertRequest'
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_ClassicStreamUpsertRequest'
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_QueryStreamUpsertRequest'
    Kibana_HTTP_APIs_StreamlangConditionBlock:
      additionalProperties: false
      type: object
      properties:
        condition:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_ConditionWithSteps'
        customIdentifier:
          type: string
      required:
      - condition
    Kibana_HTTP_APIs_StreamlangStep:
      anyOf:
      - anyOf:
        - additionalProperties: false
          description: Grok processor - Extract fields from text using grok patterns
          type: object
          properties:
            action:
              enum:
              - grok
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              description: Source field to parse with grok patterns
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              description: Skip processing when source field is missing
              type: boolean
            pattern_definitions:
              additionalProperties:
                type: string
              type: object
            patterns:
              description: Grok patterns applied in order to extract fields
              items:
                description: A non-empty string.
                minLength: 1
                type: string
              minItems: 1
              type: array
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
          - patterns
        - additionalProperties: false
          description: Dissect processor - Extract fields from text using a lightweight, delimiter-based parser
          type: object
          properties:
            action:
              enum:
              - dissect
              type: string
            append_separator:
              description: Separator inserted when target fields are concatenated
              minLength: 1
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              description: Source field to parse with dissect pattern
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              description: Skip processing when source field is missing
              type: boolean
            pattern:
              description: Dissect pattern describing field boundaries
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
          - pattern
        - additionalProperties: false
          description: Date processor - Parse dates from strings using one or more expected formats
          type: object
          properties:
            action:
              enum:
              - date
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            formats:
              description: Accepted input date formats, tried in order
              items:
                description: A non-empty string.
                minLength: 1
                type: string
              type: array
            from:
              description: Source field containing the date/time text
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            locale:
              description: Optional locale for date parsing
              minLength: 1
              type: string
            output_format:
              description: Optional output format for storing the parsed date as text
              minLength: 1
              type: string
            timezone:
              description: Optional timezone for date parsing
              minLength: 1
              type: string
            to:
              description: Target field for the parsed date (defaults to source)
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
          - formats
        - additionalProperties: false
          type: object
          properties:
            action:
              enum:
              - drop_document
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
        - additionalProperties: false
          type: object
          properties:
            action:
              enum:
              - math
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            expression:
              description: A non-empty string.
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              type: boolean
            to:
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - expression
          - to
        - additionalProperties: false
          description: Rename processor - Change a field name and optionally its location
          type: object
          properties:
            action:
              enum:
              - rename
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              description: Existing source field to rename or move
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              description: Skip when source field is missing
              type: boolean
            override:
              description: Allow overwriting the target field if it already exists
              type: boolean
            to:
              description: New field name or destination path
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
          - to
        - additionalProperties: false
          description: Set processor - Assign a literal or copied value to a field (mutually exclusive inputs)
          type: object
          properties:
            action:
              enum:
              - set
              type: string
            copy_from:
              description: Copy value from another field instead of providing a literal
              minLength: 1
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            override:
              description: Allow overwriting an existing target field
              type: boolean
            to:
              description: Target field to set or create
              minLength: 1
              type: string
            value:
              description: Literal value to assign to the target field
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - to
        - additionalProperties: false
          description: Append processor - Append one or more values to an existing or new array field
          type: object
          properties:
            action:
              enum:
              - append
              type: string
            allow_duplicates:
              description: If true, do not deduplicate appended values
              type: boolean
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            to:
              description: Array field to append values to
              minLength: 1
              type: string
            value:
              description: Values to append (must be literal, no templates)
              items: {}
              minItems: 1
              type: array
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - to
          - value
        - additionalProperties: false
          description: Remove by prefix processor - Remove a field and all nested fields matching the prefix
          type: object
          properties:
            action:
              enum:
              - remove_by_prefix
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              description: Field to remove along with all its nested fields
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
          required:
          - action
          - from
        - additionalProperties: false
          description: Remove processor - Delete one or more fields from the document
          type: object
          properties:
            action:
              enum:
              - remove
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              description: Field to remove from the document
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              description: Skip processing when source field is missing
              type: boolean
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
        - additionalProperties: false
          type: object
          properties:
            action:
              enum:
              - replace
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              type: boolean
            pattern:
              minLength: 1
              type: string
            replacement:
              type: string
            to:
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
          - pattern
          - replacement
        - additionalProperties: false
          description: Redact processor - Mask sensitive data using Grok patterns
          type: object
          properties:
            action:
              enum:
              - redact
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              description: Source field to redact sensitive data from
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              description: Skip processing when source field is missing (defaults to true)
              type: boolean
            pattern_definitions:
              additionalProperties:
                type: string
              description: Custom pattern definitions to use in the patterns
              type: object
            patterns:
              description: Grok patterns to match sensitive data (for example, "%{IP:client}", "%{EMAILADDRESS:email}")
              items:
                description: A non-empty string.
