Elastic Stack (ELK Stack) Streams API

openapi: 3.2.0
info:
  title: Elk Stack Streams API
  version: ''
  x-refined-note:
  - x-doc-license differs across the merged source definitions and was not carried
  - x-feedbackLink differs across the merged source definitions and was not carried
  description: 'Operations tagged streams across 2 of this provider''s published API definitions: elk-stack-elasticsearch-openapi.json, elk-stack-kibana-openapi.yaml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
tags:
- name: streams
paths:
  /_streams/{name}/_disable:
    post:
      tags:
      - streams
      summary: Disable a named stream
      description: 'Turn off the named stream feature for this cluster.


        ## Required authorization


        * Cluster privileges: `manage`

        '
      operationId: streams-logs-disable
      parameters:
      - in: path
        name: name
        description: The stream type to disable.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/streams._types.StreamType'
        style: simple
      - in: query
        name: master_timeout
        description: 'The period to wait for a connection to the master node.

          If no response is received before the timeout expires, the request fails and returns an error.'
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      - in: query
        name: timeout
        description: 'The period to wait for a response.

          If no response is received before the timeout expires, the request fails and returns an error.'
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
              examples:
                PostStreamsLogsDisableResponseExample1:
                  summary: Disable logs.otel streams
                  description: 'A successful response from `POST _streams/logs.otel/_disable` endpoint

                    '
                  value: "{\n  \"acknowledged\": true\n}"
      x-state: Experimental; Added in 9.1.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_streams/{name}/_enable:
    post:
      tags:
      - streams
      summary: Enable a named stream
      description: 'Turn on the named stream feature for this cluster.


        NOTE: To protect existing data, this feature can be turned on only if the cluster does not have

        existing indices or data streams that match the pattern `<name>|<name>.*` for the enabled stream

        type name. If those indices or data streams exist, a `409 - Conflict` response and error is

        returned.


        ## Required authorization


        * Cluster privileges: `manage`

        '
      operationId: streams-logs-enable
      parameters:
      - in: path
        name: name
        description: The stream type to enable.
        required: true
        deprecated: false
        schema:
          $ref: '#/components/schemas/streams._types.StreamType'
        style: simple
      - in: query
        name: master_timeout
        description: 'The period to wait for a connection to the master node.

          If no response is received before the timeout expires, the request fails and returns an error.'
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      - in: query
        name: timeout
        description: 'The period to wait for a response.

          If no response is received before the timeout expires, the request fails and returns an error.'
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/_types.AcknowledgedResponseBase'
              examples:
                PostStreamsEnableResponseExample1:
                  summary: Enable logs streams
                  description: 'A successful response from `POST _streams/logs.otel/_enable` endpoint

                    '
                  value: "{\n  \"acknowledged\": true\n}"
      x-state: Experimental; Added in 9.1.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /_streams/status:
    get:
      tags:
      - streams
      summary: Get the status of streams
      description: 'Get the current status for all types of streams.


