[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-elastic-kibana-streams":3,"mdc-vegjmc-key":34,"related-repo-elastic-kibana-streams":1719,"related-org-elastic-kibana-streams":1815},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":29,"sourceUrl":32,"mdContent":33},"kibana-streams","manage Kibana streams via REST API","List, inspect, enable, disable, and resync Kibana Streams via the REST API. Use when the user needs stream details, ingest\u002Fquery settings, queries, significant events, or attachments.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},"elastic","Elastic","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Felastic.png",[12,16,17,20],{"name":13,"slug":14,"type":15},"Data Engineering","data-engineering","tag",{"name":9,"slug":8,"type":15},{"name":18,"slug":19,"type":15},"Kibana","kibana",{"name":21,"slug":22,"type":15},"REST API","rest-api",531,"https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills","2026-07-12T07:46:46.184814",null,41,[],{"repoUrl":24,"stars":23,"forks":27,"topics":30,"description":31},[],"Official Elastic Skills","https:\u002F\u002Fgithub.com\u002Felastic\u002Fagent-skills\u002Ftree\u002FHEAD\u002Fskills\u002Fkibana\u002Fstreams","---\nname: kibana-streams\ndescription: >\n  List, inspect, enable, disable, and resync Kibana Streams via the REST API. Use\n  when the user needs stream details, ingest\u002Fquery settings, queries, significant\n  events, or attachments.\nmetadata:\n  author: elastic\n  version: 0.1.0\n---\n\n# Kibana Streams\n\nRead stream metadata, settings, queries, significant events, and attachments, and manage stream lifecycle (enable,\ndisable, resync) via the Kibana Streams REST API. Streams are an experimental way to manage data in Kibana — expect API\nand behavior changes. This skill covers **read** operations and **lifecycle** only; create, update, delete, fork, and\nother mutating operations may be added in a later version.\n\nFor detailed endpoints and parameters, see [references\u002Fstreams-api-reference.md](references\u002Fstreams-api-reference.md).\n\n## When to use\n\n- Listing all streams or getting a single stream's definition and metadata\n- Reading a stream's ingest or query settings\n- Listing a stream's queries\n- Reading significant events for a stream\n- Listing attachments (dashboards, rules, SLOs) linked to a stream\n- Enabling, disabling, or resyncing streams\n\n## Prerequisites\n\n| Item               | Description                                                               |\n| ------------------ | ------------------------------------------------------------------------- |\n| **Kibana URL**     | Kibana endpoint (e.g. `https:\u002F\u002Flocalhost:5601` or a Cloud deployment URL) |\n| **Authentication** | API key or basic auth (see the elasticsearch-authn skill)                 |\n| **Privileges**     | `read_stream` for read operations; `manage_stream` for lifecycle APIs     |\n\nUse the space-scoped path `\u002Fs\u002F{space_id}\u002Fapi\u002Fstreams` when operating in a non-default space. For role configuration\n(Kibana feature privileges and Elasticsearch-level permissions), refer to\n[Streams required permissions](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fsolutions\u002Fobservability\u002Fstreams\u002Fstreams#streams-required-permissions).\n\n## API base and headers\n\n- **Base path:** `GET` or `POST` to `\u003Ckibana_url>\u002Fapi\u002Fstreams` (or `\u002Fs\u002F\u003Cspace_id>\u002Fapi\u002Fstreams` for a space).\n- **Read operations:** Typically do not require extra headers; follow the\n  [official API docs](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fapi\u002Fdoc\u002Fkibana\u002Fgroup\u002Fendpoint-streams) for each endpoint.\n- **Lifecycle operations:** `POST \u002Fapi\u002Fstreams\u002F_disable`, `_enable`, and `_resync` are mutating — send `kbn-xsrf: true`\n  (or equivalent) as required by your Kibana version.\n\n## Operations (read + lifecycle)\n\n### Read\n\n| Operation                  | Method | Path                                     |\n| -------------------------- | ------ | ---------------------------------------- |\n| Get stream list            | GET    | `\u002Fapi\u002Fstreams`                           |\n| Get a stream               | GET    | `\u002Fapi\u002Fstreams\u002F{name}`                    |\n| Get ingest stream settings | GET    | `\u002Fapi\u002Fstreams\u002F{name}\u002F_ingest`            |\n| Get query stream settings  | GET    | `\u002Fapi\u002Fstreams\u002F{name}\u002F_query`             |\n| Get stream queries         | GET    | `\u002Fapi\u002Fstreams\u002F{name}\u002Fqueries`            |\n| Read significant events    | GET    | `\u002Fapi\u002Fstreams\u002F{name}\u002Fsignificant_events` |\n| Get stream attachments     | GET    | `\u002Fapi\u002Fstreams\u002F{streamName}\u002Fattachments`  |\n\n### Lifecycle\n\n| Operation       | Method | Path                    |\n| --------------- | ------ | ----------------------- |\n| Disable streams | POST   | `\u002Fapi\u002Fstreams\u002F_disable` |\n| Enable streams  | POST   | `\u002Fapi\u002Fstreams\u002F_enable`  |\n| Resync streams  | POST   | `\u002Fapi\u002Fstreams\u002F_resync`  |\n\nPath parameters: `{name}` and `{streamName}` are the stream identifier (same value; the API docs use both names).\n\n## Lifecycle and retention (ingest settings)\n\nIngest settings (`GET \u002Fapi\u002Fstreams\u002F{name}\u002F_ingest`) expose two separate lifecycle areas:\n\n- **Stream lifecycle** (`ingest.lifecycle`) — Controls how long the **stream's data** is retained. Use\n  `lifecycle.dsl.data_retention` (e.g. `\"30d\"`) for explicit retention, or `lifecycle.inherit` for child streams. This\n  is what users usually mean when they ask to \"set retention\", \"update retention\", or \"change the stream's retention\".\n- **Failure store lifecycle** (`ingest.failure_store.lifecycle`) — Controls retention of **failed documents** only\n  (documents that did not process successfully). Users rarely need to change this unless they explicitly mention the\n  failure store or failed-document retention.\n\nWhen a user asks to set or update retention, target the **stream's** main lifecycle (`lifecycle.dsl.data_retention`),\nnot the failure store, unless they specifically ask about failure store or failed documents.\n\n## Examples\n\n### List streams\n\n```bash\ncurl -X GET \"${KIBANA_URL}\u002Fapi\u002Fstreams\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\"\n```\n\n### Get a single stream\n\n```bash\ncurl -X GET \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002Fmy-stream\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\"\n```\n\n### Get stream queries\n\n```bash\ncurl -X GET \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002Fmy-stream\u002Fqueries\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\"\n```\n\n### Get significant events or attachments\n\n```bash\n# Significant events\ncurl -X GET \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002Fmy-stream\u002Fsignificant_events\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\"\n\n# Attachments (dashboards, rules, SLOs linked to the stream)\ncurl -X GET \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002Fmy-stream\u002Fattachments\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\"\n```\n\n### Disable, enable, or resync streams\n\n```bash\n# Disable streams (request body per API docs) — deletes wired stream data; warn and confirm before proceeding\ncurl -X POST \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002F_disable\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{}'\n\n# Enable streams\ncurl -X POST \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002F_enable\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{}'\n\n# Resync streams\ncurl -X POST \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002F_resync\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{}'\n```\n\nCheck the [Streams API operation pages](https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fapi\u002Fdoc\u002Fkibana\u002Fgroup\u002Fendpoint-streams) for\nrequest\u002Fresponse bodies (e.g. request body for \\_disable\u002F\\_enable\u002F\\_resync if required).