                minLength: 1
                type: string
              minItems: 1
              type: array
            prefix:
              description: Prefix to prepend to the redacted pattern name (defaults to "<")
              type: string
            suffix:
              description: Suffix to append to the redacted pattern name (defaults to ">")
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
          - patterns
        - additionalProperties: false
          type: object
          properties:
            action:
              enum:
              - uppercase
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              type: boolean
            to:
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
        - additionalProperties: false
          type: object
          properties:
            action:
              enum:
              - lowercase
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              type: boolean
            to:
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
        - additionalProperties: false
          type: object
          properties:
            action:
              enum:
              - trim
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              type: boolean
            to:
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
        - additionalProperties: false
          type: object
          properties:
            action:
              enum:
              - join
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            delimiter:
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              items:
                minLength: 1
                type: string
              minItems: 1
              type: array
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              type: boolean
            to:
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
          - delimiter
          - to
        - additionalProperties: false
          description: Split processor - Split a field value into an array using a separator
          type: object
          properties:
            action:
              enum:
              - split
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              description: Source field to split into an array
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              description: Skip processing when source field is missing
              type: boolean
            preserve_trailing:
              description: Preserve empty trailing fields in the split result
              type: boolean
            separator:
              description: Regex separator used to split the field value into an array
              minLength: 1
              type: string
            to:
              description: Target field for the split array (defaults to source)
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
          - separator
        - additionalProperties: false
          type: object
          properties:
            action:
              enum:
              - sort
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              description: Array field to sort
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              description: Skip processing when source field is missing
              type: boolean
            order:
              description: Sort order - "asc" (ascending) or "desc" (descending). Defaults to "asc"
              enum:
              - asc
              - desc
              type: string
            to:
              description: Target field for the sorted array (defaults to source)
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
        - additionalProperties: false
          description: Convert processor - Change the data type of a field value (integer, long, double, boolean, or string)
          type: object
          properties:
            action:
              enum:
              - convert
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              description: Source field to convert to a different data type
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              description: Skip processing when source field is missing
              type: boolean
            to:
              description: Target field for the converted value (defaults to source)
              minLength: 1
              type: string
            type:
              description: 'Target data type: integer, long, double, boolean, or string'
              enum:
              - integer
              - long
              - double
              - boolean
              - string
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
          - type
        - additionalProperties: false
          type: object
          properties:
            action:
              enum:
              - concat
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            from:
              items:
                anyOf:
                - type: object
                  properties:
                    type:
                      enum:
                      - field
                      type: string
                    value:
                      minLength: 1
                      type: string
                  required:
                  - type
                  - value
                - type: object
                  properties:
                    type:
                      enum:
                      - literal
                      type: string
                    value:
                      type: string
                  required:
                  - type
                  - value
              minItems: 1
              type: array
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              type: boolean
            to:
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - from
          - to
        - allOf:
          - additionalProperties: false
            type: object
            properties:
              action:
                enum:
                - network_direction
                type: string
              customIdentifier:
                description: Custom identifier to correlate this processor across outputs
                minLength: 1
                type: string
              description:
                description: Human-readable notes about this processor step
                type: string
              destination_ip:
                minLength: 1
                type: string
              ignore_failure:
                description: Continue pipeline execution if this processor fails
                type: boolean
              ignore_missing:
                type: boolean
              source_ip:
                minLength: 1
                type: string
              target_field:
                minLength: 1
                type: string
              where:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
                description: Conditional expression controlling whether this processor runs
            required:
            - action
            - source_ip
            - destination_ip
          - anyOf:
            - additionalProperties: false
              type: object
              properties:
                internal_networks:
                  items:
                    type: string
                  type: array
              required:
              - internal_networks
            - additionalProperties: false
              type: object
              properties:
                internal_networks_field:
                  minLength: 1
                  type: string
              required:
              - internal_networks_field
        - additionalProperties: false
          description: JsonExtract processor - Extract values from JSON strings using JSONPath-like selectors
          type: object
          properties:
            action:
              enum:
              - json_extract
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            extractions:
              description: List of extraction specifications
              items:
                description: A single extraction specification
                type: object
                properties:
                  selector:
                    description: JSONPath-like selector to extract value (e.g., "user.id", "$.metadata.client.ip", "items[0].name")
                    minLength: 1
                    type: string
                  target_field:
                    description: Target field to store the extracted value
                    minLength: 1
                    type: string
                  type:
                    description: Data type for the extracted value. Defaults to "keyword". Ensures consistent types across transpilers.
