# Import / update value list (items) via api

**URL:** <https://discuss.elastic.co/t/import-update-value-list-items-via-api/353770>\
**Category:** Elastic Security\
**Created:** [February 21, 2024, 10:14am UTC](https://discuss.elastic.co/t/import-update-value-list-items-via-api/353770 "2024-02-21T10:14:31Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![maan](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@maan](https://discuss.elastic.co/u/maan)\
**Post date:** [February 21, 2024, 10:14am UTC](https://discuss.elastic.co/t/import-update-value-list-items-via-api/353770/1 "2024-02-21T10:14:31Z")

</div>

Using the [lists api](https://www.elastic.co/guide/en/security/current/lists-api-import-list-items.html) you can easily import items to a list.  
Now consider this imported source list have been updated and I want to reflect that in elastic. I would love it if I could just simple re-import it with some kind of overwrite of the current items like PUT/PATCH for other endpoint, but as I understand the documentation I can not simply import it again, since that will append to the list and duplicate the items. Having used the list in exceptions etc I can not either remove the list and recreate it. I guess the list items must be purged and then reimported. Neither there seams to be a way to remove all current list items in one go, I must iterate them? Alternative way would be to in an external script diff the updated source and what is currently in the list in elastic and execute specific create/delete list items accordingly. Is there some other smarter way to do this that I have missed? Thanks.

---

<div class="post-metadata">

**Author:** ![carly.richmond](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/carly.richmond/32/104935_2.png) [@carly.richmond](https://discuss.elastic.co/u/carly.richmond)\
**Post date:** [February 21, 2024, 10:25am UTC](https://discuss.elastic.co/t/import-update-value-list-items-via-api/353770/2 "2024-02-21T10:25:17Z")

</div>

Hi @maan,

Welcome! I also don't see a way to override the existing items. There is a way to delete an individual item, or alternatively you could delete the list container and then recreate the container and import the new items. But I see your concern as you're already using the list that it could invalidate your exceptions.

Are you looking to update existing items? There is an [update API](https://www.elastic.co/guide/en/security/current/lists-api-update-item.html) that is an alternative for updating individual items. Otherwise deletion of individual items and then adding the new ones is also an option looking at the API.

Hope that helps!

---

<div class="post-metadata">

**Author:** ![vitaliidm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitaliidm/32/101610_2.png) [@vitaliidm](https://discuss.elastic.co/u/vitaliidm)\
**Post date:** [February 21, 2024, 10:55am UTC](https://discuss.elastic.co/t/import-update-value-list-items-via-api/353770/3 "2024-02-21T10:55:53Z")

</div>

Hi @maan

Welcome to the community!

> Neither there seams to be a way to remove all current list items in one go, I must iterate them?

One possible way is to use Elasticsearch query through [Kibana dev console](https://www.elastic.co/guide/en/kibana/current/console-kibana.html)

You can use [\_delete\_by\_query API](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html) to find and delete all items of the list.

For example, the following query, would delete all items of list **value\_list-test-1.txt** , created in **t1** space

```JSON

POST .items-t1/_delete_by_query
{
  "query": {
    "terms": {
      "list_id": [
        "value_list-test-1.txt"
      ]
    }
  }
}

```

**list\_id** parameter is the list id of the list container, it can be retrieved from API call: [Get list container | Elastic Security Solution [8.12] | Elastic](https://www.elastic.co/guide/en/security/current/lists-api-get-container.html)

**.items-t1** is index, where list container is created. The second part of the index name is Kibana space name. In my example, it is **t1** space. So you would need to put there name of the space where list container was created. If it in default space, index name will be **.items-default**

Hope this can be helpful.

---

<div class="post-metadata">

**Author:** ![maan](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@maan](https://discuss.elastic.co/u/maan)\
**Post date:** [February 21, 2024, 11:03am UTC](https://discuss.elastic.co/t/import-update-value-list-items-via-api/353770/4 "2024-02-21T11:03:43Z")

</div>

Great, thank you. At least that(delete\_by\_query) is a much quicker and more simple way to purge all items from the list. Perfectly clear explanation, I do get it.

---

<div class="post-metadata">

**Author:** ![maan](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@maan](https://discuss.elastic.co/u/maan)\
**Post date:** [February 21, 2024, 2:21pm UTC](https://discuss.elastic.co/t/import-update-value-list-items-via-api/353770/5 "2024-02-21T14:21:08Z")

</div>

> [@vitaliidm](#):
>
> ```auto
> POST .items-t1/_delete_by_query
> {
> "query": {
> "terms": {
> "list_id": [
> "value_list-test-1.txt"
> ]
> }
> }
> }
> 
> ```

Ah, as you said, but I initially missed, this is a elasticsearch api thing and I need to do this via the kibana api's. So even if it is stil a good tip it is unfortunately not my solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 20, 2024, 2:21pm UTC](https://discuss.elastic.co/t/import-update-value-list-items-via-api/353770/6 "2024-03-20T14:21:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.