\n\n## Guidelines\n\n- When the user asks to set or update **retention**, assume they mean the **stream's** data retention\n  (`ingest.lifecycle` \u002F `lifecycle.dsl.data_retention`). Do not change only the failure store retention unless they\n  explicitly ask about the failure store or failed documents.\n- Other mutating operations (create, update, delete, fork, bulk query management, attachment management, and more) are\n  not supported by this skill. See [references\u002Fstreams-api-reference.md](references\u002Fstreams-api-reference.md) for the\n  full list of deferred operations.\n- **Disabling streams can lead to data loss for wired streams.** The disable API deletes wired stream data (classic\n  stream data is preserved). Before calling disable, warn the user and confirm they understand the risk (and have backed\n  up or no longer need the data).\n- Prefer read operations when the user only needs to inspect stream state; use lifecycle APIs when they need to enable,\n  disable, or resync streams.\n",{"data":35,"body":38},{"name":4,"description":6,"metadata":36},{"author":8,"version":37},"0.1.0",{"type":39,"children":40},"root",[41,49,70,83,90,125,131,230,252,258,363,369,375,549,554,641,662,668,681,757,776,782,788,877,883,949,954,1020,1026,1182,1188,1633,1646,1652,1713],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":48},"text","Kibana Streams",{"type":42,"tag":50,"props":51,"children":52},"p",{},[53,55,61,63,68],{"type":47,"value":54},"Read stream metadata, settings, queries, significant events, and attachments, and manage stream lifecycle (enable,\ndisable, resync) via the Kibana Streams REST API. Streams are an experimental way to manage data in Kibana — expect API\nand behavior changes. This skill covers ",{"type":42,"tag":56,"props":57,"children":58},"strong",{},[59],{"type":47,"value":60},"read",{"type":47,"value":62}," operations and ",{"type":42,"tag":56,"props":64,"children":65},{},[66],{"type":47,"value":67},"lifecycle",{"type":47,"value":69}," only; create, update, delete, fork, and\nother mutating operations may be added in a later version.",{"type":42,"tag":50,"props":71,"children":72},{},[73,75,81],{"type":47,"value":74},"For detailed endpoints and parameters, see ",{"type":42,"tag":76,"props":77,"children":79},"a",{"href":78},"references\u002Fstreams-api-reference.md",[80],{"type":47,"value":78},{"type":47,"value":82},".",{"type":42,"tag":84,"props":85,"children":87},"h2",{"id":86},"when-to-use",[88],{"type":47,"value":89},"When to use",{"type":42,"tag":91,"props":92,"children":93},"ul",{},[94,100,105,110,115,120],{"type":42,"tag":95,"props":96,"children":97},"li",{},[98],{"type":47,"value":99},"Listing all streams or getting a single stream's definition and metadata",{"type":42,"tag":95,"props":101,"children":102},{},[103],{"type":47,"value":104},"Reading a stream's ingest or query settings",{"type":42,"tag":95,"props":106,"children":107},{},[108],{"type":47,"value":109},"Listing a stream's queries",{"type":42,"tag":95,"props":111,"children":112},{},[113],{"type":47,"value":114},"Reading significant events for a stream",{"type":42,"tag":95,"props":116,"children":117},{},[118],{"type":47,"value":119},"Listing attachments (dashboards, rules, SLOs) linked to a stream",{"type":42,"tag":95,"props":121,"children":122},{},[123],{"type":47,"value":124},"Enabling, disabling, or resyncing streams",{"type":42,"tag":84,"props":126,"children":128},{"id":127},"prerequisites",[129],{"type":47,"value":130},"Prerequisites",{"type":42,"tag":132,"props":133,"children":134},"table",{},[135,154],{"type":42,"tag":136,"props":137,"children":138},"thead",{},[139],{"type":42,"tag":140,"props":141,"children":142},"tr",{},[143,149],{"type":42,"tag":144,"props":145,"children":146},"th",{},[147],{"type":47,"value":148},"Item",{"type":42,"tag":144,"props":150,"children":151},{},[152],{"type":47,"value":153},"Description",{"type":42,"tag":155,"props":156,"children":157},"tbody",{},[158,184,200],{"type":42,"tag":140,"props":159,"children":160},{},[161,170],{"type":42,"tag":162,"props":163,"children":164},"td",{},[165],{"type":42,"tag":56,"props":166,"children":167},{},[168],{"type":47,"value":169},"Kibana URL",{"type":42,"tag":162,"props":171,"children":172},{},[173,175,182],{"type":47,"value":174},"Kibana endpoint (e.g. ",{"type":42,"tag":176,"props":177,"children":179},"code",{"className":178},[],[180],{"type":47,"value":181},"https:\u002F\u002Flocalhost:5601",{"type":47,"value":183}," or a Cloud deployment URL)",{"type":42,"tag":140,"props":185,"children":186},{},[187,195],{"type":42,"tag":162,"props":188,"children":189},{},[190],{"type":42,"tag":56,"props":191,"children":192},{},[193],{"type":47,"value":194},"Authentication",{"type":42,"tag":162,"props":196,"children":197},{},[198],{"type":47,"value":199},"API key or basic auth (see the elasticsearch-authn skill)",{"type":42,"tag":140,"props":201,"children":202},{},[203,211],{"type":42,"tag":162,"props":204,"children":205},{},[206],{"type":42,"tag":56,"props":207,"children":208},{},[209],{"type":47,"value":210},"Privileges",{"type":42,"tag":162,"props":212,"children":213},{},[214,220,222,228],{"type":42,"tag":176,"props":215,"children":217},{"className":216},[],[218],{"type":47,"value":219},"read_stream",{"type":47,"value":221}," for read operations; ",{"type":42,"tag":176,"props":223,"children":225},{"className":224},[],[226],{"type":47,"value":227},"manage_stream",{"type":47,"value":229}," for lifecycle APIs",{"type":42,"tag":50,"props":231,"children":232},{},[233,235,241,243,251],{"type":47,"value":234},"Use the space-scoped path ",{"type":42,"tag":176,"props":236,"children":238},{"className":237},[],[239],{"type":47,"value":240},"\u002Fs\u002F{space_id}\u002Fapi\u002Fstreams",{"type":47,"value":242}," when operating in a non-default space. For role configuration\n(Kibana feature privileges and Elasticsearch-level permissions), refer to\n",{"type":42,"tag":76,"props":244,"children":248},{"href":245,"rel":246},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fsolutions\u002Fobservability\u002Fstreams\u002Fstreams#streams-required-permissions",[247],"nofollow",[249],{"type":47,"value":250},"Streams required permissions",{"type":47,"value":82},{"type":42,"tag":84,"props":253,"children":255},{"id":254},"api-base-and-headers",[256],{"type":47,"value":257},"API base and headers",{"type":42,"tag":91,"props":259,"children":260},{},[261,303,322],{"type":42,"tag":95,"props":262,"children":263},{},[264,269,271,277,279,285,287,293,295,301],{"type":42,"tag":56,"props":265,"children":266},{},[267],{"type":47,"value":268},"Base path:",{"type":47,"value":270}," ",{"type":42,"tag":176,"props":272,"children":274},{"className":273},[],[275],{"type":47,"value":276},"GET",{"type":47,"value":278}," or ",{"type":42,"tag":176,"props":280,"children":282},{"className":281},[],[283],{"type":47,"value":284},"POST",{"type":47,"value":286}," to ",{"type":42,"tag":176,"props":288,"children":290},{"className":289},[],[291],{"type":47,"value":292},"\u003Ckibana_url>\u002Fapi\u002Fstreams",{"type":47,"value":294}," (or ",{"type":42,"tag":176,"props":296,"children":298},{"className":297},[],[299],{"type":47,"value":300},"\u002Fs\u002F\u003Cspace_id>\u002Fapi\u002Fstreams",{"type":47,"value":302}," for a space).",{"type":42,"tag":95,"props":304,"children":305},{},[306,311,313,320],{"type":42,"tag":56,"props":307,"children":308},{},[309],{"type":47,"value":310},"Read operations:",{"type":47,"value":312}," Typically do not