--- type: api title: Create a dashboard description: Creates a new dashboard and returns its ID, full state, and metadata. url: https://www.elastic.co/docs/api/doc/kibana-serverless/operation/operation-create-dashboard resource: https://www.elastic.co/docs/api/doc/kibana-serverless/operation/operation-create-dashboard products: - Kibana --- # Create a dashboard Authentication: required - Server: `https://{kibana_url}` ## Paths - `POST` `/api/dashboards` - `POST` `/s/{space_id}/api/dashboards` #### Path parameters - `space_id` (string) — optional An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information. ## Description Creates a new dashboard and returns its ID, full state, and metadata. ## Header parameters - `kbn-xsrf` (string) — required A required header to protect against CSRF attacks ## Request body `application/json` - `access_control` (object) — optional Access control settings for the dashboard. - `access_mode` (enum) — optional Controls edit access to the dashboard. Set to `write_restricted` to prevent edits by users without explicit write permission. Defaults to `default` (all viewers can edit). Values: `write_restricted`, `default` - `description` (string) — optional A short description of the dashboard. - `esql_approximation` (boolean) — optional When `true`, ES|QL visualizations that use `STATS` run with [approximate execution](https://www.elastic.co/docs/reference/query-languages/esql/esql-query-approximation) for faster, estimated results. - `filters` (union oneOf[] · max items: 500) — optional Filters applied across all panels, including pinned panels. - **condition** A filter that evaluates a single field condition such as equality, range, or existence. - `type` (enum) — required Values: `condition` - `condition` (union oneOf) — required A filter condition with strict operator/value type matching. - **is** (`operator: is`) Matches documents where `field` equals a single specified value. - `operator` (enum) — required Values: `is` - `field` (string) — required Name of the document field the condition evaluates. - `negate` (boolean) — optional When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`. - `value` (union string | number | boolean) — required Single value to compare against the field. - **is_one_of** (`operator: is_one_of`) Matches documents where `field` equals any value in a provided list. - `operator` (enum) — required Values: `is_one_of` - `field` (string) — required Name of the document field the condition evaluates. - `negate` (boolean) — optional When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`. - `value` (union string[] | number[] | boolean[]) — required Homogeneous array of values to match against the field. - **range** (`operator: range`) Matches documents where `field` falls within a specified numeric or date range. - `operator` (enum) — required Values: `range` - `field` (string) — required Name of the document field the condition evaluates. - `negate` (boolean) — optional When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`. - `value` (object) — required Boundary values for a range comparison. - `format` (string) — optional Elasticsearch [date format](https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-date-format) string applied when parsing date boundary values. For example, `strict_date_optional_time` or `epoch_millis`. - `gt` (number | string) — optional Greater than. - `gte` (number | string) — optional Greater than or equal to. - `lt` (number | string) — optional Less than. - `lte` (number | string) — optional Less than or equal to. - **exists** (`operator: exists`) Matches documents where `field` exists and contains a non-null value. - `operator` (enum) — required Values: `exists` - `field` (string) — required Name of the document field the condition evaluates. - `negate` (boolean) — optional When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`. - `controlled_by` (string) — optional Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel. - `data_view_id` (string) — optional Identifier of the data view used as context for this filter. - `disabled` (boolean) — optional When `true`, the filter is inactive and does not affect query results. Defaults to `false`. - `is_multi_index` (boolean) — optional When `true`, the filter can be applied across multiple indices. Defaults to `false`. - `label` (string) — optional Human-readable label for the filter, used for display purposes. - `negate` (boolean) — optional When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`. - **group** A filter that combines multiple conditions or nested groups using a logical `and` or `or` operator. - `type` (enum) — required Values: `group` - `controlled_by` (string) — optional Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel. - `data_view_id` (string) — optional Identifier of the data view used as context for this filter. - `disabled` (boolean) — optional When `true`, the filter is inactive and does not affect query results. Defaults to `false`. - `group` (object) — required Logical group that combines one or more conditions or nested groups. - `conditions` (union anyOf[]) — required — recursive Ordered list of conditions or nested groups combined by the group `operator`. - `operator` (enum) — required Logical operator applied across all entries in `conditions`. Use `and` to require all conditions, or `or` to require at least one. Values: `and`, `or` - `is_multi_index` (boolean) — optional When `true`, the filter can be applied across multiple indices. Defaults to `false`. - `label` (string) — optional Human-readable label for the filter, used for display purposes. - `negate` (boolean) — optional When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`. - **dsl** A filter expressed as a raw [Elasticsearch Query DSL](https://www.elastic.co/docs/reference/query-languages/querydsl) object, used for queries that cannot be represented by condition or group filters. - `type` (enum) — required Values: `dsl` - `controlled_by` (string) — optional Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel. - `data_view_id` (string) — optional Identifier of the data view used as context for this filter. - `disabled` (boolean) — optional When `true`, the filter is inactive and does not affect query results. Defaults to `false`. - `dsl` (map string to object) — required Elasticsearch Query DSL object passed directly to the query. - `field` (string) — optional Field name for scripted filters where the field cannot be extracted from the DSL query. - `is_multi_index` (boolean) — optional When `true`, the filter can be applied across multiple indices. Defaults to `false`. - `label` (string) — optional Human-readable label for the filter, used for display purposes. - `negate` (boolean) — optional When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`. - `params` (object) — optional Filter parameters metadata. May contain display values, formats, and parameters for scripted filters. - **spatial** A filter that applies an Elasticsearch geo query, used for geographic boundary and shape matching. - `type` (enum) — required Values: `spatial` - `controlled_by` (string) — optional Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel. - `data_view_id` (string) — optional Identifier of the data view used as context for this filter. - `disabled` (boolean) — optional When `true`, the filter is inactive and does not affect query results. Defaults to `false`. - `dsl` (map string to object) — required Elasticsearch geo query DSL object. - `is_multi_index` (boolean) — optional When `true`, the filter can be applied across multiple indices. Defaults to `false`. - `label` (string) — optional Human-readable label for the filter, used for display purposes. - `negate` (boolean) — optional When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`. - `options` (object) — optional Display and behavior settings for the dashboard. Default: `{"auto_apply_filters":true,"hide_panel_borders":false,"hide_panel_titles":false,"sync_colors":false,"sync_cursor":true,"sync_tooltips":false,"use_margins":true}` - `auto_apply_filters` (boolean · default: true) — optional When `true`, control filter changes are applied automatically. When `false`, control filter changes are applied manually through the dashboard's search update button. Defaults to `true`. - `hide_panel_borders` (boolean · default: false) — optional When `true`, panel borders are hidden. Defaults to `false`. - `hide_panel_titles` (boolean · default: false) — optional When `true`, panel titles are hidden. Defaults to `false`. - `sync_colors` (boolean · default: false) — optional When `true`, colors are synchronized across panels that share a data source. Defaults to `false`. - `sync_cursor` (boolean · default: true) — optional When `true`, the cursor position is synchronized across panels. Defaults to `true`. - `sync_tooltips` (boolean · default: false) — optional When `true`, tooltips are synchronized across panels. Defaults to `false`. - `use_margins` (boolean · default: true) — optional When `true`, panels are separated by a margin. Defaults to `true`. - `panels` (union anyOf[] · max items: 1000) — optional Panels and sections in the dashboard. Each entry is either a panel (with a `type` and `config`) or a collapsible section (with a `title`, `collapsed` state, and nested `panels`). - **Anomaly charts** - `config` (object) — required Anomaly Charts embeddable - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `job_ids` (string[] · min items: 1 · max items: 10000) — required Anomaly detection job or group IDs whose results are shown in the charts. - `max_series_to_plot` (number · min: 1 · max: 50) — optional Maximum number of anomaly series to plot. - `severity_threshold` (union anyOf[] · max items: 5) — optional Severity threshold ranges used to filter anomaly results. - **max: 3** - `max` (enum) — required Values: `3` - `min` (enum) — required Values: `0` - **max: 25** - `max` (enum) — required Values: `25` - `min` (enum) — required Values: `3` - **max: 50** - `max` (enum) — required Values: `50` - `min` (enum) — required Values: `25` - **max: 75** - `max` (enum) — required Values: `75` - `min` (enum) — required Values: `50` - **object** - `min` (number · min: 0 · max: 100) — required - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `ml_anomaly_charts` - **Anomaly swim lane** - `config` (union anyOf) — required Anomaly Swim Lane embeddable - **swimlane_type: overall** - `swimlane_type` (enum) — required Values: `overall` - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `job_ids` (string[] · min items: 1 · max items: 10000) — required IDs of the anomaly detection jobs or groups whose results are shown in the swim lane. - `per_page` (number · min: 1) — optional Number of rows to display per page in a view-by swim lane. Ignored for overall swim lanes. - `severity_threshold` (number · min: 0 · max: 100) — optional Minimum anomaly score (0–100) to show in the swim lane. Anomalies with scores at or above this value are displayed. - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - **swimlane_type: viewBy** - `swimlane_type` (enum) — required Values: `viewBy` - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `job_ids` (string[] · min items: 1 · max items: 10000) — required IDs of the anomaly detection jobs or groups whose results are shown in the swim lane. - `per_page` (number · min: 1) — optional Number of rows to display per page in a view-by swim lane. Ignored for overall swim lanes. - `severity_threshold` (number · min: 0 · max: 100) — optional Minimum anomaly score (0–100) to show in the swim lane. Anomalies with scores at or above this value are displayed. - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `view_by` (string · min length: 1 · max length: 2048) — required Field name used to split anomalies into a view-by swim lane. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `ml_anomaly_swimlane` - **APM Service map** - `config` (object) — required APM service map embeddable schema - `alert_status_filter` (enum[] · max items: 4) — optional Values: `active`, `recovered`, `untracked`, `delayed` - `anomaly_severity_filter` (enum[] · max items: 6) — optional Values: `critical`, `major`, `minor`, `warning`, `low`, `unknown` - `connection_filter` (enum[] · max items: 2) — optional Values: `orphaned`, `connected` - `description` (string) — optional A short description of the panel. - `environment` (string · max length: 1024 · default: ENVIRONMENT_ALL) — optional - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `highlighted_service_names` (string[] · max items: 50) — optional - `kuery` (string · max length: 2048) — optional - `map_orientation` (enum) — optional Values: `horizontal`, `vertical` - `service_group_id` (string · max length: 1024) — optional - `service_name` (string · max length: 1024) — optional - `slo_status_filter` (enum[] · max items: 4) — optional Values: `healthy`, `degrading`, `violated`, `noData` - `sync_with_dashboard_filters` (boolean) — optional - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `apm_service_map` - **Change point charts** - `config` (object) — required Panel configuration stored inline - `apply_dashboard_context` (boolean · default: true) — optional When true, the panel uses the dashboard filters, query, and ES|QL variables. When false, it uses static_context. - `description` (string) — optional A short description of the panel. - `esql` (string · max length: 10000) — required The ES|QL query that detects the change points. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `static_context` (object) — optional Filters, query, and ES|QL variables captured from Discover. Used only when apply_dashboard_context is false. - `esql_variables` (object[] · max items: 50) — optional ES|QL variable values captured from Discover. - `key` (string · max length: 256) — required - `type` (enum) — required Values: `time_literal`, `fields`, `values`, `multi_values`, `functions` - `value` (union string | number | number[]) — required Any of: `(string | number)[]` or `string` or `number` - `filters` (union oneOf[] · max items: 100) — optional Filters captured from Discover. Same options as `filters` - `query` (object) — optional A search query consisting of an expression and its language. Supports KQL and Lucene syntax. - `expression` (string) — required A query expression in KQL or Lucene syntax. - `language` (enum) — required Query language. Use `kql` for Kibana Query Language (KQL) or `lucene` for Lucene query syntax. Values: `kql`, `lucene` - `time_range` (object) — optional Panel time range. When set, it overrides the dashboard time range. - `from` (string · max length: 128) — required The start of the time range. Accepts date math (for example, now-7d) or an ISO 8601 timestamp. - `mode` (enum) — optional Use absolute for fixed timestamps, or relative for date math that is re-evaluated at query time. Values: `absolute`, `relative` - `to` (string · max length: 128) — required The end of the time range. Accepts date math (for example, now) or an ISO 8601 timestamp. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `change_point_grid` - **Change point detection chart** - `config` (object) — required Change point detection chart embeddable schema - `aggregation_function` (enum · default: avg) — optional The aggregation function used to calculate the metric values. Values: `avg`, `sum`, `min`, `max` - `data_view_id` (string · min length: 1 · max length: 10000) — required The data view ID used to run change point detection. - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `max_series_to_plot` (integer · min: 1 · max: 50 · default: 6) — optional The maximum number of change points to visualize. Defaults to 6. - `metric_field` (string · min length: 1 · max length: 10000) — required The metric field used by the aggregation function. - `partitions` (string[] · max items: 10000) — optional Optional split field values to include in the panel. - `split_field` (string · min length: 1 · max length: 10000) — optional The optional field used to split change point results. - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `view_type` (enum · default: charts) — optional The type of change point detection view to display. Values: `charts`, `table` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `aiops_change_point_chart` - **Custom panel** - `config` (object) — required - `description` (string) — optional A short description of the panel. - `esql_query` (string[] · max items: 1) — optional - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `template` (string · max length: 510000) — optional - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `custom_content` - **Discover session** - `config` (union anyOf) — required - **By value** Panel configuration stored inline - `description` (string) — optional A short description of the panel. - `drilldowns` (union[] · max items: 100) — optional - **url_drilldown** - `encode_url` (boolean · default: true) — optional When true, URL is escaped using percent encoding - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_open_panel_menu` - `type` (enum) — required Values: `url_drilldown` - `url` (string) — required Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `tabs` (union anyOf[] · min items: 1 · max items: 1) — required Inline tab configuration. Used when no `ref_id` is set. Currently supports one tab. - **header_row_height: auto** - `column_order` (string[] · max items: 100) — optional Ordered list of field names to display in the data table. If omitted, defaults to the `defaultColumns` advanced setting. - `column_settings` (map string to object) — optional Per-column settings keyed by field name, such as width. Keys should correspond to entries in `column_order` when both are set. Map values (object) - `width` (number · min: 0) — optional Optional width of the column in pixels. - `data_source` (union oneOf) — required The data view used by the tab, specified by reference or defined inline. - **Data view reference** (`type: data_view_reference`) - `type` (enum) — required Values: `data_view_reference` - `ref_id` (string) — required The id of the Kibana data view to use as the data source. Example: "my-data-view". - **Data view inline spec** (`type: data_view_spec`) - `type` (enum) — required Values: `data_view_spec` - `allow_hidden_indices` (boolean) — optional When `true`, allows the data view to match hidden indices. - `field_filters` (string[] · max items: 10000) — optional Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as `user*` which filters fields starting with 'user'. - `field_settings` (map string to anyOf) — optional Settings for individual fields, keyed by field name. To change how Kibana displays a field from the backing indices, set its label, description, or format. To define a runtime field, use the