                    enum:
                    - keyword
                    - integer
                    - long
                    - double
                    - boolean
                    type: string
                required:
                - selector
                - target_field
              minItems: 1
              type: array
            field:
              description: Source field containing the JSON string to parse
              minLength: 1
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              description: Skip processing when source field is missing
              type: boolean
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - field
          - extractions
        - additionalProperties: false
          type: object
          properties:
            action:
              enum:
              - enrich
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            ignore_missing:
              type: boolean
            override:
              type: boolean
            policy_name:
              description: A non-empty string.
              minLength: 1
              type: string
            to:
              minLength: 1
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - policy_name
          - to
        - additionalProperties: false
          description: Manual ingest pipeline wrapper around native Elasticsearch processors
          type: object
          properties:
            action:
              description: Manual ingest pipeline - executes raw Elasticsearch ingest processors
              enum:
              - manual_ingest_pipeline
              type: string
            customIdentifier:
              description: Custom identifier to correlate this processor across outputs
              minLength: 1
              type: string
            description:
              description: Human-readable notes about this processor step
              type: string
            ignore_failure:
              description: Continue pipeline execution if this processor fails
              type: boolean
            on_failure:
              description: Fallback processors to run when a processor fails
              items:
                additionalProperties: {}
                type: object
              type: array
            processors:
              description: List of raw Elasticsearch ingest processors to run
              items:
                additionalProperties: {}
                type: object
              type: array
            tag:
              description: Optional ingest processor tag for Elasticsearch
              type: string
            where:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: Conditional expression controlling whether this processor runs
          required:
          - action
          - processors
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangConditionBlock'
    Kibana_HTTP_APIs_ClassicFieldDefinition:
      additionalProperties:
        $ref: '#/components/schemas/Kibana_HTTP_APIs_ClassicFieldDefinitionConfig'
      type: object
    Kibana_HTTP_APIs_FilterCondition:
      anyOf:
      - additionalProperties: false
        description: A condition that compares a field to a value or range using an operator as the key.
        type: object
        properties:
          contains:
            anyOf:
            - type: string
            - type: number
            - type: boolean
            description: Contains comparison value.
          endsWith:
            anyOf:
            - type: string
            - type: number
            - type: boolean
            description: Ends-with comparison value.
          eq:
            anyOf:
            - type: string
            - type: number
            - type: boolean
            description: Equality comparison value.
          field:
            description: The document field to filter on.
            minLength: 1
            type: string
          gt:
            anyOf:
            - type: string
            - type: number
            - type: boolean
            description: Greater-than comparison value.
          gte:
            anyOf:
            - type: string
            - type: number
            - type: boolean
            description: Greater-than-or-equal comparison value.
          includes:
            anyOf:
            - type: string
            - type: number
            - type: boolean
            description: Checks if multivalue field includes the value.
          lt:
            anyOf:
            - type: string
            - type: number
            - type: boolean
            description: Less-than comparison value.
          lte:
            anyOf:
            - type: string
            - type: number
            - type: boolean
            description: Less-than-or-equal comparison value.
          neq:
            anyOf:
            - type: string
            - type: number
            - type: boolean
            description: Inequality comparison value.
          range:
            additionalProperties: false
            description: Range comparison values.
            type: object
            properties:
              gt:
                anyOf:
                - type: string
                - type: number
                - type: boolean
                description: A value that can be a string, number, or boolean.
              gte:
                anyOf:
                - type: string
                - type: number
                - type: boolean
                description: A value that can be a string, number, or boolean.
              lt:
                anyOf:
                - type: string
                - type: number
                - type: boolean
                description: A value that can be a string, number, or boolean.
              lte:
                anyOf:
                - type: string
                - type: number
                - type: boolean
                description: A value that can be a string, number, or boolean.
          startsWith:
            anyOf:
            - type: string
            - type: number
            - type: boolean
            description: Starts-with comparison value.
        required:
        - field
      - additionalProperties: false
        description: A condition that checks for the existence or non-existence of a field.
        type: object
        properties:
          exists:
            description: Indicates whether the field exists or not.
            type: boolean
          field:
            description: The document field to check.
            minLength: 1
            type: string
        required:
        - field
      description: A basic filter condition, either unary or binary.