require extra headers; follow the\n",{"type":42,"tag":76,"props":314,"children":317},{"href":315,"rel":316},"https:\u002F\u002Fwww.elastic.co\u002Fdocs\u002Fapi\u002Fdoc\u002Fkibana\u002Fgroup\u002Fendpoint-streams",[247],[318],{"type":47,"value":319},"official API docs",{"type":47,"value":321}," for each endpoint.",{"type":42,"tag":95,"props":323,"children":324},{},[325,330,331,337,339,345,347,353,355,361],{"type":42,"tag":56,"props":326,"children":327},{},[328],{"type":47,"value":329},"Lifecycle operations:",{"type":47,"value":270},{"type":42,"tag":176,"props":332,"children":334},{"className":333},[],[335],{"type":47,"value":336},"POST \u002Fapi\u002Fstreams\u002F_disable",{"type":47,"value":338},", ",{"type":42,"tag":176,"props":340,"children":342},{"className":341},[],[343],{"type":47,"value":344},"_enable",{"type":47,"value":346},", and ",{"type":42,"tag":176,"props":348,"children":350},{"className":349},[],[351],{"type":47,"value":352},"_resync",{"type":47,"value":354}," are mutating — send ",{"type":42,"tag":176,"props":356,"children":358},{"className":357},[],[359],{"type":47,"value":360},"kbn-xsrf: true",{"type":47,"value":362},"\n(or equivalent) as required by your Kibana version.",{"type":42,"tag":84,"props":364,"children":366},{"id":365},"operations-read-lifecycle",[367],{"type":47,"value":368},"Operations (read + lifecycle)",{"type":42,"tag":370,"props":371,"children":372},"h3",{"id":60},[373],{"type":47,"value":374},"Read",{"type":42,"tag":132,"props":376,"children":377},{},[378,399],{"type":42,"tag":136,"props":379,"children":380},{},[381],{"type":42,"tag":140,"props":382,"children":383},{},[384,389,394],{"type":42,"tag":144,"props":385,"children":386},{},[387],{"type":47,"value":388},"Operation",{"type":42,"tag":144,"props":390,"children":391},{},[392],{"type":47,"value":393},"Method",{"type":42,"tag":144,"props":395,"children":396},{},[397],{"type":47,"value":398},"Path",{"type":42,"tag":155,"props":400,"children":401},{},[402,423,444,465,486,507,528],{"type":42,"tag":140,"props":403,"children":404},{},[405,410,414],{"type":42,"tag":162,"props":406,"children":407},{},[408],{"type":47,"value":409},"Get stream list",{"type":42,"tag":162,"props":411,"children":412},{},[413],{"type":47,"value":276},{"type":42,"tag":162,"props":415,"children":416},{},[417],{"type":42,"tag":176,"props":418,"children":420},{"className":419},[],[421],{"type":47,"value":422},"\u002Fapi\u002Fstreams",{"type":42,"tag":140,"props":424,"children":425},{},[426,431,435],{"type":42,"tag":162,"props":427,"children":428},{},[429],{"type":47,"value":430},"Get a stream",{"type":42,"tag":162,"props":432,"children":433},{},[434],{"type":47,"value":276},{"type":42,"tag":162,"props":436,"children":437},{},[438],{"type":42,"tag":176,"props":439,"children":441},{"className":440},[],[442],{"type":47,"value":443},"\u002Fapi\u002Fstreams\u002F{name}",{"type":42,"tag":140,"props":445,"children":446},{},[447,452,456],{"type":42,"tag":162,"props":448,"children":449},{},[450],{"type":47,"value":451},"Get ingest stream settings",{"type":42,"tag":162,"props":453,"children":454},{},[455],{"type":47,"value":276},{"type":42,"tag":162,"props":457,"children":458},{},[459],{"type":42,"tag":176,"props":460,"children":462},{"className":461},[],[463],{"type":47,"value":464},"\u002Fapi\u002Fstreams\u002F{name}\u002F_ingest",{"type":42,"tag":140,"props":466,"children":467},{},[468,473,477],{"type":42,"tag":162,"props":469,"children":470},{},[471],{"type":47,"value":472},"Get query stream settings",{"type":42,"tag":162,"props":474,"children":475},{},[476],{"type":47,"value":276},{"type":42,"tag":162,"props":478,"children":479},{},[480],{"type":42,"tag":176,"props":481,"children":483},{"className":482},[],[484],{"type":47,"value":485},"\u002Fapi\u002Fstreams\u002F{name}\u002F_query",{"type":42,"tag":140,"props":487,"children":488},{},[489,494,498],{"type":42,"tag":162,"props":490,"children":491},{},[492],{"type":47,"value":493},"Get stream queries",{"type":42,"tag":162,"props":495,"children":496},{},[497],{"type":47,"value":276},{"type":42,"tag":162,"props":499,"children":500},{},[501],{"type":42,"tag":176,"props":502,"children":504},{"className":503},[],[505],{"type":47,"value":506},"\u002Fapi\u002Fstreams\u002F{name}\u002Fqueries",{"type":42,"tag":140,"props":508,"children":509},{},[510,515,519],{"type":42,"tag":162,"props":511,"children":512},{},[513],{"type":47,"value":514},"Read significant events",{"type":42,"tag":162,"props":516,"children":517},{},[518],{"type":47,"value":276},{"type":42,"tag":162,"props":520,"children":521},{},[522],{"type":42,"tag":176,"props":523,"children":525},{"className":524},[],[526],{"type":47,"value":527},"\u002Fapi\u002Fstreams\u002F{name}\u002Fsignificant_events",{"type":42,"tag":140,"props":529,"children":530},{},[531,536,540],{"type":42,"tag":162,"props":532,"children":533},{},[534],{"type":47,"value":535},"Get stream attachments",{"type":42,"tag":162,"props":537,"children":538},{},[539],{"type":47,"value":276},{"type":42,"tag":162,"props":541,"children":542},{},[543],{"type":42,"tag":176,"props":544,"children":546},{"className":545},[],[547],{"type":47,"value":548},"\u002Fapi\u002Fstreams\u002F{streamName}\u002Fattachments",{"type":42,"tag":370,"props":550,"children":551},{"id":67},[552],{"type":47,"value":553},"Lifecycle",{"type":42,"tag":132,"props":555,"children":556},{},[557,575],{"type":42,"tag":136,"props":558,"children":559},{},[560],{"type":42,"tag":140,"props":561,"children":562},{},[563,567,571],{"type":42,"tag":144,"props":564,"children":565},{},[566],{"type":47,"value":388},{"type":42,"tag":144,"props":568,"children":569},{},[570],{"type":47,"value":393},{"type":42,"tag":144,"props":572,"children":573},{},[574],{"type":47,"value":398},{"type":42,"tag":155,"props":576,"children":577},{},[578,599,620],{"type":42,"tag":140,"props":579,"children":580},{},[581,586,590],{"type":42,"tag":162,"props":582,"children":583},{},[584],{"type":47,"value":585},"Disable streams",{"type":42,"tag":162,"props":587,"children":588},{},[589],{"type":47,"value":284},{"type":42,"tag":162,"props":591,"children":592},{},[593],{"type":42,"tag":176,"props":594,"children":596},{"className":595},[],[597],{"type":47,"value":598},"\u002Fapi\u002Fstreams\u002F_disable",{"type":42,"tag":140,"props":600,"children":601},{},[602,607,611],{"type":42,"tag":162,"props":603,"children":604},{},[605],{"type":47,"value":606},"Enable streams",{"type":42,"tag":162,"props":608,"children":609},{},[610],{"type":47,"value":284},{"type":42,"tag":162,"props":612,"children":613},{},[614],{"type":42,"tag":176,"props":615,"children":617},{"className":616},[],[618],{"type":47,"value":619},"\u002Fapi\u002Fstreams\u002F_enable",{"type":42,"tag":140,"props":621,"children":622},{},[623,628,632],{"type":42,"tag":162,"props":624,"children":625},{},[626],{"type":47,"value":627},"Resync streams",{"type":42,"tag":162,"props":629,"children":630},{},[631],{"type":47,"value":284},{"type":42,"tag":162,"props":633,"children":634},{},[635],{"type":42,"tag":176,"props":636,"children":638},{"className":637},[],[639],{"type":47,"value":640},"\u002Fapi\u002Fstreams\u002F_resync",{"type":42,"tag":50,"props":642,"children":643},{},[644,646,652,654,660],{"type":47,"value":645},"Path parameters: ",{"type":42,"tag":176,"props":647,"children":649},{"className":648},[],[650],{"type":47,"value":651},"{name}",{"type":47,"value":653}," and ",{"type":42,"tag":176,"props":655,"children":657},{"className":656},[],[658],{"type":47,"value":659},"{streamName}",{"type":47,"value":661}," are the stream identifier (same value; the API docs use both names).",{"type":42,"tag":84,"props":663,"children":665},{"id":664},"lifecycle-and-retention-ingest-settings",[666],{"type":47,"value":667},"Lifecycle and retention (ingest settings)",{"type":42,"tag":50,"props":669,"children":670},{},[671,673,679],{"type":47,"value":672},"Ingest