Applies a bulk action to multiple Knowledge Base Entries
The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs.
Body
-
create
array[object] List of Knowledge Base Entries to create.
Any of: Hide attributes Show attributes
-
global
boolean Whether this Knowledge Base Entry is global, defaults to false.
-
name
string Required Name of the Knowledge Base Entry.
-
namespace
string Kibana Space, defaults to 'default' space.
-
users
array[object] Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Could be any string, not necessarily a UUID.
-
kbResource
string Required Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
Values are
security_labsoruser. -
source
string Required Source document name or filepath.
-
text
string Required Knowledge Base Entry content.
-
type
string Required Discriminator Entry type.
Value is
document. -
required
boolean Whether this resource should always be included, defaults to false.
-
vector
object Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
Hide attributes Show attributes
-
global
boolean Whether this Knowledge Base Entry is global, defaults to false.
-
name
string Required Name of the Knowledge Base Entry.
-
namespace
string Kibana Space, defaults to 'default' space.
-
users
array[object] Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Could be any string, not necessarily a UUID.
-
description
string Required Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
-
field
string Required Field to query for Knowledge Base content.
-
index
string Required Index or Data Stream to query for Knowledge Base content.
-
queryDescription
string Required Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
-
type
string Required Discriminator Entry type.
Value is
index. -
inputSchema
array[object] Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
Hide inputSchema attributes Show inputSchema attributes object
-
description
string Required Description of the field.
-
fieldName
string Required Name of the field.
-
fieldType
string Required Type of the field.
-
-
outputFields
array[string] Fields to extract from the query result, defaults to all fields if not provided or empty.
-
-
delete
object -
update
array[object] List of Knowledge Base Entries to update.
Any of: Hide attributes Show attributes
-
global
boolean Whether this Knowledge Base Entry is global, defaults to false.
-
id
string(nonempty) Required The ID of the anonymization field.
Minimum length is
1. -
name
string Required Name of the Knowledge Base Entry.
-
namespace
string Kibana Space, defaults to 'default' space.
-
users
array[object] Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Could be any string, not necessarily a UUID.
-
kbResource
string Required Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
Values are
security_labsoruser. -
source
string Required Source document name or filepath.
-
text
string Required Knowledge Base Entry content.
-
type
string Required Discriminator Entry type.
Value is
document. -
required
boolean Whether this resource should always be included, defaults to false.
-
vector
object Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
Hide attributes Show attributes
-
global
boolean Whether this Knowledge Base Entry is global, defaults to false.
-
id
string(nonempty) Required The ID of the anonymization field.
Minimum length is
1. -
name
string Required Name of the Knowledge Base Entry.
-
namespace
string Kibana Space, defaults to 'default' space.
-
users
array[object] Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Could be any string, not necessarily a UUID.
-
description
string Required Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
-
field
string Required Field to query for Knowledge Base content.
-
index
string Required Index or Data Stream to query for Knowledge Base content.
-
queryDescription
string Required Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
-
type
string Required Discriminator Entry type.
Value is
index. -
inputSchema
array[object] Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
Hide inputSchema attributes Show inputSchema attributes object
-
description
string Required Description of the field.
-
fieldName
string Required Name of the field.
-
fieldType
string Required Type of the field.
-
-
outputFields
array[string] Fields to extract from the query result, defaults to all fields if not provided or empty.
-
Responses
-
200 application/json
Successful bulk operation request
Hide response attributes Show response attributes object
-
attributes
object Required Hide attributes attributes Show attributes attributes object
-
errors
array[object] List of errors encountered during the bulk action.
Hide errors attributes Show errors attributes object
-
err_code
string Specific error code for the issue.
-
knowledgeBaseEntries
array[object] Required List of Knowledge Base Entries that encountered the error.
-
message
string Required Error message describing the issue.
-
statusCode
integer Required HTTP status code associated with the error.
-
-
results
object Required Hide results attributes Show results attributes object
-
created
array[object] Required List of Knowledge Base Entries that were successfully created.
Any of: Hide attributes Show attributes
-
global
boolean Required Whether this Knowledge Base Entry is global, defaults to false.
-
name
string Required Name of the Knowledge Base Entry.
-
namespace
string Required Kibana Space, defaults to 'default' space.
-
users
array[object] Required Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Could be any string, not necessarily a UUID.
-
createdAt
string Required Time the Knowledge Base Entry was created.
-
createdBy
string Required User who created the Knowledge Base Entry.
-
id
string(nonempty) Required The ID of the anonymization field.
Minimum length is
1. -
updatedAt
string Required Time the Knowledge Base Entry was last updated.
-
updatedBy
string Required User who last updated the Knowledge Base Entry.
-
kbResource
string Required Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
Values are
security_labsoruser. -
source
string Required Source document name or filepath.
-
text
string Required Knowledge Base Entry content.
-
type
string Required Discriminator Entry type.
Value is
document. -
required
boolean Whether this resource should always be included, defaults to false.
-
vector
object Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
Hide attributes Show attributes
-
global
boolean Required Whether this Knowledge Base Entry is global, defaults to false.
-
name
string Required Name of the Knowledge Base Entry.
