Kibana streams API

openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana APIs Actions streams API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: streams
  description: "Streams provide a unified data management layer for ingestion, routing, and processing. There are three stream types:\n* **Wired** streams are managed by Kibana. They route documents to child streams based on\n  field conditions and support custom field mappings and processing steps.\n\n* **Classic** streams map to existing Elasticsearch data streams. You can add processing\n  steps to classic streams without changing their underlying index template.\n\n* **Query** streams are virtual aggregations backed by an ES|QL expression. They aggregate\n  data from multiple streams into a single logical view without duplicating documents.\n"
  x-displayName: Streams
  externalDocs:
    description: Streams documentation
    url: https://www.elastic.co/docs/solutions/observability/streams
paths:
  /api/streams:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches list of all streams<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                listStreams:
                  value:
                    streams:
                    - description: Root logs stream
                      ingest:
                        failure_store:
                          inherit: {}
                        lifecycle:
                          inherit: {}
                        processing:
                          steps: []
                          updated_at: '2025-01-10T08:00:00.000Z'
                        settings: {}
                        wired:
                          fields:
                            '@timestamp':
                              type: date
                            log.level:
                              type: keyword
                            message:
                              type: match_only_text
                          routing:
                          - destination: logs.nginx
                            status: enabled
                            where:
                              eq: nginx
                              field: host.name
                      name: logs
                      type: wired
                      updated_at: '2025-01-10T08:00:00.000Z'
                    - description: Web server access logs, routed by severity
                      ingest:
                        failure_store:
                          inherit: {}
                        lifecycle:
                          inherit: {}
                        processing:
                          steps: []
                          updated_at: '2025-01-15T10:30:00.000Z'
                        settings: {}
                        wired:
                          fields:
                            host.name:
                              type: keyword
                            http.response.status_code:
                              type: long
                            message:
                              type: match_only_text
                          routing:
                          - destination: logs.nginx.errors
                            status: enabled
                            where:
                              field: http.response.status_code
                              gte: 500
                      name: logs.nginx
                      type: wired
                      updated_at: '2025-01-15T10:30:00.000Z'
                    - description: Legacy application logs
                      ingest:
                        classic: {}
                        failure_store:
                          disabled: {}
                        lifecycle:
                          dsl:
                            data_retention: 30d
                        processing:
                          steps:
                          - action: grok
                            from: message
                            ignore_missing: true
                            patterns:
                            - '%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}'
                          updated_at: '2024-12-01T09:00:00.000Z'
                        settings: {}
                      name: logs-myapp-default
                      type: classic
                      updated_at: '2024-12-01T09:00:00.000Z'
                    - description: All error-level logs across every stream
                      name: logs.errors
                      query:
                        esql: FROM logs* | WHERE log.level == "error"
                        view: logs.errors-view
                      type: query
                      updated_at: '2025-01-20T14:00:00.000Z'
      summary: Get stream list
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/_disable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_disable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Disables wired streams and deletes all existing stream definitions. The data of wired streams is deleted, but the data of classic streams is preserved.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-disable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses: {}
      summary: Disable streams
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/_enable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_enable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Enables wired streams<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-enable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses: {}
      summary: Enable streams
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/_resync:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_resync</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Resyncs all streams, making sure that Elasticsearch assets are up to date<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-resync
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses: {}
      summary: Resync streams
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Deletes a stream definition and the underlying data stream<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: delete-streams-name
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          description: The stream was deleted successfully.
      summary: Delete a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches a stream definition and associated dashboards<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name
      parameters:
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                getWiredStream:
                  value:
                    dashboards: []
                    data_stream_exists: true
                    effective_failure_store:
                      disabled: {}
                      from: logs
                    effective_lifecycle:
                      dsl:
                        data_retention: 7d
                      from: logs
                    effective_settings: {}
                    inherited_fields:
                      '@timestamp':
                        from: logs
                        type: date
                      log.level:
                        from: logs
                        type: keyword
                    privileges:
                      create_snapshot_repository: false
                      lifecycle: true
                      manage: true
                      manage_failure_store: true
                      monitor: true
                      read_failure_store: true
                      simulate: true
                      text_structure: true
                      view_index_metadata: true
                    queries: []
                    rules: []
                    stream:
                      description: Web server access logs, routed by severity
                      ingest:
                        failure_store:
                          inherit: {}
                        lifecycle:
                          inherit: {}
                        processing:
                          steps: []
                          updated_at: '2025-01-15T10:30:00.000Z'
                        settings: {}
                        wired:
                          fields:
                            host.name:
                              type: keyword
                            http.response.status_code:
                              type: long
                            message:
                              type: match_only_text
                          routing:
                          - destination: logs.nginx.errors
                            status: enabled
                            where:
                              field: http.response.status_code
                              gte: 500
                      name: logs.nginx
                      type: wired
                      updated_at: '2025-01-15T10:30:00.000Z'
          description: Stream definition and associated metadata.
      summary: Get a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates or updates a stream definition. Classic streams can not be created through this API, only updated<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-name
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createQueryStream:
                value:
                  dashboards: []
                  queries: []
                  rules: []
                  stream:
                    description: All error-level logs across every stream
                    query:
                      esql: FROM logs* | WHERE log.level == "error"
                      view: logs.errors-view
                    type: query
              createWiredStream:
                value:
                  dashboards: []
                  queries: []
                  rules: []
                  stream:
                    description: Web server access logs, routed by severity
                    ingest:
                      failure_store:
                        inherit: {}
                      lifecycle:
                        inherit: {}
                      processing:
                        steps: []
                      settings: {}
                      wired:
                        fields:
                          host.name:
                            type: keyword
                          http.response.status_code:
                            type: long
                          message:
                            type: match_only_text
                        routing:
                        - destination: logs.nginx.errors
                          status: enabled
                          where:
                            field: http.response.status_code
                            gte: 500
                    type: wired
              updateClassicStream:
                value:
                  dashboards: []
                  queries: []
                  rules: []
                  stream:
                    description: Legacy application logs managed as a classic data stream
                    ingest:
                      classic: {}
                      failure_store:
                        disabled: {}
                      lifecycle:
                        dsl:
                          data_retention: 30d
                      processing:
                        steps:
                        - action: grok
                          from: message
                          ignore_missing: true
                          patterns:
                          - '%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}'
                      settings: {}
                    type: classic
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamUpsertRequest'
      responses:
        '200':
          description: The stream was created or updated successfully.