        ## Required authorization


        * Cluster privileges: `monitor`

        '
      operationId: streams-status
      parameters:
      - in: query
        name: master_timeout
        description: Period to wait for a connection to the master node. If no response is received before the timeout expires, the request fails and returns an error.
        deprecated: false
        schema:
          default: 30s
          allOf:
          - $ref: '#/components/schemas/_types.Duration'
        style: form
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  logs:
                    allOf:
                    - $ref: '#/components/schemas/streams.status.StreamStatus'
                  logs.otel:
                    allOf:
                    - $ref: '#/components/schemas/streams.status.StreamStatus'
                  logs.ecs:
                    allOf:
                    - $ref: '#/components/schemas/streams.status.StreamStatus'
                required:
                - logs
                - logs.otel
                - logs.ecs
              examples:
                GetStreamsStatusResponseExample1:
                  summary: Get Streams Status A successful response from `GET _streams/status` that outlines the current state of all wired streams in the cluster.
                  value: "{\n  \"logs\": {\n    \"enabled\": false\n  }\n  \"logs.ecs\": {\n    \"enabled\": true\n  }\n  \"logs.otel\": {\n    \"enabled\": true\n  }\n}"
      x-state: Experimental; Added in 9.1.0
      x-metaTags:
      - content: Elasticsearch
        name: product_name
  /api/streams:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches list of all streams<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams
      parameters: []
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                listStreams:
                  value:
                    streams:
                    - description: Root logs stream
                      ingest:
                        failure_store:
                          inherit: {}
                        lifecycle:
                          inherit: {}
                        processing:
                          steps: []
                          updated_at: '2025-01-10T08:00:00.000Z'
                        settings: {}
                        wired:
                          fields:
                            '@timestamp':
                              type: date
                            log.level:
                              type: keyword
                            message:
                              type: match_only_text
                          routing:
                          - destination: logs.nginx
                            status: enabled
                            where:
                              eq: nginx
                              field: host.name
                      name: logs
                      type: wired
                      updated_at: '2025-01-10T08:00:00.000Z'
                    - description: Web server access logs, routed by severity
                      ingest:
                        failure_store:
                          inherit: {}
                        lifecycle:
                          inherit: {}
                        processing:
                          steps: []
                          updated_at: '2025-01-15T10:30:00.000Z'
                        settings: {}
                        wired:
                          fields:
                            host.name:
                              type: keyword
                            http.response.status_code:
                              type: long
                            message:
                              type: match_only_text
                          routing:
                          - destination: logs.nginx.errors
                            status: enabled
                            where:
                              field: http.response.status_code
                              gte: 500
                      name: logs.nginx
                      type: wired
                      updated_at: '2025-01-15T10:30:00.000Z'
                    - description: Legacy application logs
                      ingest:
                        classic: {}
                        failure_store:
                          disabled: {}
                        lifecycle:
                          dsl:
                            data_retention: 30d
                        processing:
                          steps:
                          - action: grok
                            from: message
                            ignore_missing: true
                            patterns:
                            - '%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}'
                          updated_at: '2024-12-01T09:00:00.000Z'
                        settings: {}
                      name: logs-myapp-default
                      type: classic
                      updated_at: '2024-12-01T09:00:00.000Z'
                    - description: All error-level logs across every stream
                      name: logs.errors
                      query:
                        esql: FROM logs* | WHERE log.level == "error"
                        view: logs.errors-view
                      type: query
                      updated_at: '2025-01-20T14:00:00.000Z'
          description: A list of all streams.
      summary: Get stream list
      tags:
      - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    servers:
    - url: https://{kibana_url}
      variables:
        kibana_url:
          default: localhost:5601
  /api/streams/_disable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_disable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Disables wired streams and deletes all existing stream definitions. The data of wired streams is deleted, but the data of classic streams is preserved.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-disable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - {}
      responses:
        '200':
          description: Streams were disabled successfully.
      summary: Disable streams
      tags:
      - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    servers:
    - url: https://{kibana_url}
      variables:
        kibana_url:
          default: localhost:5601
  /api/streams/_enable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_enable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Enables wired streams<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-enable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - {}
      responses:
        '200':
          description: Streams were enabled successfully.
      summary: Enable streams
      tags:
      - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    servers:
    - url: https://{kibana_url}
      variables:
        kibana_url:
          default: localhost:5601
  /api/streams/_resync:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_resync</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Resyncs all streams, making sure that Elasticsearch assets are up to date<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-resync
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - {}
      responses:
        '200':
          description: Streams were resynced successfully.
      summary: Resync streams
      tags:
      - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    servers:
    - url: https://{kibana_url}
      variables:
        kibana_url:
          default: localhost:5601
  /api/streams/{name}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Deletes a stream definition and the underlying data stream<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: delete-streams-name
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - {}
      responses:
        '200':
          description: The stream was deleted successfully.
      summary: Delete a stream
      tags:
      - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches a stream definition and associated dashboards<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name
      parameters:
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                getWiredStream:
                  value:
                    dashboards: []
                    data_stream_exists: true
                    effective_failure_store:
                      disabled: {}
                      from: logs
                    effective_lifecycle:
                      dsl:
                        data_retention: 7d
                      from: logs
                    effective_settings: {}
                    inherited_fields:
                      '@timestamp':
                        from: logs
                        type: date
                      log.level:
                        from: logs
                        type: keyword
                    privileges:
                      create_snapshot_repository: false
                      lifecycle: true
                      manage: true
                      manage_failure_store: true
                      monitor: true
                      read_failure_store: true
                      simulate: true
                      text_structure: true
                      view_index_metadata: true
                    rules: []
                    stream:
                      description: Web server access logs, routed by severity
                      ingest:
                        failure_store:
                          inherit: {}