runtime field name and set `type`. Map values (union anyOf) Any of: - **Composite runtime field** - `fields` (map string to object) — required Map values (object) - `custom_description` (string · min length: 1) — optional Add a description to the field. It's displayed next to the field on the Discover, Lens, and Data View Management pages. - `custom_label` (string · min length: 1) — optional Create a label to display in place of the field name in Discover, Maps, Lens, Visualize, and TSVB. Useful for shortening a long field name. Queries and filters use the original field name. - `format` (union anyOf) — optional Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover. - **Boolean field format** Formats a field into a true/false value. - `type` (enum) — required Values: `boolean` - **Bytes field format** Formats a field into a bytes value following the numeral.js format pattern. The default pattern is defined by the format:bytes:defaultPattern advanced setting. - `params` (object) — optional - `pattern` (string) — optional Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more. - `type` (enum) — required Values: `bytes` - **Color field format** Formats a field into a color value. - `params` (union oneOf) — required - **field_type: string** (`field_type: string`) - `field_type` (enum) — required Values: `string` - `colors` (object[]) — required - `background` (string) — required The background color to use for the field. - `regex` (string) — required When the field type is a string, this regex is used to determine the color. - `text` (string) — required The text color to use for the field. - **field_type: number** (`field_type: number`) - `field_type` (enum) — required Values: `number` - `colors` (object[]) — required - `background` (string) — required The background color to use for the field. - `range` (string) — required When the field type is a number, this range is used to determine the color. - `text` (string) — required The text color to use for the field. - `pattern` (string) — optional Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more. - **field_type: boolean** (`field_type: boolean`) - `field_type` (enum) — required Values: `boolean` - `colors` (object[]) — required - `background` (string) — required The background color to use for the field. - `boolean` (boolean) — required When the field type is a boolean, this boolean is used to determine the color. - `text` (string) — required The text color to use for the field. - `type` (enum) — required Values: `color` - **Currency field format** Formats a field into a currency value. The format is determined by the pattern of the format:currency:defaultPattern advanced setting. - `type` (enum) — required Values: `currency` - **Date nanos field format** Formats a field into a date nanos value following the defined pattern. - `params` (object) — optional - `pattern` (string · default: MMM D, YYYY @ HH:mm:ss.SSSSSSSSS) — optional Moment.js format pattern. See https://momentjs.com/ to learn more. - `type` (enum) — required Values: `date_nanos` - **Date field format** Formats a field into a date value following the defined pattern. - `params` (object) — optional - `pattern` (string · default: MMM D, YYYY @ HH:mm:ss.SSS) — optional Moment.js format pattern. See https://momentjs.com/ to learn more. - `type` (enum) — required Values: `date` - **Duration field format** Formats a field into a duration value. - `params` (object) — required - `include_space_with_suffix` (boolean · default: true) — optional When true or not provided, the formatted duration includes a space between the value and suffix. When false, no space is included. - `input_format` (enum) — required The unit of the field value before formatting. Values: `picoseconds`, `nanoseconds`, `microseconds`, `milliseconds`, `seconds`, `minutes`, `hours`, `days`, `weeks`, `months`, `years` - `output_format` (enum) — required The unit to convert the field value into for display. Values: `humanize`, `humanize_precise`, `as_milliseconds`, `as_seconds`, `as_minutes`, `as_hours`, `as_days`, `as_weeks`, `as_months`, `as_years` - `output_precision` (number · default: 2) — optional The number of decimal places to display in the duration value. - `show_suffix` (boolean) — optional When true, the formatted duration includes a suffix (such as "seconds", "milliseconds", or "years"). When false or not provided, no suffix is shown. - `use_short_suffix` (boolean · default: false) — optional When true, the formatted duration uses short suffixes (such as "s", "ms", or "h"). When false or not provided, full suffixes are used. - `type` (enum) — required Values: `duration` - **Geo point field format** Formats a field into a geo point value. - `params` (object) — optional - `transform` (enum) — required The transform to apply to the geo point value. Values: `lat_lon_string`, `wkt`, `dms`, `mgrs`, `multi` - `type` (enum) — required Values: `geo_point` - **Histogram field format** Formats a histogram field into a numeric value following the defined pattern. The default pattern is defined by format:bytes:defaultPattern, format:percent:defaultPattern or format:number:defaultPattern advanced settings depending on the selected format. - `params` (object) — required - `format` (enum) — required Values: `bytes`, `percent`, `number` - `pattern` (string) — optional Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more. - `type` (enum) — required Values: `histogram` - **IP field format** Formats a field into an IP address. - `type` (enum) — required Values: `ip` - **Number field format** Formats a field into a numeric value following the defined pattern. The default pattern is defined by format:number:defaultPattern advanced setting. - `params` (object) — optional - `pattern` (string) — optional Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more. - `type` (enum) — required Values: `number` - **Percent field format** Formats a field into a percentage value following the defined pattern. The default pattern is defined by format:percent:defaultPattern advanced setting. - `params` (object) — optional - `pattern` (string) — optional Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more. - `type` (enum) — required Values: `percent` - **Relative date field format** Formats a field into a relative date value. For example: "1 day ago". - `type` (enum) — required Values: `relative_date` - **Static lookup field format** Formats a field into a static value based on the lookup entries or the unknown key value. - `params` (object) — required - `lookup_entries` (object[]) — required The lookup entries to use for the static lookup. The key refers to the field value, and the value refers to the new value to display. - `key` (string) — required - `value` (string) — required - `unknown_key_value` (string) — optional The value to display for unknown key values. If not provided, the field value will be displayed. - `type` (enum) — required Values: `static_lookup` - **String field format** Formats a field into a string value. - `params` (object) — optional - `transform` (enum) — optional Values: `lower`, `upper`, `title`, `short`, `base64`, `urlparam` - `type` (enum) — required Values: `string` - **Truncate field format** Truncates the field value to the specified length. If the field value is longer than the specified length, it will be truncated and the remaining text will be replaced with "...". - `params` (object) — optional - `field_length` (number) — optional - `type` (enum) — required Values: `truncate` - **URL field format** Formats a field into a link, image or audio. - `params` (union oneOf) — required - **type: a** (`type: a`) - `type` (enum) — required Displays the field value as a hyperlink. Values: `a` - `label_template` (string) — optional The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: `{{value}}`, `{{rawValue}}` and `{{url}}`. For example: "`{{value}}`". - `open_link_in_current_tab` (boolean) — optional When true, the URL opens in the current tab. When false or not provided, the URL opens in a new tab. - `url_template` (string) — optional The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: `{{value}}`, `{{rawValue}}` and `{{risonValue}}`. Use `{{risonValue}}` when embedding the field value inside Kibana app URL rison state (for example: query:'`{{risonValue}}`'). For example: "https://example.com/`{{value}}`". - **type: img** (`type: img`) - `type` (enum) — required Displays the field value as an image. Values: `img` - `height` (number) — optional The height of the image. If not provided, the image will be displayed at the original height. - `label_template` (string) — optional The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: `{{value}}`, `{{rawValue}}` and `{{url}}`. For example: "`{{value}}`". - `url_template` (string) — optional The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: `{{value}}`, `{{rawValue}}` and `{{risonValue}}`. Use `{{risonValue}}` when embedding the field value inside Kibana app URL rison state (for example: query:'`{{risonValue}}`'). For example: "https://example.com/`{{value}}`". - `width` (number) — optional The width of the image. If not provided, the image will be displayed at the original width. - **type: audio** (`type: audio`) - `type` (enum) — required Displays the field value as an audio player. Values: `audio` - `label_template` (string) — optional The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: `{{value}}`, `{{rawValue}}` and `{{url}}`. For example: "`{{value}}`". - `url_template` (string) — optional The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: `{{value}}`, `{{rawValue}}` and `{{risonValue}}`. Use `{{risonValue}}` when embedding the field value inside Kibana app URL rison state (for example: query:'`{{risonValue}}`'). For example: "https://example.com/`{{value}}`". - `type` (enum) — required Values: `url` - **Extensible format** Fallback for custom formatter IDs only. Known formatter IDs must match their dedicated schema and are validated at runtime. - `params` (object) — optional - `type` (string) — required - `type` (enum) — required The type of the runtime field (e.g., "keyword", "long", "date"). Values: `keyword`, `long`, `double`, `date`, `ip`, `boolean`, `geo_point` - `script` (string · min length: 1) — optional The script that defines the runtime field. This should be a painless script that computes the field value at query time. Runtime fields without a script retrieve values from _source. If the field doesn't exist in _source, a search request returns no value. - `type` (enum) — required Values: `composite` - **Runtime field** - `custom_description` (string · min length: 1) — optional Add a description to the field. It's displayed next to the field on the Discover, Lens, and Data View Management pages. - `custom_label` (string · min length: 1) — optional Create a label to display in place of the field name in Discover, Maps, Lens, Visualize, and TSVB. Useful for shortening a long field name. Queries and filters use the original field name. - `format` (union anyOf) — optional Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover. Same options as `format` in `fields` - `script` (string · min length: 1) — optional The script that defines the runtime field. This should be a painless script that computes the field value at query time. Runtime fields without a script retrieve values from _source. If the field doesn't exist in _source, a search request returns no value. - `type` (enum) — required The type of the runtime field (e.g., "keyword", "long", "date"). Values: `keyword`, `long`, `double`, `date`, `ip`, `boolean`, `geo_point` - **Field settings** Display overrides for a field. These settings can define a custom label, description, and format. - `custom_description` (string · min length: 1) — optional Add a description to the field. It's displayed next to the field on the Discover, Lens, and Data View Management pages. - `custom_label` (string · min length: 1) — optional Create a label to display in place of the field name in Discover, Maps, Lens, Visualize, and TSVB. Useful for shortening a long field name. Queries and filters use the original field name. - `format` (union anyOf) — optional Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover. Same options as `format` in `fields` - `index_pattern` (string · min length: 1) — required The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*". - `name` (string · min length: 1 · max length: 256) — optional The name of the data view. Example: "Sample data view". - `time_field` (string) — optional The name of the time field in the index. Used for time-based filtering. Example: "@timestamp". - `default_rendered_nodes` (number · min: 10 · max: 200) — optional The number of nodes each JSON cell renders by default in the JSON document view. - `density` (enum) — optional The table row spacing. If omitted, Kibana determines the density from its current settings, such as the user preference. Values: `compact`, `expanded`, `normal` - `documents_display_mode` (enum) — optional How documents are shown: `table` for a formatted table or `json` for a raw JSON tree. Values: `table`, `json` - `filters` (union oneOf[] · max items: 100 · default: []) — optional List of filters to apply to the data in the tab. Same options as `filters` - `header_row_height` (union number | enum) — optional The table header row height, as a number of lines, or `auto` to size it based on content. If omitted, Kibana determines the height from its current settings, such as the user preference. Values: `auto` - `hide_nulls` (boolean) — optional When `true`, fields with null values are hidden in the JSON document view. - `query` (object) — optional A search query consisting of an expression and its language. Supports KQL and Lucene syntax. - `expression` (string) — required A query expression in KQL or Lucene syntax. - `language` (enum) — required Query language. Use `kql` for Kibana Query Language (KQL) or `lucene` for Lucene query syntax. Values: `kql`, `lucene` - `row_height` (union number | enum) — optional The table data row height, as a number of lines, or `auto` to size it based on content. If omitted, defaults to the `discover:rowHeightOption` advanced setting. Values: `auto` - `rows_per_page` (number · min: 1 · max: 10000) — optional The number of rows to display per page in the data table. If omitted, defaults to the `discover:sampleRowsPerPage` advanced setting. Has no effect on ES|QL tabs. - `sample_size` (number · min: 10 · max: 10000) — optional The number of documents to sample for the data table. If omitted, defaults to the `discover:sampleSize` advanced setting. - `sort` (object[] · max items: 100 · default: []) — optional Sort configuration for the data table (field and direction). - `direction` (enum) — required The sort direction: `asc` for ascending or `desc` for descending. Values: `asc`, `desc` - `name` (string) — required The name of the field to sort by. - `type` (enum · default: default) — optional The tab type. `default` tabs have no type-specific settings. Values: `default` - `view_mode` (enum · default: documents) — optional The Discover view mode: `documents` (search hits), `patterns` (pattern analysis), or `aggregated` (field statistics). Values: `documents`, `patterns`, `aggregated` - `wrap_lines` (boolean) — optional When `true`, long values wrap in the JSON document view. When `false`, they are truncated to a single line. - **header_row_height: auto** ES|QL (Elasticsearch Query Language) data source. - `column_order` (string[] · max items: 100) — optional Ordered list of field names to display in the data table. If omitted, defaults to the `defaultColumns` advanced setting. - `column_settings` (map string to object) — optional Per-column settings keyed by field name, such as width. Keys should correspond to entries in `column_order` when both are set. Map values (object) - `width` (number · min: 0) — optional Optional width of the column in pixels. - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `default_rendered_nodes` (number · min: 10 · max: 200) — optional The number of nodes each JSON cell renders by default in the JSON document view. - `density` (enum) — optional The table row spacing. If omitted, Kibana determines the density from its current settings, such as the user preference. Values: `compact`, `expanded`, `normal` - `documents_display_mode` (enum) — optional How documents are shown: `table` for a formatted table or `json` for a raw JSON tree. Values: `table`, `json` - `header_row_height` (union number | enum) — optional The table header row height, as a number of lines, or `auto` to size it based on content. If omitted, Kibana determines the height from its current settings, such as the user preference. Values: `auto` - `hide_nulls` (boolean) — optional When `true`, fields with null values are hidden in the JSON document view. - `row_height` (union number | enum) — optional The table data row height, as a number of lines, or `auto` to size it based on content. If omitted, defaults to the `discover:rowHeightOption` advanced setting. Values: `auto` - `rows_per_page` (number · min: 1 · max: 10000) — optional The number of rows to display per page in the data table. If omitted, defaults to the `discover:sampleRowsPerPage` advanced setting. Has no effect on ES|QL tabs. - `sample_size` (number · min: 10 · max: 10000) — optional The number of documents to sample for the data table. If omitted, defaults to the `discover:sampleSize` advanced setting. - `sort` (object[] · max items: 100 · default: []) — optional Sort configuration for the data table (field and direction). - `direction` (enum) — required The sort direction: `asc` for ascending or `desc` for descending. Values: `asc`, `desc` - `name` (string) — required The name of the field to sort by. - `type` (enum · default: default) — optional The tab type. `default` tabs have no type-specific settings. Values: `default` - `wrap_lines` (boolean) — optional When `true`, long values wrap in the JSON document view. When `false`, they are truncated to a single line. - **Metrics tab** An ES|QL tab with saved metrics grid settings. The dashboard panel stores these settings and restores them in Discover. The panel does not render the metrics grid. - `column_order` (string[] · max items: 100) — optional Ordered list of field names to display in the data table. If omitted, defaults to the `defaultColumns` advanced setting. - `column_settings` (map string to object) — optional Per-column settings keyed by field name, such as width. Keys should correspond to entries in `column_order` when both are set. Map values (object) - `width` (number · min: 0) — optional Optional width of the column in pixels. - `counter_aggregation` (enum) — required Aggregation applied to counter metric fields. Values: `avg`, `sum`, `min`, `max` - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `default_rendered_nodes` (number · min: 10 · max: 200) — optional The number of nodes each JSON cell renders by default in the JSON document view. - `density` (enum) — optional The table row spacing. If omitted, Kibana determines the density from its current settings, such as the user preference. Values: `compact`, `expanded`, `normal` - `dimensions` (string[] · max items: 5) — required Fields used to group metrics in the metrics grid. - `documents_display_mode` (enum) — optional How documents are shown: `table` for a formatted table or `json` for a raw JSON tree. Values: `table`, `json` - `gauge_aggregation` (enum) — required Aggregation applied to gauge metric fields. Values: `avg`, `sum`, `min`, `max` - `grid_sort_direction` (enum) — optional Direction of the metrics grid order. If omitted, defaults to ascending. Values: `asc`, `desc` - `grid_sort_field` (enum) — optional Criterion used to order metrics in the metrics grid. `recency` orders by the metrics the viewing user explored most recently in their own browser. If omitted, metrics are ordered alphabetically. Values: `alphabetically`, `recency` - `header_row_height` (union number | enum) — optional The table header row height, as a number of lines, or `auto` to size it based on content. If omitted, Kibana determines the height from its current settings, such as the user preference. Values: `auto` - `hide_nulls` (boolean) — optional When `true`, fields with null values are hidden in the JSON document view. - `histogram_percentile` (enum) — required Percentile displayed for histogram metric fields. Values: `p50`, `p75`, `p90`, `p95`, `p99` - `histogram_visualization` (enum) — optional How histogram metrics are drawn. If omitted, Discover uses the percentile chart. Values: `lnsXY` - `row_height` (union number | enum) — optional The table data row height, as a number of lines, or `auto` to size it based on content. If omitted, defaults to the `discover:rowHeightOption` advanced setting. Values: `auto` - `rows_per_page` (number · min: 1 · max: 10000) — optional The number of rows to display per page in the data table. If omitted, defaults to the `discover:sampleRowsPerPage` advanced setting. Has no effect on ES|QL tabs. - `sample_size` (number · min: 10 · max: 10000) — optional The number of documents to sample for the data table. If omitted, defaults to the `discover:sampleSize` advanced setting. - `search_term` (string · max length: 1000) — required Search term used to filter metrics in the metrics grid. - `sort` (object[] · max items: 100 · default: []) — optional Sort configuration for the data table (field and direction). - `direction` (enum) — required The sort direction: `asc` for ascending or `desc` for descending. Values: `asc`, `desc` - `name` (string) — required The name of the field to sort by. - `type` (enum) — required A tab with saved metrics grid settings. Requires an ES|QL data source. These settings are used only when the query supports the metrics experience. Values: `metrics` - `wrap_lines` (boolean) — optional When `true`, long values wrap in the JSON document view. When `false`, they are truncated to a single line. - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - **By reference** Panel configuration stored in a linked library item - `description` (string) — optional A short description of the panel. - `drilldowns` (union[] · max items: 100) — optional - **url_drilldown** - `encode_url` (boolean · default: true) — optional When true, URL is escaped using percent encoding - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_open_panel_menu` - `type` (enum) — required Values: `url_drilldown` - `url` (string) — required Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `overrides` (object · default: {}) — optional - `column_order` (string[] · max items: 100) — optional When set, overrides column order for the data table relative to the referenced saved object (`ref_id`) or the inline tab in `tabs`. If omitted, the source configuration is used. - `column_settings` (map string to object) — optional Per-column settings keyed by field name, such as width. When set, merges with the source configuration for the referenced session or inline tab. Map values (object) - `width` (number · min: 0) — optional Optional width of the column in pixels. - `default_rendered_nodes` (number · min: 10 · max: 200) — optional The number of nodes each JSON cell renders by default in the JSON document view. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used. - `density` (enum) — optional The table row spacing. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used. Values: `compact`, `expanded`, `normal` - `documents_display_mode` (enum) — optional How documents are shown: `table` for a formatted table or `json` for a raw JSON tree. When set, overrides the referenced saved object or the inline tab config in `tabs`. Values: `table`, `json` - `header_row_height` (union number | enum) — optional The table header row height, as a number of lines, or `auto`. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used. Values: `auto` - `hide_nulls` (boolean) — optional When `true`, fields with null values are hidden in the JSON document view. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used. - `row_height` (union number | enum) — optional The table data row height, as a number of lines, or `auto`. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, falls back to the source or to the `discover:rowHeightOption` advanced setting. Values: `auto` - `rows_per_page` (number · min: 1 · max: 10000) — optional The number of rows per page. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, falls back to the source or to the `discover:sampleRowsPerPage` advanced setting. - `sample_size` (number · min: 10 · max: 10000) — optional The number of documents to sample. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, falls back to the source or to the `discover:sampleSize` advanced setting. - `sort` (object[] · max items: 100) — optional Sort configuration (field and direction) for the data table. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used. - `direction` (enum) — required The sort direction: `asc` for ascending or `desc` for descending. Values: `asc`, `desc` - `name` (string) — required The name of the field to sort by. - `wrap_lines` (boolean) — optional When `true`, long values wrap in the JSON document view. When `false`, they are truncated to a single line. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used. - `ref_id` (string) — required - `selected_tab_id` (string) — optional Tab to select from the referenced saved object. If omitted, defaults to the first tab. - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `discover_session` - **ES|QL variable control** - `config` (union oneOf) — required - **STATIC_VALUES** (`control_type: STATIC_VALUES`) An ES|QL variable control with a fixed list of selectable options defined directly in `available_options`. - `control_type` (enum) — required Values: `STATIC_VALUES` - `available_options` (string[] · max items: 1000) — required A fixed list of option strings displayed in the control. - `display_settings` (object) — optional - `hide_action_bar` (boolean) — optional When `true`, the search bar, sorting options, and select all toggle are hidden from the control. - `hide_exclude` (boolean) — optional When `true`, the exclude mode toggle is hidden from the control. - `hide_exists` (boolean) — optional When `true`, the exists filter option is hidden from the control. - `hide_sort` (boolean) — optional When `true`, the sort selector is hidden from the control. - `placeholder` (string) — optional Placeholder text displayed in the control input when no option is selected. - `selected_options` (string[] · max items: 10000) — required The list of currently selected option values. - `single_select` (boolean · default: true) — optional When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `true`. - `title` (string) — optional A human-readable title for the control. - `variable_name` (string) — required The name of the ES|QL variable that this control populates. The variable is referenced in ES|QL queries using the `?variable_name` syntax. - `variable_type` (enum) — required The ES|QL variable type that determines how the selected value is substituted into the query. Accepts `fields`, `values`, `functions`, `time_literal`, or `multi_values`. Values: `fields`, `values`, `functions`, `time_literal`, `multi_values` - **VALUES_FROM_QUERY** (`control_type: VALUES_FROM_QUERY`) An ES|QL variable control whose selectable options are dynamically retrieved by running an ES|QL query. - `control_type` (enum) — required Values: `VALUES_FROM_QUERY` - `display_settings` (object) — optional - `hide_action_bar` (boolean) — optional When `true`, the search bar, sorting options, and select all toggle are hidden from the control. - `hide_exclude` (boolean) — optional When `true`, the exclude mode toggle is hidden from the control. - `hide_exists` (boolean) — optional When `true`, the exists filter option is hidden from the control. - `hide_sort` (boolean) — optional When `true`, the sort selector is hidden from the control. - `placeholder` (string) — optional Placeholder text displayed in the control input when no option is selected. - `esql_query` (string) — required An ES|QL query whose results populate the list of available