    Kibana_HTTP_APIs_FieldDefinition:
      additionalProperties:
        $ref: '#/components/schemas/Kibana_HTTP_APIs_FieldDefinitionConfig'
      type: object
    Kibana_HTTP_APIs_FieldDefinitionConfig:
      allOf:
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_RecursiveRecord'
      - anyOf:
        - additionalProperties: false
          type: object
          properties:
            description:
              type: string
            format:
              description: A non-empty string.
              minLength: 1
              type: string
            type:
              enum:
              - keyword
              - match_only_text
              - long
              - double
              - date
              - boolean
              - ip
              - geo_point
              - integer
              - short
              - byte
              - float
              - half_float
              - text
              - wildcard
              - version
              - unsigned_long
              - date_nanos
              type: string
          required:
          - type
        - additionalProperties: false
          type: object
          properties:
            description:
              type: string
            format:
              not: {}
            type:
              not: {}
          required:
          - description
        - additionalProperties: false
          type: object
          properties:
            description:
              type: string
            type:
              enum:
              - system
              type: string
          required:
          - type
    Kibana_HTTP_APIs_ConditionWithSteps:
      allOf:
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
      - additionalProperties: false
        type: object
        properties:
          else:
            items:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
            type: array
          steps:
            items:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
            type: array
        required:
        - steps
    Kibana_HTTP_APIs_WiredStreamUpsertRequest:
      additionalProperties: false
      type: object
      properties:
        dashboards:
          items:
            type: string
          type: array
        queries:
          items:
            type: object
            properties:
              description:
                type: string
              esql:
                type: object
                properties:
                  query:
                    type: string
                required:
                - query
              evidence:
                items:
                  type: string
                type: array
              id:
                description: A non-empty string.
                minLength: 1
                type: string
              severity_score:
                type: number
              title:
                description: A non-empty string.
                minLength: 1
                type: string
              type:
                default: match
                enum:
                - match
                - stats
                type: string
            required:
            - id
            - title
            - description
            - esql
          type: array
        rules:
          items:
            type: string
          type: array
        stream:
          additionalProperties: false
          type: object
          properties:
            description:
              type: string
            ingest:
              additionalProperties: false
              type: object
              properties:
                failure_store:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_FailureStore'
                lifecycle:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle'
                processing:
                  additionalProperties: false
                  type: object
                  properties:
                    steps:
                      items:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
                      type: array
                    updated_at: {}
                  required:
                  - steps
                settings:
                  additionalProperties: false
                  type: object
                  properties:
                    index.number_of_replicas:
                      additionalProperties: false
                      type: object
                      properties:
                        value:
                          type: number
                      required:
                      - value
                    index.number_of_shards:
                      additionalProperties: false
                      type: object
                      properties:
                        value:
                          type: number
                      required:
                      - value
                    index.refresh_interval:
                      additionalProperties: false
                      type: object
                      properties:
                        value:
                          anyOf:
                          - type: string
                          - enum:
                            - -1
                            type: number
                      required:
                      - value
                wired:
                  additionalProperties: false
                  type: object
                  properties:
                    draft:
                      type: boolean
                    fields:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_FieldDefinition'
                    routing:
                      items:
                        type: object
                        properties:
                          destination:
                            description: A non-empty string.
                            minLength: 1
                            type: string
                          draft:
                            type: boolean
                          status:
                            enum:
                            - enabled
                            - disabled
                            type: string
                          where:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
                        required:
                        - destination
                        - where
                      type: array
                  required:
                  - fields
                  - routing
              required:
              - lifecycle
              - processing
              - settings
              - failure_store
              - wired
            query_streams:
              items:
                type: object
                properties:
                  name:
                    type: string
                required:
                - name
              type: array
            type:
              enum:
              - wired
              type: string
          required:
          - description
          - ingest
          - type
      required:
      - dashboards
      - rules
      - queries
      - stream
    Kibana_HTTP_APIs_ClassicFieldDefinitionConfig:
      allOf:
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_RecursiveRecord'
      - anyOf:
        - additionalProperties: false
          type: object
          properties:
            description:
              type: string
            format:
              description: A non-empty string.
              minLength: 1
              type: string
            type:
              enum:
              - keyword
              - match_only_text
              - long
              - double
              - date
              - boolean
              - ip
              - geo_point
              - integer
              - short
              - byte
              - float
              - half_float
              - text
              - wildcard
              - version
              - unsigned_long
              - date_nanos
              type: string
          required:
          - type
        - additionalProperties: false
          type: object
          properties:
            description:
              type: string
            type:
              enum:
              - system
              type: string
          required:
          - type
    Kibana_HTTP_APIs_Condition:
      anyOf:
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_FilterCondition'
      - additionalProperties: false
        description: A logical AND that groups multiple conditions.