                        lifecycle:
                          inherit: {}
                        processing:
                          steps: []
                          updated_at: '2025-01-15T10:30:00.000Z'
                        settings: {}
                        wired:
                          fields:
                            host.name:
                              type: keyword
                            http.response.status_code:
                              type: long
                            message:
                              type: match_only_text
                          routing:
                          - destination: logs.nginx.errors
                            status: enabled
                            where:
                              field: http.response.status_code
                              gte: 500
                      name: logs.nginx
                      type: wired
                      updated_at: '2025-01-15T10:30:00.000Z'
          description: Stream definition and associated metadata.
      summary: Get a stream
      tags:
      - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates or updates a stream definition. Classic streams can not be created through this API, only updated<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-name
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createQueryStream:
                value:
                  dashboards: []
                  rules: []
                  stream:
                    description: All error-level logs across every stream
                    query:
                      esql: FROM logs* | WHERE log.level == "error"
                      view: logs.errors-view
                    type: query
              createWiredStream:
                value:
                  dashboards: []
                  rules: []
                  stream:
                    description: Web server access logs, routed by severity
                    ingest:
                      failure_store:
                        inherit: {}
                      lifecycle:
                        inherit: {}
                      processing:
                        steps: []
                      settings: {}
                      wired:
                        fields:
                          host.name:
                            type: keyword
                          http.response.status_code:
                            type: long
                          message:
                            type: match_only_text
                        routing:
                        - destination: logs.nginx.errors
                          status: enabled
                          where:
                            field: http.response.status_code
                            gte: 500
                    type: wired
              updateClassicStream:
                value:
                  dashboards: []
                  rules: []
                  stream:
                    description: Legacy application logs managed as a classic data stream
                    ingest:
                      classic: {}
                      failure_store:
                        disabled: {}
                      lifecycle:
                        dsl:
                          data_retention: 30d
                      processing:
                        steps:
                        - action: grok
                          from: message
                          ignore_missing: true
                          patterns:
                          - '%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}'
                      settings: {}
                    type: classic
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamUpsertRequest'
      responses:
        '200':
          description: The stream was created or updated successfully.
      summary: Create or update a stream
      tags:
      - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    servers:
    - url: https://{kibana_url}
      variables:
        kibana_url:
          default: localhost:5601
  /api/streams/{name}/_fork:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_fork</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Forks a wired stream and creates a child stream<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-name-fork
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the parent stream to fork from.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              forkStream:
                value:
                  status: enabled
                  stream:
                    name: logs.nginx.errors
                  where:
                    eq: '500'
                    field: http.response.status_code
            schema:
              additionalProperties: false
              type: object
              properties:
                draft:
                  type: boolean
                status:
                  enum:
                  - enabled
                  - disabled
                  type: string
                stream:
                  additionalProperties: false
                  type: object
                  properties:
                    name:
                      type: string
                  required:
                  - name
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              required:
              - stream
              - where
      responses:
        '200':
          description: The stream was forked successfully.
      summary: Fork a stream
      tags:
      - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    servers:
    - url: https://{kibana_url}
      variables:
        kibana_url:
          default: localhost:5601
  /api/streams/{name}/_ingest:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_ingest</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches the ingest settings of an ingest stream definition<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name-ingest
      parameters:
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                getWiredIngest:
                  value:
                    ingest:
                      failure_store:
                        inherit: {}
                      lifecycle:
                        inherit: {}
                      processing:
                        steps:
                        - action: grok
                          from: message
                          ignore_missing: false
                          patterns:
                          - '%{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:@timestamp}\] "%{WORD:http.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}" %{NUMBER:http.response.status_code:int} (?:%{NUMBER:http.response.body.bytes:int}|-)'
                        updated_at: '2025-01-15T10:30:00.000Z'
                      settings: {}
                      wired:
                        fields:
                          client.ip:
                            type: ip
                          http.method:
                            type: keyword
                          http.response.body.bytes:
                            type: long
                          http.response.status_code:
                            type: long
                          url.original:
                            type: wildcard
                        routing:
                        - destination: logs.nginx.errors
                          status: enabled
                          where:
                            field: http.response.status_code
                            gte: 500
          description: Ingest settings for the stream.
      summary: Get ingest stream settings
      tags:
      - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
      security:
      - apiKeyAuth: []
      - basicAuth: []
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_ingest</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Upserts the ingest settings of an ingest stream definition<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-name-ingest
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              upsertWiredIngest:
                value:
                  ingest:
                    failure_store:
                      inherit: {}
                    lifecycle:
                      inherit: {}
                    processing:
                      steps:
                      - action: grok
                        from: message
                        ignore_missing: false
                        patterns:
                        - '%{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:@timestamp}\] "%{WORD:http.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}" %{NUMBER:http.response.status_code:int} (?:%{NUMBER:http.response.body.bytes:int}|-)'
                    settings: {}
                    wired:
                      fields:
                        client.ip:
                          type: ip
                        http.method:
                          type: keyword
                        http.response.body.bytes:
                          type: long
                        http.response.status_code:
                          type: long
                        url.original:
                          type: wildcard
                      routing:
                      - destination: logs.nginx.errors
                        status: enabled
                        where:
                

# --- truncated at 32 KB (122 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-streams-api-openapi.yml