settings (",{"type":42,"tag":176,"props":674,"children":676},{"className":675},[],[677],{"type":47,"value":678},"GET \u002Fapi\u002Fstreams\u002F{name}\u002F_ingest",{"type":47,"value":680},") expose two separate lifecycle areas:",{"type":42,"tag":91,"props":682,"children":683},{},[684,733],{"type":42,"tag":95,"props":685,"children":686},{},[687,692,694,700,702,707,709,715,717,723,725,731],{"type":42,"tag":56,"props":688,"children":689},{},[690],{"type":47,"value":691},"Stream lifecycle",{"type":47,"value":693}," (",{"type":42,"tag":176,"props":695,"children":697},{"className":696},[],[698],{"type":47,"value":699},"ingest.lifecycle",{"type":47,"value":701},") — Controls how long the ",{"type":42,"tag":56,"props":703,"children":704},{},[705],{"type":47,"value":706},"stream's data",{"type":47,"value":708}," is retained. Use\n",{"type":42,"tag":176,"props":710,"children":712},{"className":711},[],[713],{"type":47,"value":714},"lifecycle.dsl.data_retention",{"type":47,"value":716}," (e.g. ",{"type":42,"tag":176,"props":718,"children":720},{"className":719},[],[721],{"type":47,"value":722},"\"30d\"",{"type":47,"value":724},") for explicit retention, or ",{"type":42,"tag":176,"props":726,"children":728},{"className":727},[],[729],{"type":47,"value":730},"lifecycle.inherit",{"type":47,"value":732}," for child streams. This\nis what users usually mean when they ask to \"set retention\", \"update retention\", or \"change the stream's retention\".",{"type":42,"tag":95,"props":734,"children":735},{},[736,741,742,748,750,755],{"type":42,"tag":56,"props":737,"children":738},{},[739],{"type":47,"value":740},"Failure store lifecycle",{"type":47,"value":693},{"type":42,"tag":176,"props":743,"children":745},{"className":744},[],[746],{"type":47,"value":747},"ingest.failure_store.lifecycle",{"type":47,"value":749},") — Controls retention of ",{"type":42,"tag":56,"props":751,"children":752},{},[753],{"type":47,"value":754},"failed documents",{"type":47,"value":756}," only\n(documents that did not process successfully). Users rarely need to change this unless they explicitly mention the\nfailure store or failed-document retention.",{"type":42,"tag":50,"props":758,"children":759},{},[760,762,767,769,774],{"type":47,"value":761},"When a user asks to set or update retention, target the ",{"type":42,"tag":56,"props":763,"children":764},{},[765],{"type":47,"value":766},"stream's",{"type":47,"value":768}," main lifecycle (",{"type":42,"tag":176,"props":770,"children":772},{"className":771},[],[773],{"type":47,"value":714},{"type":47,"value":775},"),\nnot the failure store, unless they specifically ask about failure store or failed documents.",{"type":42,"tag":84,"props":777,"children":779},{"id":778},"examples",[780],{"type":47,"value":781},"Examples",{"type":42,"tag":370,"props":783,"children":785},{"id":784},"list-streams",[786],{"type":47,"value":787},"List streams",{"type":42,"tag":789,"props":790,"children":795},"pre",{"className":791,"code":792,"language":793,"meta":794,"style":794},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","curl -X GET \"${KIBANA_URL}\u002Fapi\u002Fstreams\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\"\n","bash","",[796],{"type":42,"tag":176,"props":797,"children":798},{"__ignoreMap":794},[799,853],{"type":42,"tag":800,"props":801,"children":804},"span",{"class":802,"line":803},"line",1,[805,811,817,822,828,834,839,843,848],{"type":42,"tag":800,"props":806,"children":808},{"style":807},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[809],{"type":47,"value":810},"curl",{"type":42,"tag":800,"props":812,"children":814},{"style":813},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[815],{"type":47,"value":816}," -X",{"type":42,"tag":800,"props":818,"children":819},{"style":813},[820],{"type":47,"value":821}," GET",{"type":42,"tag":800,"props":823,"children":825},{"style":824},"--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF",[826],{"type":47,"value":827}," \"${",{"type":42,"tag":800,"props":829,"children":831},{"style":830},"--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8",[832],{"type":47,"value":833},"KIBANA_URL",{"type":42,"tag":800,"props":835,"children":836},{"style":824},[837],{"type":47,"value":838},"}",{"type":42,"tag":800,"props":840,"children":841},{"style":813},[842],{"type":47,"value":422},{"type":42,"tag":800,"props":844,"children":845},{"style":824},[846],{"type":47,"value":847},"\"",{"type":42,"tag":800,"props":849,"children":850},{"style":830},[851],{"type":47,"value":852}," \\\n",{"type":42,"tag":800,"props":854,"children":856},{"class":802,"line":855},2,[857,862,867,872],{"type":42,"tag":800,"props":858,"children":859},{"style":813},[860],{"type":47,"value":861},"  -H",{"type":42,"tag":800,"props":863,"children":864},{"style":824},[865],{"type":47,"value":866}," \"",{"type":42,"tag":800,"props":868,"children":869},{"style":813},[870],{"type":47,"value":871},"Authorization: ApiKey \u003Cbase64-api-key>",{"type":42,"tag":800,"props":873,"children":874},{"style":824},[875],{"type":47,"value":876},"\"\n",{"type":42,"tag":370,"props":878,"children":880},{"id":879},"get-a-single-stream",[881],{"type":47,"value":882},"Get a single stream",{"type":42,"tag":789,"props":884,"children":886},{"className":791,"code":885,"language":793,"meta":794,"style":794},"curl -X GET \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002Fmy-stream\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\"\n",[887],{"type":42,"tag":176,"props":888,"children":889},{"__ignoreMap":794},[890,930],{"type":42,"tag":800,"props":891,"children":892},{"class":802,"line":803},[893,897,901,905,909,913,917,922,926],{"type":42,"tag":800,"props":894,"children":895},{"style":807},[896],{"type":47,"value":810},{"type":42,"tag":800,"props":898,"children":899},{"style":813},[900],{"type":47,"value":816},{"type":42,"tag":800,"props":902,"children":903},{"style":813},[904],{"type":47,"value":821},{"type":42,"tag":800,"props":906,"children":907},{"style":824},[908],{"type":47,"value":827},{"type":42,"tag":800,"props":910,"children":911},{"style":830},[912],{"type":47,"value":833},{"type":42,"tag":800,"props":914,"children":915},{"style":824},[916],{"type":47,"value":838},{"type":42,"tag":800,"props":918,"children":919},{"style":813},[920],{"type":47,"value":921},"\u002Fapi\u002Fstreams\u002Fmy-stream",{"type":42,"tag":800,"props":923,"children":924},{"style":824},[925],{"type":47,"value":847},{"type":42,"tag":800,"props":927,"children":928},{"style":830},[929],{"type":47,"value":852},{"type":42,"tag":800,"props":931,"children":932},{"class":802,"line":855},[933,937,941,945],{"type":42,"tag":800,"props":934,"children":935},{"style":813},[936],{"type":47,"value":861},{"type":42,"tag":800,"props":938,"children":939},{"style":824},[940],{"type":47,"value":866},{"type":42,"tag":800,"props":942,"children":943},{"style":813},[944],{"type":47,"value":871},{"type":42,"tag":800,"props":946,"children":947},{"style":824},[948],{"type":47,"value":876},{"type":42,"tag":370,"props":950,"children":952},{"id":951},"get-stream-queries",[953],{"type":47,"value":493},{"type":42,"tag":789,"props":955,"children":957},{"className":791,"code":956,"language":793,"meta":794,"style":794},"curl -X GET \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002Fmy-stream\u002Fqueries\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\"\n",[958],{"type":42,"tag":176,"props":959,"children":960},{"__ignoreMap":794},[961,1001],{"type":42,"tag":800,"props":962,"children":963},{"class":802,"line":803},[964,968,972,976,980,984,988,993,997],{"type":42,"tag":800,"props":965,"children":966},{"style":807},[967],{"type":47,"value":810},{"type":42,"tag":800,"props":969,"children":970},{"style":813},[971],{"type":47,"value":816},{"type":42,"tag":800,"props":973,"children":974},{"style":813},[975],{"type":47,"value":821},{"type":42,"tag":800,"props":977,"children":978},{"style":824},[979],{"type":47,"value":827},{"type":42,"tag":800,"props":981,"children":982},{"style":830},[983],{"type":47,"value":833},{"type":42,"tag":800,"props":985,"children":986},{"style":824},[987],{"type":47,"value":838},{"type":42,"tag":800,"props":989,"children":990},{"style":813},[991],{"type":47,"value":992},"\u002Fapi\u002Fstreams\u002Fmy-stream\u002Fqueries",{"type":42,"tag":800,"props":994,"children":995},{"style":824},[996],{"type":47,"value":847},{"type":42,"tag":800,"props":998,"children":999},{"style":830},[1000],{"type":47,"value":852},{"type":42,"tag":800,"props":1002,"children":1003},{"class":802,"line":855},[1004,1008,1012,1016],{"type":42,"tag":800,"props":1005,"children":1006},{"style":813},[1007],{"type":47,"value":861},{"type":42,"tag":800,"props":1009,"children":1010},{"style":824},[1011],{"type":47,"value":866},{"type":42,"tag":800,"props":1013,"children":1014},{"style":813},[1015],{"type":47,"value":871},{"type":42,"tag":800,"props":1017,"children":1018},{"style":824},[1019],{"type":47,"value":876},{"type":42,"tag":370,"props":1021,"children":1023},{"id":1022},"get-significant-events-or-attachments",[1024],{"type":47,"value":1025},"Get significant events or attachments",{"type":42,"tag":789,"props":1027,"children":1029},{"className":791,"code":1028,"language":793,"meta":794,"style":794},"# Significant events\ncurl -X GET \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002Fmy-stream\u002Fsignificant_events\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\"\n\n# Attachments (dashboards, rules, SLOs linked to the stream)\ncurl -X GET \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002Fmy-stream\u002Fattachments\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\"\n",[1030],{"type":42,"tag":176,"props":1031,"children":1032},{"__ignoreMap":794},[1033,1042,1082,1102,1112,1121,1162],{"type":42,"tag":800,"props":1034,"children":1035},{"class":802,"line":803},[1036],{"type":42,"tag":800,"props":1037,"children":1039},{"style":1038},"--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic",[1040],{"type":47,"value":1041},"# Significant events\n",{"type":42,"tag":800,"props":1043,"children":1044},{"class":802,"line":855},[1045,1049,1053,1057,1061,1065,1069,1074,1078],{"type":42,"tag":800,"props":1046,"children":1047},{"style":807},[1048],{"type":47,"value":810},{"type":42,"tag":800,"props":1050,"children":1051},{"style":813},[1052],{"type":47,"value":816},{"type":42,"tag":800,"props":1054,"children":1055},{"style":813},[1056],{"type":47,"value":821},{"type":42,"tag":800,"props":1058,"children":1059},{"style":824},[1060],{"type":47,"value":827},{"type":42,"tag":800,"props":1062,"children":1063},{"style":830},[1064],{"type":47,"value":833},{"type":42,"tag":800,"props":1066,"children":1067},{"style":824},[1068],{"type":47,"value":838},{"type":42,"tag":800,"props":1070,"children":1071},{"style":813},[1072],{"type":47,"value":1073},"\u002Fapi\u002Fstreams\u002Fmy-stream\u002Fsignificant_events",{"type":42,"tag":800,"props":1075,"children":1076},{"style":824},[1077],{"type":47,"value":847},{"type":42,"tag":800,"props":1079,"children":1080},{"style":830},[1081],{"type":47,"value":852},{"type":42,"tag":800,"props":1083,"children":1085},{"class":802,"line":1084},3,[1086,1090,1094,1098],{"type":42,"tag":800,"props":1087,"children":1088},{"style":813},[1089],{"type":47,"value":861},{"type":42,"tag":800,"props":1091,"children":1092},{"style":824},[1093],{"type":47,"value":866},{"type":42,"tag":800,"props":1095,"children":1096},{"style":813},[1097],{"type":47,"value":871},{"type":42,"tag":800,"props":1099,"children":1100},{"style":824},[1101],{"type":47,"value":876},{"type":42,"tag":800,"props":1103,"children":1105},{"class":802,"line":1104},4,[1106],{"type":42,"tag":800,"props":1107,"children":1109},{"emptyLinePlaceholder":1108},true,[1110],{"type":47,"value":1111},"\n",{"type":42,"tag":800,"props":1113,"children":1115},{"class":802,"line":1114},5,[1116],{"type":42,"tag":800,"props":1117,"children":1118},{"style":1038},[1119],{"type":47,"value":1120},"# Attachments (dashboards, rules, SLOs linked to the stream)\n",{"type":42,"tag":800,"props":1122,"children":1124},{"class":802,"line":1123},6,[1125,1129,1133,1137,1141,1145,1149,1154,1158],{"type":42,"tag":800,"props":1126,"children":1127},{"style":807},[1128],{"type":47,"value":810},{"type":42,"tag":800,"props":1130,"children":1131},{"style":813},[1132],{"type":47,"value":816},{"type":42,"tag":800,"props":1134,"children":1135},{"style":813},[1136],{"type":47,"value":821},{"type":42,"tag":800,"props":1138,"children":1139},{"style":824},[1140],{"type":47,"value":827},{"type":42,"tag":800,"props":1142,"children":1143},{"style":830},[1144],{"type":47,"value":833},{"type":42,"tag":800,"props":1146,"children":1147},{"style":824},[1148],{"type":47,"value":838},{"type":42,"tag":800,"props":1150,"children":1151},{"style":813},[1152],{"type":47,"value":1153},"\u002Fapi\u002Fstreams\u002Fmy-stream\u002Fattachments",{"type":42,"tag":800,"props":1155,"children":1156},{"style":824},[1157],{"type":47,"value":847},{"type":42,"tag":800,"props":1159,"children":1160},{"style":830},[1161],{"type":47,"value":852},{"type":42,"tag":800,"props":1163,"children":1165},{"class":802,"line":1164},7,[1166,1170,1174,1178],{"type":42,"tag":800,"props":1167,"children":1168},{"style":813},[1169],{"type":47,"value":861},{"type":42,"tag":800,"props":1171,"children":1172},{"style":824},[1173],{"type":47,"value":866},{"type":42,"tag":800,"props":1175,"children":1176},{"style":813},[1177],{"type":47,"value":871},{"type":42,"tag":800,"props":1179,"children":1180},{"style":824},[1181],{"type":47,"value":876},{"type":42,"tag":370,"props":1183,"children":1185},{"id":1184},"disable-enable-or-resync-streams",[1186],{"type":47,"value":1187},"Disable, enable, or resync streams",{"type":42,"tag":789,"props":1189,"children":1191},{"className":791,"code":1190,"language":793,"meta":794,"style":794},"# Disable streams (request body per API docs) — deletes wired stream data; warn and confirm before proceeding\ncurl -X POST \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002F_disable\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{}'\n\n# Enable streams\ncurl -X POST \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002F_enable\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{}'\n\n# Resync streams\ncurl -X POST \"${KIBANA_URL}\u002Fapi\u002Fstreams\u002F_resync\" \\\n  -H \"Authorization: ApiKey \u003Cbase64-api-key>\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{}'\n",[1192],{"type":42,"tag":176,"props":1193,"children":1194},{"__ignoreMap":794},[1195,1203,1243,1266,1289,1313,1336,1343,1352,1392,1416,1440,1464,1484,1492,1501,1541,1565,1589,1613],{"type":42,"tag":800,"props":1196,"children":1197},{"class":802,"line":803},[1198],{"type":42,"tag":800,"props":1199,"children":1200},{"style":1038},[1201],{"type":47,"value":1202},"# Disable streams (request body per API docs) — deletes wired stream data; warn and confirm before