options in the control popover. - `selected_options` (string[] · max items: 10000) — required The list of currently selected option values. - `single_select` (boolean · default: true) — optional When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `true`. - `title` (string) — optional A human-readable title for the control. - `variable_name` (string) — required The name of the ES|QL variable that this control populates. The variable is referenced in ES|QL queries using the `?variable_name` syntax. - `variable_type` (enum) — required The ES|QL variable type that determines how the selected value is substituted into the query. Accepts `fields`, `values`, `functions`, `time_literal`, or `multi_values`. Values: `fields`, `values`, `functions`, `time_literal`, `multi_values` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `esql_control` - **Field statistics table** - `config` (union oneOf) — required Field statistics table embeddable schema - **view_type: dataview** (`view_type: dataview`) - `view_type` (enum) — required Values: `dataview` - `data_view_id` (string · min length: 1 · max length: 1000) — required Data view ID (stored as a panel reference). - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `show_distributions` (boolean · default: false) — optional Whether to show the distribution mini-charts in the table. - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - **view_type: esql** (`view_type: esql`) - `view_type` (enum) — required Values: `esql` - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `query` (object) — required ES|QL query. - `esql` (string · max length: 1000) — required The ES|QL query string. - `show_distributions` (boolean · default: false) — optional Whether to show the distribution mini-charts in the table. - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `field_stats_table` - **Image** - `config` (object) — required Image embeddable schema - `description` (string) — optional A short description of the panel. - `drilldowns` (union anyOf[] · max items: 100) — optional - **dashboard_drilldown** - `type` (enum) — required Values: `dashboard_drilldown` - `open_in_new_tab` (boolean · default: false) — optional When enabled, the dashboard opens in a new browser tab. - `use_filters` (boolean · default: true) — optional When enabled, filters are passed to the opening dashboard. - `use_time_range` (boolean · default: true) — optional When enabled, time range is passed to the opening dashboard. - `dashboard_id` (string) — required - `label` (string) — required - `trigger` (enum) — required Values: `on_click_image` - **url_drilldown** - `type` (enum) — required Values: `url_drilldown` - `encode_url` (boolean · default: true) — optional When true, URL is escaped using percent encoding - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_click_image`, `on_open_panel_menu` - `url` (string) — required Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `image_config` (object) — required - `alt_text` (string) — optional - `background_color` (string) — optional - `object_fit` (enum · default: contain) — optional How the image should be sized within its container Values: `fill`, `contain`, `cover`, `none` - `src` (union anyOf) — required Image source - **file** - `type` (enum) — required Values: `file` - `file_id` (string) — required - **url** - `type` (enum) — required Values: `url` - `url` (string) — required URL of the image - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `image` - **Links** - `config` (union anyOf) — required Links embeddable schema - **By value** Panel configuration stored inline - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `layout` (enum) — optional Whether to display the links in a horizontal or vertical layout. Values: `horizontal`, `vertical` - `links` (union oneOf[] · max items: 100) — required The list of links to display. - **type: dashboardLink** Link type. Set to dashboardLink for a link to another dashboard. - `type` (enum) — required Values: `dashboardLink` - `destination` (string) — required Linked dashboard saved object ID. - `label` (string) — optional The label of the link displayed in the UI. - `options` (object) — optional Default: `{"open_in_new_tab":false,"use_filters":true,"use_time_range":true}` - `open_in_new_tab` (boolean · default: false) — optional When enabled, the dashboard opens in a new browser tab. - `use_filters` (boolean · default: true) — optional When enabled, filters are passed to the opening dashboard. - `use_time_range` (boolean · default: true) — optional When enabled, time range is passed to the opening dashboard. - **type: externalLink** Link type. Set to externalLink for a URL outside Kibana. - `type` (enum) — required Values: `externalLink` - `destination` (string) — required The external URL to link to. - `label` (string) — optional The label of the link displayed in the UI. - `options` (object) — optional Default: `{"encode_url":true,"open_in_new_tab":true}` - `encode_url` (boolean · default: true) — optional Whether to escape the URL with percent encoding - `open_in_new_tab` (boolean · default: true) — optional Whether to open this link in a new tab when clicked. - `title` (string) — optional The panel title. - **By reference** Panel configuration stored in a linked library item - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `ref_id` (string) — required The unique identifier of the links library item. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `links` - **Log rate analysis** - `config` (object) — required Log rate analysis embeddable schema - `data_view_id` (string · min length: 1 · max length: 1000) — required The data view ID used to run log rate analysis. - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `aiops_log_rate_analysis` - **Markdown** - `config` (union anyOf) — required Markdown panel config - **By value** Panel configuration stored inline - `content` (string) — required The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings. - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `settings` (object · default: {"open_links_in_new_tab":true}) — optional Display settings for the markdown panel. - `open_links_in_new_tab` (boolean · default: true) — optional Open links in a new browser tab. - `title` (string) — optional The panel title. - **By reference** Panel configuration stored in a linked library item - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `ref_id` (string) — required The unique identifier of the markdown library item. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `markdown` - **Options list control** - `config` (union oneOf) — required - **EsqlOptionsListControl** (`values_source: esql`) An options list control whose available options come from an ES|QL query's results. - `values_source` (enum) — required Values: `esql` - `display_settings` (object) — optional - `hide_action_bar` (boolean) — optional When `true`, the search bar, sorting options, and select all toggle are hidden from the control. - `hide_exclude` (boolean) — optional When `true`, the exclude mode toggle is hidden from the control. - `hide_exists` (boolean) — optional When `true`, the exists filter option is hidden from the control. - `hide_sort` (boolean) — optional When `true`, the sort selector is hidden from the control. - `placeholder` (string) — optional Placeholder text displayed in the control input when no option is selected. - `esql_query` (string · min length: 1) — required The ES|QL query that provides field options for this control - `exclude` (boolean · default: false) — optional When `true`, the control filters to documents that do NOT match the selected options. Defaults to `false`. - `exists_selected` (boolean · default: false) — optional When `true`, the control filters to documents where the field exists, regardless of the field's value. Defaults to `false`. - `ignore_validations` (boolean · default: false) — optional When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results. - `run_past_timeout` (boolean · default: false) — optional When `true`, the options list query continues running even if it exceeds the configured timeout threshold. Defaults to `false`. - `search_technique` (enum · default: wildcard) — optional The matching technique used when searching available options. `prefix` matches values starting with the search term, `wildcard` matches values containing the search term, and `exact` requires a complete match. Only applies to string and IP fields. Defaults to `wildcard`. Values: `prefix`, `wildcard`, `exact` - `selected_options` ((number | string)[] · max items: 10000 · default: []) — optional The list of currently selected option values. - `single_select` (boolean · default: false) — optional When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `false`. - `sort` (object · default: {"by":"_count","direction":"desc"}) — optional Defines how the available options are sorted in the control popover. Defaults to `{ by: "_count", direction: "desc" }`. - `by` (enum) — required The field used to sort the available options list. `_count` sorts by document count and `_key` sorts alphabetically by option value. Values: `_count`, `_key` - `direction` (enum) — required The sort direction. `asc` sorts ascending and `desc` sorts descending. Values: `asc`, `desc` - `title` (string) — optional A human-readable title for the control. - `use_global_filters` (boolean · default: true) — optional