        type: object
        properties:
          and:
            description: An array of conditions. All sub-conditions must be true for this condition to be true.
            items:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
            type: array
        required:
        - and
      - additionalProperties: false
        description: A logical OR that groups multiple conditions.
        type: object
        properties:
          or:
            description: An array of conditions. At least one sub-condition must be true for this condition to be true.
            items:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
            type: array
        required:
        - or
      - additionalProperties: false
        description: A logical NOT that negates a condition.
        type: object
        properties:
          not:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
            description: A condition that negates another condition.
        required:
        - not
      - additionalProperties: false
        description: A condition that always evaluates to false.
        type: object
        properties:
          never:
            additionalProperties: false
            description: An empty object. This condition never matches.
            type: object
            properties: {}
        required:
        - never
      - additionalProperties: false
        description: A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.
        type: object
        properties:
          always:
            additionalProperties: false
            description: An empty object. This condition always matches.
            type: object
            properties: {}
        required:
        - always
      description: The root condition object. It can be a simple filter or a combination of other conditions.
    Kibana_HTTP_APIs_RecursiveRecord:
      additionalProperties:
        anyOf:
        - anyOf:
          - type: string
          - type: number
          - type: boolean
          - nullable: true
          - {}
        - items:
            anyOf:
            - type: string
            - type: number
            - type: boolean
            - nullable: true
            - {}
          type: array
        - items: {}
          type: array
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_RecursiveRecord'
      type: object
    Kibana_HTTP_APIs_IngestStreamLifecycle:
      anyOf:
      - additionalProperties: false
        type: object
        properties:
          dsl:
            additionalProperties: false
            type: object
            properties:
              data_retention:
                description: A non-empty string.
                minLength: 1
                type: string
              downsample:
                items:
                  type: object
                  properties:
                    after:
                      description: A non-empty string.
                      minLength: 1
                      type: string
                    fixed_interval:
                      description: A non-empty string.
                      minLength: 1
                      type: string
                  required:
                  - after
                  - fixed_interval
                type: array
        required:
        - dsl
      - additionalProperties: false
        type: object
        properties:
          ilm:
            additionalProperties: false
            type: object
            properties:
              policy:
                description: A non-empty string.
                minLength: 1
                type: string
            required:
            - policy
        required:
        - ilm
      - additionalProperties: false
        type: object
        properties:
          inherit:
            additionalProperties: false
            type: object
            properties: {}
        required:
        - inherit
    Kibana_HTTP_APIs_QueryStreamUpsertRequest:
      additionalProperties: false
      type: object
      properties:
        dashboards:
          items:
            type: string
          type: array
        queries:
          items:
            type: object
            properties:
              description:
                type: string
              esql:
                type: object
                properties:
                  query:
                    type: string
                required:
                - query
              evidence:
                items:
                  type: string
                type: array
              id:
                description: A non-empty string.
                minLength: 1
                type: string
              severity_score:
                type: number
              title:
                description: A non-empty string.
                minLength: 1
                type: string
              type:
                default: match
                enum:
                - match
                - stats
                type: string
            required:
            - id
            - title
            - description
            - esql
          type: array
        rules:
          items:
            type: string
          type: array
        stream:
          additionalProperties: false
          type: object
          properties:
            description:
              type: string
            field_descriptions:
              additionalProperties:
                type: string
              type: object
            query:
              additionalProperties: false
              type: object
              properties:
                esql:
                  type: string
                view:
                  type: string
              required:
              - view
              - esql
            query_streams:
              items:
                type: object
                properties:
                  name:
                    type: string
                required:
                - name
              type: array
            type:
              enum:
              - query
              type: string
          required:
          - description
          - type
          - query
      required:
      - dashboards
      - rules
      - queries
      - stream
    Kibana_HTTP_APIs_ContentPackIncludedObjects:
      anyOf:
      - additionalProperties: false
        type: object
        properties:
          objects:
            additionalProperties: false
            type: object
            properties:
              all:
                additionalProperties: false
                type: object
                properties: {}
            required:
            - all
        required:
        - objects
      - additionalProperties: false
        type: object
        properties:
          objects:
            additionalProperties: false
            type: object
            properties:
              mappings:
                type: boolean
              queries:
                items:
                  type: object
                  properties:
                    id:
                      type: string
                  required:
                  - id
                type: array
              routing:
                items:
                  allOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_ContentPackIncludedObjects'
                  - type: object
                    properties:
                      destination:
                        type: string
                    required:
                    - destination
                type: array
            required:
            - mappings
            - queries
            - routing
        required:
        - objects
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"