proceeding\n",{"type":42,"tag":800,"props":1204,"children":1205},{"class":802,"line":855},[1206,1210,1214,1219,1223,1227,1231,1235,1239],{"type":42,"tag":800,"props":1207,"children":1208},{"style":807},[1209],{"type":47,"value":810},{"type":42,"tag":800,"props":1211,"children":1212},{"style":813},[1213],{"type":47,"value":816},{"type":42,"tag":800,"props":1215,"children":1216},{"style":813},[1217],{"type":47,"value":1218}," POST",{"type":42,"tag":800,"props":1220,"children":1221},{"style":824},[1222],{"type":47,"value":827},{"type":42,"tag":800,"props":1224,"children":1225},{"style":830},[1226],{"type":47,"value":833},{"type":42,"tag":800,"props":1228,"children":1229},{"style":824},[1230],{"type":47,"value":838},{"type":42,"tag":800,"props":1232,"children":1233},{"style":813},[1234],{"type":47,"value":598},{"type":42,"tag":800,"props":1236,"children":1237},{"style":824},[1238],{"type":47,"value":847},{"type":42,"tag":800,"props":1240,"children":1241},{"style":830},[1242],{"type":47,"value":852},{"type":42,"tag":800,"props":1244,"children":1245},{"class":802,"line":1084},[1246,1250,1254,1258,1262],{"type":42,"tag":800,"props":1247,"children":1248},{"style":813},[1249],{"type":47,"value":861},{"type":42,"tag":800,"props":1251,"children":1252},{"style":824},[1253],{"type":47,"value":866},{"type":42,"tag":800,"props":1255,"children":1256},{"style":813},[1257],{"type":47,"value":871},{"type":42,"tag":800,"props":1259,"children":1260},{"style":824},[1261],{"type":47,"value":847},{"type":42,"tag":800,"props":1263,"children":1264},{"style":830},[1265],{"type":47,"value":852},{"type":42,"tag":800,"props":1267,"children":1268},{"class":802,"line":1104},[1269,1273,1277,1281,1285],{"type":42,"tag":800,"props":1270,"children":1271},{"style":813},[1272],{"type":47,"value":861},{"type":42,"tag":800,"props":1274,"children":1275},{"style":824},[1276],{"type":47,"value":866},{"type":42,"tag":800,"props":1278,"children":1279},{"style":813},[1280],{"type":47,"value":360},{"type":42,"tag":800,"props":1282,"children":1283},{"style":824},[1284],{"type":47,"value":847},{"type":42,"tag":800,"props":1286,"children":1287},{"style":830},[1288],{"type":47,"value":852},{"type":42,"tag":800,"props":1290,"children":1291},{"class":802,"line":1114},[1292,1296,1300,1305,1309],{"type":42,"tag":800,"props":1293,"children":1294},{"style":813},[1295],{"type":47,"value":861},{"type":42,"tag":800,"props":1297,"children":1298},{"style":824},[1299],{"type":47,"value":866},{"type":42,"tag":800,"props":1301,"children":1302},{"style":813},[1303],{"type":47,"value":1304},"Content-Type: application\u002Fjson",{"type":42,"tag":800,"props":1306,"children":1307},{"style":824},[1308],{"type":47,"value":847},{"type":42,"tag":800,"props":1310,"children":1311},{"style":830},[1312],{"type":47,"value":852},{"type":42,"tag":800,"props":1314,"children":1315},{"class":802,"line":1123},[1316,1321,1326,1331],{"type":42,"tag":800,"props":1317,"children":1318},{"style":813},[1319],{"type":47,"value":1320},"  -d",{"type":42,"tag":800,"props":1322,"children":1323},{"style":824},[1324],{"type":47,"value":1325}," '",{"type":42,"tag":800,"props":1327,"children":1328},{"style":813},[1329],{"type":47,"value":1330},"{}",{"type":42,"tag":800,"props":1332,"children":1333},{"style":824},[1334],{"type":47,"value":1335},"'\n",{"type":42,"tag":800,"props":1337,"children":1338},{"class":802,"line":1164},[1339],{"type":42,"tag":800,"props":1340,"children":1341},{"emptyLinePlaceholder":1108},[1342],{"type":47,"value":1111},{"type":42,"tag":800,"props":1344,"children":1346},{"class":802,"line":1345},8,[1347],{"type":42,"tag":800,"props":1348,"children":1349},{"style":1038},[1350],{"type":47,"value":1351},"# Enable streams\n",{"type":42,"tag":800,"props":1353,"children":1355},{"class":802,"line":1354},9,[1356,1360,1364,1368,1372,1376,1380,1384,1388],{"type":42,"tag":800,"props":1357,"children":1358},{"style":807},[1359],{"type":47,"value":810},{"type":42,"tag":800,"props":1361,"children":1362},{"style":813},[1363],{"type":47,"value":816},{"type":42,"tag":800,"props":1365,"children":1366},{"style":813},[1367],{"type":47,"value":1218},{"type":42,"tag":800,"props":1369,"children":1370},{"style":824},[1371],{"type":47,"value":827},{"type":42,"tag":800,"props":1373,"children":1374},{"style":830},[1375],{"type":47,"value":833},{"type":42,"tag":800,"props":1377,"children":1378},{"style":824},[1379],{"type":47,"value":838},{"type":42,"tag":800,"props":1381,"children":1382},{"style":813},[1383],{"type":47,"value":619},{"type":42,"tag":800,"props":1385,"children":1386},{"style":824},[1387],{"type":47,"value":847},{"type":42,"tag":800,"props":1389,"children":1390},{"style":830},[1391],{"type":47,"value":852},{"type":42,"tag":800,"props":1393,"children":1395},{"class":802,"line":1394},10,[1396,1400,1404,1408,1412],{"type":42,"tag":800,"props":1397,"children":1398},{"style":813},[1399],{"type":47,"value":861},{"type":42,"tag":800,"props":1401,"children":1402},{"style":824},[1403],{"type":47,"value":866},{"type":42,"tag":800,"props":1405,"children":1406},{"style":813},[1407],{"type":47,"value":871},{"type":42,"tag":800,"props":1409,"children":1410},{"style":824},[1411],{"type":47,"value":847},{"type":42,"tag":800,"props":1413,"children":1414},{"style":830},[1415],{"type":47,"value":852},{"type":42,"tag":800,"props":1417,"children":1419},{"class":802,"line":1418},11,[1420,1424,1428,1432,1436],{"type":42,"tag":800,"props":1421,"children":1422},{"style":813},[1423],{"type":47,"value":861},{"type":42,"tag":800,"props":1425,"children":1426},{"style":824},[1427],{"type":47,"value":866},{"type":42,"tag":800,"props":1429,"children":1430},{"style":813},[1431],{"type":47,"value":360},{"type":42,"tag":800,"props":1433,"children":1434},{"style":824},[1435],{"type":47,"value":847},{"type":42,"tag":800,"props":1437,"children":1438},{"style":830},[1439],{"type":47,"value":852},{"type":42,"tag":800,"props":1441,"children":1443},{"class":802,"line":1442},12,[1444,1448,1452,1456,1460],{"type":42,"tag":800,"props":1445,"children":1446},{"style":813},[1447],{"type":47,"value":861},{"type":42,"tag":800,"props":1449,"children":1450},{"style":824},[1451],{"type":47,"value":866},{"type":42,"tag":800,"props":1453,"children":1454},{"style":813},[1455],{"type":47,"value":1304},{"type":42,"tag":800,"props":1457,"children":1458},{"style":824},[1459],{"type":47,"value":847},{"type":42,"tag":800,"props":1461,"children":1462},{"style":830},[1463],{"type":47,"value":852},{"type":42,"tag":800,"props":1465,"children":1467},{"class":802,"line":1466},13,[1468,1472,1476,1480],{"type":42,"tag":800,"props":1469,"children":1470},{"style":813},[1471],{"type":47,"value":1320},{"type":42,"tag":800,"props":1473,"children":1474},{"style":824},[1475],{"type":47,"value":1325},{"type":42,"tag":800,"props":1477,"children":1478},{"style":813},[1479],{"type":47,"value":1330},{"type":42,"tag":800,"props":1481,"children":1482},{"style":824},[1483],{"type":47,"value":1335},{"type":42,"tag":800,"props":1485,"children":1487},{"class":802,"line":1486},14,[1488],{"type":42,"tag":800,"props":1489,"children":1490},{"emptyLinePlaceholder":1108},[1491],{"type":47,"value":1111},{"type":42,"tag":800,"props":1493,"children":1495},{"class":802,"line":1494},15,[1496],{"type":42,"tag":800,"props":1497,"children":1498},{"style":1038},[1499],{"type":47,"value":1500},"# Resync streams\n",{"type":42,"tag":800,"props":1502,"children":1504},{"class":802,"line":1503},16,[1505,1509,1513,1517,1521,1525,1529,1533,1537],{"type":42,"tag":800,"props":1506,"children":1507},{"style":807},[1508],{"type":47,"value":810},{"type":42,"tag":800,"props":1510,"children":1511},{"style":813},[1512],{"type":47,"value":816},{"type":42,"tag":800,"props":1514,"children":1515},{"style":813},[1516],{"type":47,"value":1218},{"type":42,"tag":800,"props":1518,"children":1519},{"style":824},[1520],{"type":47,"value":827},{"type":42,"tag":800,"props":1522,"children":1523},{"style":830},[1524],{"type":47,"value":833},{"type":42,"tag":800,"props":1526,"children":1527},{"style":824},[1528],{"type":47,"value":838},{"type":42,"tag":800,"props":1530,"children":1531},{"style":813},[1532],{"type":47,"value":640},{"type":42,"tag":800,"props":1534,"children":1535},{"style":824},[1536],{"type":47,"value":847},{"type":42,"tag":800,"props":1538,"children":1539},{"style":830},[1540],{"type":47,"value":852},{"type":42,"tag":800,"props":1542,"children":1544},{"class":802,"line":1543},17,[1545,1549,1553,1557,1561],{"type":42,"tag":800,"props":1546,"children":1547},{"style":813},[1548],{"type":47,"value":861},{"type":42,"tag":800,"props":1550,"children":1551