When `true`, the control's available options are narrowed by the page's active filters. - **FieldOptionsListControl** (`values_source: field`) An options list control whose available options come from a data view field. - `values_source` (enum · default: field) — optional The source of the field options for this control. Defaults to `field` for legacy controls. Values: `field` - `data_view_id` (string · min length: 1) — required The ID of the data view that provides field options for this control. - `display_settings` (object) — optional - `hide_action_bar` (boolean) — optional When `true`, the search bar, sorting options, and select all toggle are hidden from the control. - `hide_exclude` (boolean) — optional When `true`, the exclude mode toggle is hidden from the control. - `hide_exists` (boolean) — optional When `true`, the exists filter option is hidden from the control. - `hide_sort` (boolean) — optional When `true`, the sort selector is hidden from the control. - `placeholder` (string) — optional Placeholder text displayed in the control input when no option is selected. - `exclude` (boolean · default: false) — optional When `true`, the control filters to documents that do NOT match the selected options. Defaults to `false`. - `exists_selected` (boolean · default: false) — optional When `true`, the control filters to documents where the field exists, regardless of the field's value. Defaults to `false`. - `field_name` (string · min length: 1) — required The name of the field in the data view that this control filters on. - `ignore_validations` (boolean · default: false) — optional When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results. - `run_past_timeout` (boolean · default: false) — optional When `true`, the options list query continues running even if it exceeds the configured timeout threshold. Defaults to `false`. - `search_technique` (enum · default: wildcard) — optional The matching technique used when searching available options. `prefix` matches values starting with the search term, `wildcard` matches values containing the search term, and `exact` requires a complete match. Only applies to string and IP fields. Defaults to `wildcard`. Values: `prefix`, `wildcard`, `exact` - `selected_options` ((number | string)[] · max items: 10000 · default: []) — optional The list of currently selected option values. - `single_select` (boolean · default: false) — optional When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `false`. - `sort` (object · default: {"by":"_count","direction":"desc"}) — optional Defines how the available options are sorted in the control popover. Defaults to `{ by: "_count", direction: "desc" }`. - `by` (enum) — required The field used to sort the available options list. `_count` sorts by document count and `_key` sorts alphabetically by option value. Values: `_count`, `_key` - `direction` (enum) — required The sort direction. `asc` sorts ascending and `desc` sorts descending. Values: `asc`, `desc` - `title` (string) — optional A human-readable title for the control. - `use_global_filters` (boolean · default: true) — optional When `true`, the control's available options are narrowed by the page's active filters. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `options_list_control` - **Pattern analysis** - `config` (object) — required Log Pattern Analysis embeddable schema - `data_view_id` (string · min length: 1 · max length: 1000) — required The data view ID used for pattern analysis. - `description` (string) — optional A short description of the panel. - `field_name` (string · min length: 1 · max length: 1000) — required The text field on which to run pattern analysis. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `minimum_time_range` (enum · default: no_minimum) — optional Minimum time range for pattern analysis. Values: `no_minimum`, `1_week`, `1_month`, `3_months`, `6_months` - `random_sampler_mode` (enum · default: on_automatic) — optional The random sampler mode. Values: `on_automatic`, `on_manual`, `off` - `random_sampler_probability` (number · min: 1E-05 · max: 0.5 · default: null) — optional — nullable The probability to use for random sampling (between 0.00001 and 0.5). - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `aiops_pattern_analysis` - **Range slider control** - `config` (union oneOf) — required - **EsqlRangeSliderControl** (`values_source: esql`) A range slider control whose values come from an ES|QL query's results. - `values_source` (enum) — required Values: `esql` - `esql_query` (string · min length: 1) — required The ES|QL query that provides field options for this control - `ignore_validations` (boolean · default: false) — optional When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results. - `step` (number · min: 0 · default: 1) — optional The step size between selectable range values. - `title` (string) — optional A human-readable title for the control. - `use_global_filters` (boolean · default: true) — optional When `true`, the control's available options are narrowed by the page's active filters. - `value` (string[] · min items: 2 · max items: 2) — optional The selected range as a two-element array of strings representing the lower and upper bound values, for example `["10", "50"]`. - **FieldRangeSliderControl** (`values_source: field`) A range slider control whose values come from a numeric data view field. - `values_source` (enum · default: field) — optional The source of the field options for this control. Defaults to `field` for legacy controls. Values: `field` - `data_view_id` (string · min length: 1) — required The ID of the data view that provides field options for this control. - `field_name` (string · min length: 1) — required The name of the field in the data view that this control filters on. - `ignore_validations` (boolean · default: false) — optional When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results. - `step` (number · min: 0 · default: 1) — optional The step size between selectable range values. - `title` (string) — optional A human-readable title for the control. - `use_global_filters` (boolean · default: true) — optional When `true`, the control's available options are narrowed by the page's active filters. - `value` (string[] · min items: 2 · max items: 2) — optional The selected range as a two-element array of strings representing the lower and upper bound values, for example `["10", "50"]`. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `range_slider_control` - **Single metric viewer** - `config` (object) — required Single Metric Viewer embeddable - `description` (string) — optional A short description of the panel. - `forecast_id` (string · max length: 2048) — optional Identifier of a forecast to overlay on the chart. - `function_description` (string · max length: 2048) — optional For detectors that use the `metric` function, selects which value to plot: `min`, `max`, or `mean`. Ignored for other detector functions. When omitted, the viewer derives a default from the highest-scoring anomaly record. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `job_ids` (string[] · min items: 1 · max items: 1) — required Anomaly detection job ID whose results are shown in the single metric viewer. - `selected_detector_index` (number · min: 0 · default: 0) — optional Zero-based index of the detector (the Elasticsearch detector_index) within the job whose results are shown. - `selected_entities` (map string to string | number) — optional Values of the partition, by, or over fields that identify the single time series to display. - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `ml_single_metric_viewer` - **SLO alerts** - `config` (object) — required SLO Alerts embeddable schema - `description` (string) — optional A short description of the panel. - `drilldowns` (union[] · max items: 100) — optional - **url_drilldown** - `encode_url` (boolean · default: true) — optional When true, URL is escaped using percent encoding - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_open_panel_menu` - `type` (enum) — required Values: `url_drilldown` - `url` (string) — required Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `slos` (object[] · max items: 100 · default: []) — optional List of SLOs to display alerts for - `slo_id` (string · max length: 64) — required SLO ID - `slo_instance_id` (string · max length: 512 · default: *) — optional SLO instance ID - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `slo_alerts` - **SLO burn rate** - `config` (object) — required SLO Burn Rate embeddable schema - `description` (string) — optional A short description of the panel. - `drilldowns` (union[] · max items: 100) — optional - **url_drilldown** - `encode_url` (boolean · default: true) — optional When true, URL is escaped using percent encoding - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_open_panel_menu` - `type` (enum) — required Values: `url_drilldown` - `url` (string) — required Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable - `duration` (string · max length: 32) — required Duration for the burn rate chart in the format [value][unit], e.g. 5m, 3h, or 6d - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `slo_id` (string · max length: 64) — required The ID of the SLO to display the burn rate for - `slo_instance_id` (string · max length: 512 · default: *) — optional ID of the SLO instance. Set when the SLO uses