Body Required

• description string | null
• enabled boolean | null
• name string
• policy_ids array[string] | null
• queries object
  Hide queries attribute Show queries attribute object

  • * object Additional properties
    Hide * attributes Show * attributes object

    • ecs_mapping object | null
      Hide ecs_mapping attribute Show ecs_mapping attribute object | null

      • * object | null Additional properties
        Hide * attributes Show * attributes object | null

        • field string

        • value string | array[string]

          One of:

          string-1 string array-2 array[string]
    • id string
    • platform string | null
    • query string
    • removed boolean | null
    • saved_query_id string | null
    • snapshot boolean | null
    • version string | null
• shards object
  Hide shards attributes Show shards attributes object

  • Additional properties
  • key number
  • * number Additional properties