},{"style":824},[1552],{"type":47,"value":866},{"type":42,"tag":800,"props":1554,"children":1555},{"style":813},[1556],{"type":47,"value":871},{"type":42,"tag":800,"props":1558,"children":1559},{"style":824},[1560],{"type":47,"value":847},{"type":42,"tag":800,"props":1562,"children":1563},{"style":830},[1564],{"type":47,"value":852},{"type":42,"tag":800,"props":1566,"children":1568},{"class":802,"line":1567},18,[1569,1573,1577,1581,1585],{"type":42,"tag":800,"props":1570,"children":1571},{"style":813},[1572],{"type":47,"value":861},{"type":42,"tag":800,"props":1574,"children":1575},{"style":824},[1576],{"type":47,"value":866},{"type":42,"tag":800,"props":1578,"children":1579},{"style":813},[1580],{"type":47,"value":360},{"type":42,"tag":800,"props":1582,"children":1583},{"style":824},[1584],{"type":47,"value":847},{"type":42,"tag":800,"props":1586,"children":1587},{"style":830},[1588],{"type":47,"value":852},{"type":42,"tag":800,"props":1590,"children":1592},{"class":802,"line":1591},19,[1593,1597,1601,1605,1609],{"type":42,"tag":800,"props":1594,"children":1595},{"style":813},[1596],{"type":47,"value":861},{"type":42,"tag":800,"props":1598,"children":1599},{"style":824},[1600],{"type":47,"value":866},{"type":42,"tag":800,"props":1602,"children":1603},{"style":813},[1604],{"type":47,"value":1304},{"type":42,"tag":800,"props":1606,"children":1607},{"style":824},[1608],{"type":47,"value":847},{"type":42,"tag":800,"props":1610,"children":1611},{"style":830},[1612],{"type":47,"value":852},{"type":42,"tag":800,"props":1614,"children":1616},{"class":802,"line":1615},20,[1617,1621,1625,1629],{"type":42,"tag":800,"props":1618,"children":1619},{"style":813},[1620],{"type":47,"value":1320},{"type":42,"tag":800,"props":1622,"children":1623},{"style":824},[1624],{"type":47,"value":1325},{"type":42,"tag":800,"props":1626,"children":1627},{"style":813},[1628],{"type":47,"value":1330},{"type":42,"tag":800,"props":1630,"children":1631},{"style":824},[1632],{"type":47,"value":1335},{"type":42,"tag":50,"props":1634,"children":1635},{},[1636,1638,1644],{"type":47,"value":1637},"Check the ",{"type":42,"tag":76,"props":1639,"children":1641},{"href":315,"rel":1640},[247],[1642],{"type":47,"value":1643},"Streams API operation pages",{"type":47,"value":1645}," for\nrequest\u002Fresponse bodies (e.g. request body for _disable\u002F_enable\u002F_resync if required).",{"type":42,"tag":84,"props":1647,"children":1649},{"id":1648},"guidelines",[1650],{"type":47,"value":1651},"Guidelines",{"type":42,"tag":91,"props":1653,"children":1654},{},[1655,1687,1698,1708],{"type":42,"tag":95,"props":1656,"children":1657},{},[1658,1660,1665,1667,1671,1673,1678,1680,1685],{"type":47,"value":1659},"When the user asks to set or update ",{"type":42,"tag":56,"props":1661,"children":1662},{},[1663],{"type":47,"value":1664},"retention",{"type":47,"value":1666},", assume they mean the ",{"type":42,"tag":56,"props":1668,"children":1669},{},[1670],{"type":47,"value":766},{"type":47,"value":1672}," data retention\n(",{"type":42,"tag":176,"props":1674,"children":1676},{"className":1675},[],[1677],{"type":47,"value":699},{"type":47,"value":1679}," \u002F ",{"type":42,"tag":176,"props":1681,"children":1683},{"className":1682},[],[1684],{"type":47,"value":714},{"type":47,"value":1686},"). Do not change only the failure store retention unless they\nexplicitly ask about the failure store or failed documents.",{"type":42,"tag":95,"props":1688,"children":1689},{},[1690,1692,1696],{"type":47,"value":1691},"Other mutating operations (create, update, delete, fork, bulk query management, attachment management, and more) are\nnot supported by this skill. See ",{"type":42,"tag":76,"props":1693,"children":1694},{"href":78},[1695],{"type":47,"value":78},{"type":47,"value":1697}," for the\nfull list of deferred operations.",{"type":42,"tag":95,"props":1699,"children":1700},{},[1701,1706],{"type":42,"tag":56,"props":1702,"children":1703},{},[1704],{"type":47,"value":1705},"Disabling streams can lead to data loss for wired streams.",{"type":47,"value":1707}," The disable API deletes wired stream data (classic\nstream data is preserved). Before calling disable, warn the user and confirm they understand the risk (and have backed\nup or no longer need the data).",{"type":42,"tag":95,"props":1709,"children":1710},{},[1711],{"type":47,"value":1712},"Prefer read operations when the user only needs to inspect stream state; use lifecycle APIs when they need to enable,\ndisable, or resync streams.",{"type":42,"tag":1714,"props":1715,"children":1716},"style",{},[1717],{"type":47,"value":1718},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":1720,"total":1814},[1721,1738,1752,1762,1777,1788,1803],{"slug":1722,"name":1722,"fn":1723,"description":1724,"org":1725,"tags":1726,"stars":23,"repoUrl":24,"updatedAt":1737},"cloud-access-management","manage Elastic Cloud organization access","Manage Elastic Cloud organization access: invite users, assign roles to Serverless projects, and create or revoke Cloud API keys. Use when granting, modifying, or auditing user access.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1727,1730,1731,1734],{"name":1728,"slug":1729,"type":15},"Cloud","cloud",{"name":9,"slug":8,"type":15},{"name":1732,"slug":1733,"type":15},"Operations","operations",{"name":1735,"slug":1736,"type":15},"Permissions","permissions","2026-07-12T07:46:44.946285",{"slug":1739,"name":1739,"fn":1740,"description":1741,"org":1742,"tags":1743,"stars":23,"repoUrl":24,"updatedAt":1751},"cloud-create-project","create Elastic Cloud Serverless projects","Creates Elastic Cloud Serverless projects (Elasticsearch, Observability, or Security) via the REST API, saves credentials to file, and bootstraps a scoped Elasticsearch API key. Use when creating a new serverless project, provisioning a search or observability environment, or spinning up a new Elastic Cloud project.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1744,1745,1748],{"name":1728,"slug":1729,"type":15},{"name":1746,"slug":1747,"type":15},"Deployment","deployment",{"name":1749,"slug":1750,"type":15},"Elasticsearch","elasticsearch","2026-07-12T07:46:42.353362",{"slug":1753,"name":1753,"fn":1754,"description":1755,"org":1756,"tags":1757,"stars":23,"repoUrl":24,"updatedAt":1761},"cloud-manage-project","manage Elastic Cloud Serverless projects","Manages existing Elastic Cloud Serverless projects: list, get, update, delete, reset credentials, resume, and load saved credentials. Connects to existing projects by resolving endpoints and acquiring scoped Elasticsearch API keys. Use when performing day-2 operations on serverless projects, connecting to an existing project, loading or resetting project credentials, or looking up project details.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1758,1759,1760],{"name":1728,"slug":1729,"type":15},{"name":1749,"slug":1750,"type":15},{"name":1732,"slug":1733,"type":15},"2026-07-12T07:46:41.097412",{"slug":1763,"name":1763,"fn":1764,"description":1765,"org":1766,"tags":1767,"stars":23,"repoUrl":24,"updatedAt":1776},"cloud-network-security","manage Elastic Cloud network security","Manage Serverless network security (traffic filters): create, update, and delete IP filters and AWS PrivateLink VPC filters. Use when restricting network access or configuring private connectivity.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1768,1769,1770,1773],{"name":1728,"slug":1729,"type":15},{"name":1749,"slug":1750,"type":15},{"name":1771,"slug":1772,"type":15},"Networking","networking",{"name":1774,"slug":1775,"type":15},"Security","security","2026-07-12T07:46:43.675992",{"slug":1778,"name":1778,"fn":1779,"description":1780,"org":1781,"tags":1782,"stars":23,"repoUrl":24,"updatedAt":1787},"cloud-setup","configure Elastic Cloud authentication","Configures Elastic Cloud authentication and environment defaults. Use when setting up EC_API_KEY, configuring Cloud API access, or when another cloud skill requires credentials.