      summary: Create or update a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/_fork:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_fork</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Forks a wired stream and creates a child stream<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-name-fork
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the parent stream to fork from.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              forkStream:
                value:
                  status: enabled
                  stream:
                    name: logs.nginx.errors
                  where:
                    eq: '500'
                    field: http.response.status_code
            schema:
              additionalProperties: false
              type: object
              properties:
                draft:
                  type: boolean
                status:
                  enum:
                  - enabled
                  - disabled
                  type: string
                stream:
                  additionalProperties: false
                  type: object
                  properties:
                    name:
                      type: string
                  required:
                  - name
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              required:
              - stream
              - where
      responses:
        '200':
          description: The stream was forked successfully.
      summary: Fork a stream
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/streams/{name}/_ingest:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_ingest</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Fetches the ingest settings of an ingest stream definition<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name-ingest
      parameters:
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
              - additionalProperties: false
                type: object
                properties: {}
              - nullable: true
              - {}
      responses:
        '200':
          content:
            application/json:
              examples:
                getWiredIngest:
                  value:
                    ingest:
                      failure_store:
                        inherit: {}
                      lifecycle:
                        inherit: {}
                      processing:
                        steps:
                        - action: grok
                          from: message
                          ignore_missing: false
                          patterns:
                          - '%{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:@timestamp}\] "%{WORD:http.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}" %{NUMBER:http.response.status_code:int} (?:%{NUMBER:http.response.body.bytes:int}|-)'
                        updated_at: '2025-01-15T10:30:00.000Z'
                      settings: {}
                      wired:
                        fields:
                          client.ip:
                            type: ip
                          http.method:
                            type: keyword
                          http.response.body.bytes:
                            type: long
                          http.response.status_code:
                            type: long
                          url.original:
                            type: wildcard
                        routing:
                        - destination: logs.nginx.errors
                          status: enabled
                          where:
                            field: http.response.status_code
                            gte: 500
          description: Ingest settings for the stream.
      summary: Get ingest stream settings
      tags:
      - streams
      x-state: Technical Preview; added in 9.1.0
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_ingest</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Upserts the ingest settings of an ingest stream definition<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-name-ingest
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The name of the stream.
        in: path
        name: name
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            examples:
              upsertWiredIngest:
                value:
                  ingest:
                    failure_store:
                      inherit: {}
                    lifecycle:
                      inherit: {}
                    processing:
                      steps:
                      - action: grok
                        from: message
                        ignore_missing: false
                        patterns:
                        - '%{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:@timestamp}\] "%{WORD:http.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}" %{NUMBER:http.response.status_code:int} (?:%{NUMBER:http.response.body.bytes:int}|-)'
                    settings: {}
                    wired:
                      fields:
                        client.ip:
                          type: ip
                        http.method:
                          type: keyword
                        http.response.body.bytes:
                          type: long
                        http.response.status_code:
                          type: long
                        url.original:
                          type: wildcard
                      routing:
                      - destination: logs.nginx.errors
                        status: enabled
                        where:
                          eq: '500'
                          field: http.response.status_code
            schema:
              additionalProperties: false
              type: object
              properties:
                ingest:
                  anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      failure_store:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_FailureStore'
                      lifecycle:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle'
                      processing:
                        additionalProperties: false
                        type: object
                        properties:
                          steps:
                            items:
                              $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
                            type: array
                          updated_at: {}
                        required:
                        - steps
                      settings:
                        additionalProperties: false
                        type: object
                        properties:
                          index.number_of_replicas:
                            additionalProperties: false
                            type: object
                            properties:
                              value:
                                type: number
                            required:
                            - value
                          index.number_of_shards:
                            additionalProperties: false
                            type: object
                            properties:
                              value:
                                type: number
                            required:
                            - value
                          index.refresh_interval:
                            additionalProperties: false
                            type: object
                            properties:
                              value:
                                anyOf:
                                - type: string
                                - enum:
                                  - -1
                                  type: number
                            required:
                            - value
                      wired:
                        additionalProperties: false
                        type: object
                        properties:
                          draft:
                            type: boolean
                          fields:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_FieldDefinition'
                          routing:
                            items:
                              type: object
                              properties:
                                destination:
                                  description: A non-empty string.
                                  minLength: 1
                                  type: string
                                draft:
                                  type: boolean
                                status:
                                  enum:
                                  - enabled
                                  - disabled
                                  type: string
                                where:
                                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
                              required:
                              - destination
                              - where
                            type: array
                        required:
                        - fields
                        - routing
                    required:
                    - lifecycle
                    - processing
                    - settings
                    - failure_store
                    - wired
                  - additionalProperties: false
                    type: object
                    properties:
                      classic:
                        additionalProperties: false
                        type: object
                        properties:
                          field_overrides:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_ClassicFieldDefinition'
                      failure_store:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_FailureStore'
                      lifecycle:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle'
                      processing:
                        additionalProperties: false
                        type: object
                        properties:
                          steps:
                            items:
                              $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
     

# --- truncated at 32 KB (130 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-streams-api-openapi.yml