-
namespace
string Required Kibana Space, defaults to 'default' space.
-
users
array[object] Required Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Could be any string, not necessarily a UUID.
-
createdAt
string Required Time the Knowledge Base Entry was created.
-
createdBy
string Required User who created the Knowledge Base Entry.
-
id
string(nonempty) Required The ID of the anonymization field.
Minimum length is
1. -
updatedAt
string Required Time the Knowledge Base Entry was last updated.
-
updatedBy
string Required User who last updated the Knowledge Base Entry.
-
description
string Required Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
-
field
string Required Field to query for Knowledge Base content.
-
index
string Required Index or Data Stream to query for Knowledge Base content.
-
queryDescription
string Required Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
-
type
string Required Discriminator Entry type.
Value is
index. -
inputSchema
array[object] Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
Hide inputSchema attributes Show inputSchema attributes object
-
description
string Required Description of the field.
-
fieldName
string Required Name of the field.
-
fieldType
string Required Type of the field.
-
-
outputFields
array[string] Fields to extract from the query result, defaults to all fields if not provided or empty.
-
-
deleted
array[string] Required List of IDs of Knowledge Base Entries that were successfully deleted.
-
skipped
array[object] Required List of Knowledge Base Entries that were skipped during the bulk action.
Hide skipped attributes Show skipped attributes object
-
id
string Required ID of the skipped Knowledge Base Entry.
-
name
string Name of the skipped Knowledge Base Entry.
-
skip_reason
string Required Reason why a Knowledge Base Entry was skipped during the bulk action.
Value is
KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED.
-
-
updated
array[object] Required List of Knowledge Base Entries that were successfully updated.
Any of: Hide attributes Show attributes
-
global
boolean Required Whether this Knowledge Base Entry is global, defaults to false.
-
name
string Required Name of the Knowledge Base Entry.
-
namespace
string Required Kibana Space, defaults to 'default' space.
-
users
array[object] Required Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Could be any string, not necessarily a UUID.
-
createdAt
string Required Time the Knowledge Base Entry was created.
-
createdBy
string Required User who created the Knowledge Base Entry.
-
id
string(nonempty) Required The ID of the anonymization field.
Minimum length is
1. -
updatedAt
string Required Time the Knowledge Base Entry was last updated.
-
updatedBy
string Required User who last updated the Knowledge Base Entry.
-
kbResource
string Required Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.
Values are
security_labsoruser. -
source
string Required Source document name or filepath.
-
text
string Required Knowledge Base Entry content.
-
type
string Required Discriminator Entry type.
Value is
document. -
required
boolean Whether this resource should always be included, defaults to false.
-
vector
object Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
Hide attributes Show attributes
-
global
boolean Required Whether this Knowledge Base Entry is global, defaults to false.
-
name
string Required Name of the Knowledge Base Entry.
-
namespace
string Required Kibana Space, defaults to 'default' space.
-
users
array[object] Required Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Could be any string, not necessarily a UUID.
-
createdAt
string Required Time the Knowledge Base Entry was created.
-
createdBy
string Required User who created the Knowledge Base Entry.
-
id
string(nonempty) Required The ID of the anonymization field.
Minimum length is
1. -
updatedAt
string Required Time the Knowledge Base Entry was last updated.
-
updatedBy
string Required User who last updated the Knowledge Base Entry.
-
description
string Required Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
-
field
string Required Field to query for Knowledge Base content.
-
index
string Required Index or Data Stream to query for Knowledge Base content.
-
queryDescription
string Required Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
-
type
string Required Discriminator Entry type.
Value is
index. -
inputSchema
array[object] Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
Hide inputSchema attributes Show inputSchema attributes object
-
description
string Required Description of the field.
-
fieldName
string Required Name of the field.
-
fieldType
string Required Type of the field.
-
-
outputFields
array[string] Fields to extract from the query result, defaults to all fields if not provided or empty.
-
-
-
summary
object Required Hide summary attributes Show summary attributes object
-
failed
integer Required Number of Knowledge Base Entries that failed during the bulk action.
-
skipped
integer Required Number of Knowledge Base Entries that were skipped during the bulk action.
-
succeeded
integer Required Number of Knowledge Base Entries that were successfully processed during the bulk action.
-
total
integer Required Total number of Knowledge Base Entries involved in the bulk action.
-
-
-
knowledgeBaseEntriesCount
integer Total number of Knowledge Base Entries processed.
-
message
string Message describing the result of the bulk action.
-
statusCode
integer HTTP status code of the response.
-
success
boolean Indicates whether the bulk action was successful.
-
-
400 application/json
Generic Error
Hide response attributes Show response attributes object
-
error
string Required Error type or category.
-
message
string Required Detailed error message.
-
statusCode
number Required HTTP status code of the error.
-
curl \
--request POST 'https://localhost:5601/api/security_ai_assistant/knowledge_base/entries/_bulk_action' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--data '{"create":[{"title":"New Entry","content":"This is the content of the new entry."}],"delete":{"ids":["123","456","789"],"query":"status:active AND category:technology"},"update":[{"id":"123","title":"Updated Entry","content":"Updated content."}]}'