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1783,1785,1786],{"name":194,"slug":1784,"type":15},"authentication",{"name":1728,"slug":1729,"type":15},{"name":1749,"slug":1750,"type":15},"2026-07-12T07:46:39.783105",{"slug":1789,"name":1789,"fn":1790,"description":1791,"org":1792,"tags":1793,"stars":23,"repoUrl":24,"updatedAt":1802},"elasticsearch-audit","configure Elasticsearch security audit logs","Enable, configure, and query Elasticsearch security audit logs. Use when the task involves audit logging setup, event filtering, or investigating security incidents like failed logins.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1794,1797,1798,1801],{"name":1795,"slug":1796,"type":15},"Audit","audit",{"name":1749,"slug":1750,"type":15},{"name":1799,"slug":1800,"type":15},"Logs","logs",{"name":1774,"slug":1775,"type":15},"2026-07-12T07:47:35.092599",{"slug":1804,"name":1804,"fn":1805,"description":1806,"org":1807,"tags":1808,"stars":23,"repoUrl":24,"updatedAt":1813},"elasticsearch-authn","configure Elasticsearch authentication realms","Authenticate to Elasticsearch using native, file-based, LDAP\u002FAD, SAML, OIDC, Kerberos, JWT, or certificate realms. Use when connecting with credentials, choosing a realm, or managing API keys. Assumes the target realms are already configured.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1809,1810,1811,1812],{"name":194,"slug":1784,"type":15},{"name":9,"slug":8,"type":15},{"name":1749,"slug":1750,"type":15},{"name":1774,"slug":1775,"type":15},"2026-07-12T07:47:41.474547",35,{"items":1816,"total":1938},[1817,1836,1853,1866,1873,1879,1885,1892,1898,1905,1912,1925],{"slug":1818,"name":1818,"fn":1819,"description":1820,"org":1821,"tags":1822,"stars":1833,"repoUrl":1834,"updatedAt":1835},"accessing-benchmark-results","retrieve and analyze Rally benchmark results","Retrieve Rally benchmark results from an external Elasticsearch metrics store. Use to list past races, get a single race's overall (per-task) results, chart a metric's trend across multiple runs, compare two races, or check whether a run converged — e.g. \"show me recent geonames races\", \"what's the service_time trend for nyc_taxis over the last 30 days?\", \"compare these two race-ids\". Applies when datastore.type = elasticsearch is set in ~\u002F.rally\u002Frally.ini.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1823,1826,1829,1830],{"name":1824,"slug":1825,"type":15},"Analytics","analytics",{"name":1827,"slug":1828,"type":15},"Data Analysis","data-analysis",{"name":9,"slug":8,"type":15},{"name":1831,"slug":1832,"type":15},"Performance","performance",2027,"https:\u002F\u002Fgithub.com\u002Felastic\u002Frally","2026-07-12T07:46:38.54144",{"slug":1837,"name":1837,"fn":1838,"description":1839,"org":1840,"tags":1841,"stars":1833,"repoUrl":1834,"updatedAt":1852},"developing-rally","develop and debug Rally source code","Work on Rally's own codebase, not running benchmarks with it. Use when setting up the dev environment, running Rally's tests or linters, navigating its source, debugging Rally's own code, or making changes to Rally itself.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1842,1845,1846,1849],{"name":1843,"slug":1844,"type":15},"Debugging","debugging",{"name":9,"slug":8,"type":15},{"name":1847,"slug":1848,"type":15},"Engineering","engineering",{"name":1850,"slug":1851,"type":15},"Local Development","local-development","2026-07-12T07:46:35.976807",{"slug":1854,"name":1854,"fn":1855,"description":1856,"org":1857,"tags":1858,"stars":1833,"repoUrl":1834,"updatedAt":1865},"running-benchmarks","run Rally benchmarks against Elasticsearch","Run Rally benchmarks (races) against Elasticsearch — an existing\u002Fexternal cluster or a Rally-provisioned distribution — and read the summary report. Use when running a race (any pipeline, track, challenge, target-hosts, or auth) or when interpreting throughput, latency, and service_time results.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1859,1860,1861,1862],{"name":9,"slug":8,"type":15},{"name":1749,"slug":1750,"type":15},{"name":1831,"slug":1832,"type":15},{"name":1863,"slug":1864,"type":15},"Testing","testing","2026-07-12T07:46:37.277964",{"slug":1722,"name":1722,"fn":1723,"description":1724,"org":1867,"tags":1868,"stars":23,"repoUrl":24,"updatedAt":1737},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1869,1870,1871,1872],{"name":1728,"slug":1729,"type":15},{"name":9,"slug":8,"type":15},{"name":1732,"slug":1733,"type":15},{"name":1735,"slug":1736,"type":15},{"slug":1739,"name":1739,"fn":1740,"description":1741,"org":1874,"tags":1875,"stars":23,"repoUrl":24,"updatedAt":1751},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1876,1877,1878],{"name":1728,"slug":1729,"type":15},{"name":1746,"slug":1747,"type":15},{"name":1749,"slug":1750,"type":15},{"slug":1753,"name":1753,"fn":1754,"description":1755,"org":1880,"tags":1881,"stars":23,"repoUrl":24,"updatedAt":1761},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1882,1883,1884],{"name":1728,"slug":1729,"type":15},{"name":1749,"slug":1750,"type":15},{"name":1732,"slug":1733,"type":15},{"slug":1763,"name":1763,"fn":1764,"description":1765,"org":1886,"tags":1887,"stars":23,"repoUrl":24,"updatedAt":1776},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1888,1889,1890,1891],{"name":1728,"slug":1729,"type":15},{"name":1749,"slug":1750,"type":15},{"name":1771,"slug":1772,"type":15},{"name":1774,"slug":1775,"type":15},{"slug":1778,"name":1778,"fn":1779,"description":1780,"org":1893,"tags":1894,"stars":23,"repoUrl":24,"updatedAt":1787},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1895,1896,1897],{"name":194,"slug":1784,"type":15},{"name":1728,"slug":1729,"type":15},{"name":1749,"slug":1750,"type":15},{"slug":1789,"name":1789,"fn":1790,"description":1791,"org":1899,"tags":1900,"stars":23,"repoUrl":24,"updatedAt":1802},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1901,1902,1903,1904],{"name":1795,"slug":1796,"type":15},{"name":1749,"slug":1750,"type":15},{"name":1799,"slug":1800,"type":15},{"name":1774,"slug":1775,"type":15},{"slug":1804,"name":1804,"fn":1805,"description":1806,"org":1906,"tags":1907,"stars":23,"repoUrl":24,"updatedAt":1813},{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1908,1909,1910,1911],{"name":194,"slug":1784,"type":15},{"name":9,"slug":8,"type":15},{"name":1749,"slug":1750,"type":15},{"name":1774,"slug":1775,"type":15},{"slug":1913,"name":1913,"fn":1914,"description":1915,"org":1916,"tags":1917,"stars":23,"repoUrl":24,"updatedAt":1924},"elasticsearch-authz","manage Elasticsearch RBAC and security roles","Manage Elasticsearch RBAC: native users, roles, role mappings, document- and field-level security. Use when creating users or roles, assigning privileges, or mapping external realms like LDAP\u002FSAML.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1918,1919,1920,1923],{"name":9,"slug":8,"type":15},{"name":1749,"slug":1750,"type":15},{"name":1921,"slug":1922,"type":15},"RBAC","rbac",{"name":1774,"slug":1775,"type":15},"2026-07-12T07:47:36.394177",{"slug":1926,"name":1926,"fn":1927,"description":1928,"org":1929,"tags":1930,"stars":23,"repoUrl":24,"updatedAt":1937},"elasticsearch-esql","query Elasticsearch data with ES|QL","Execute ES|QL (Elasticsearch Query Language) queries, use when the user wants to query Elasticsearch data, analyze logs, aggregate metrics, explore data, or create charts and dashboards from ES|QL results.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":8},[1931,1932,1933,1934],{"name":1824,"slug":1825,"type":15},{"name":1827,"slug":1828,"type":15},{"name":1749,"slug":1750,"type":15},{"name":1935,"slug":1936,"type":15},"SQL","sql","2026-07-12T07:47:40.249533",86]