group_by; identifies which instance to show. Defaults to * (all instances). - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `slo_burn_rate` - **SLO error budget** - `config` (object) — required SLO Error Budget embeddable schema - `description` (string) — optional A short description of the panel. - `drilldowns` (union[] · max items: 100) — optional - **url_drilldown** - `encode_url` (boolean · default: true) — optional When true, URL is escaped using percent encoding - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_open_panel_menu` - `type` (enum) — required Values: `url_drilldown` - `url` (string) — required Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `slo_id` (string · max length: 64) — required The ID of the SLO to display the error budget for - `slo_instance_id` (string · max length: 512 · default: *) — optional ID of the SLO instance. Set when the SLO uses group_by; identifies which instance to show. Defaults to * (all instances). - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `slo_error_budget` - **SLO overview** - `config` (union oneOf) — required SLO Overview embeddable schema - **overview_mode: single** (`overview_mode: single`) SLO Single Overview embeddable schema - `overview_mode` (enum) — required Values: `single` - `description` (string) — optional A short description of the panel. - `drilldowns` (union[] · max items: 100) — optional - **url_drilldown** - `encode_url` (boolean · default: true) — optional When true, URL is escaped using percent encoding - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_open_panel_menu` - `type` (enum) — required Values: `url_drilldown` - `url` (string) — required Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `remote_name` (string · max length: 256) — optional The name of the remote SLO - `slo_id` (string · max length: 64) — required The ID of the SLO - `slo_instance_id` (string · max length: 512 · default: *) — optional ID of the SLO instance. Set when the SLO uses group_by; identifies which instance to show. Defaults to * (all instances). - `title` (string) — optional The panel title. - **overview_mode: groups** (`overview_mode: groups`) SLO Group Overview embeddable schema - `overview_mode` (enum) — required Values: `groups` - `description` (string) — optional A short description of the panel. - `drilldowns` (union[] · max items: 100) — optional - **url_drilldown** - `encode_url` (boolean · default: true) — optional When true, URL is escaped using percent encoding - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_open_panel_menu` - `type` (enum) — required Values: `url_drilldown` - `url` (string) — required Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable - `group_filters` (object · default: {"group_by":"status"}) — optional - `filters` (union oneOf[] · max items: 500) — optional Same options as `filters` - `group_by` (enum · default: status) — optional Values: `slo.tags`, `status`, `slo.indicator.type`, `_index` - `groups` (string[] · max items: 100) — optional - `kql_query` (string · max length: 2048) — optional - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `slo_overview` - **Synthetics monitors** - `config` (object) — required Synthetics monitors embeddable schema - `description` (string) — optional A short description of the panel. - `filters` (object) — optional - `locations` (object[] · max items: 100) — optional Filter by monitor locations - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `monitor_ids` (object[] · max items: 5000) — optional Filter by monitor IDs - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `monitor_types` (object[] · max items: 10) — optional Filter by monitor types - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `projects` (object[] · max items: 100) — optional Filter by project - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `tags` (object[] · max items: 100) — optional Filter by tags - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `title` (string) — optional The panel title. - `view` (enum) — optional View mode for the monitors embeddable (defaults to cardView) Values: `cardView`, `compactView` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `synthetics_monitors` - **Synthetics stats overview** - `config` (object) — required Synthetics stats overview embeddable schema - `description` (string) — optional A short description of the panel. - `drilldowns` (union[] · max items: 100) — optional - **url_drilldown** - `encode_url` (boolean · default: true) — optional When true, URL is escaped using percent encoding - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_open_panel_menu` - `type` (enum) — required Values: `url_drilldown` - `url` (string) — required Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable - `filters` (object) — optional - `locations` (object[] · max items: 100) — optional Filter by monitor locations - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `monitor_ids` (object[] · max items: 5000) — optional Filter by monitor IDs - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `monitor_types` (object[] · max items: 10) — optional Filter by monitor types - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `projects` (object[] · max items: 100) — optional Filter by project - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `tags` (object[] · max items: 100) — optional Filter by tags - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `synthetics_stats_overview` - **Time slider control** - `config` (object) — required - `end_percentage_of_time_range` (number · min: 0 · max: 1 · default: 1) — optional The end of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range. - `is_anchored` (boolean · default: false) — optional When `true`, the start of the time window is fixed at the beginning of the global time range. Only the end of the window can be adjusted. Defaults to `false`. - `start_percentage_of_time_range` (number · min: 0 · max: 1 · default: 0) — optional The start of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `time_slider_control` - **Visualization** - `config` (union anyOf) — required Lens embeddable schema - **By value** Panel configuration stored inline - `description` (string) — optional A short description of the panel. - `drilldowns` (union anyOf[] · max items: 100) — optional - **dashboard_drilldown** - `type` (enum) — required Values: `dashboard_drilldown` - `open_in_new_tab` (boolean · default: false) — optional When enabled, the dashboard opens in a new browser tab. - `use_filters` (boolean · default: true) — optional When enabled, filters are passed to the opening dashboard. - `use_time_range` (boolean · default: true) — optional When enabled, time range is passed to the opening dashboard. - `dashboard_id` (string) — required - `label` (string) — required - `trigger` (enum) — required Values: `on_apply_filter` - **discover_drilldown** - `type` (enum) — required Values: `discover_drilldown` - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_apply_filter` - **url_drilldown** - `type` (enum) — required Values: `url_drilldown` - `encode_url` (boolean · default: true) — optional When true, URL is escaped using percent encoding - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_click_row`, `on_click_value`, `on_open_panel_menu`, `on_select_range` - `url` (string) — required Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `references` (object[]) — optional - `id` (string) — required - `name` (string) — required - `type` (string) — required - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. Any of: - **Metric Chart** One or two metric values with optional color coding, trend line, and breakdown by dimension. Any of: - **Metric Chart (DSL)** Metric chart configuration for standard queries - `breakdown_by` (union anyOf) — optional - **Date Histogram Operation** - `operation` (enum) — required Values: `date_histogram` - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `columns` (number · default: 3) — optional Number of columns. - `drop_partial_intervals` (boolean · default: false) — optional When `true`, drops partial intervals from the results. - `field` (string) — required Field to be used for the date histogram. - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - `suggested_interval` (string · default: auto) — optional Suggested time interval. - `use_original_time_range` (boolean · default: false) — optional When `true`, uses the original time range instead of the current query time range. - **Terms Operation** - `operation` (enum) — required Values: `terms` - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `columns` (number · default: 3) — optional Number of columns. - `excludes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to exclude. - `fields` (string[] · min items: 1 · max items: 4) — required - `format` (union anyOf) — optional Number display format for the dimension value. - **Numeric Format** Number or percentage format with optional decimal places, suffix, and compact notation. - `compact` (boolean · default: false) — optional When `true`, uses compact notation (for example, 1.2k instead of 1,200). Defaults to `false`. - `decimals` (number · default: 2) — optional Number of decimal places to display. - `suffix` (string) — optional Suffix appended to the formatted value. - `type` (enum) — required Value format type: `number` for plain numbers, `percent` for percentages. Values: `number`, `percent` - **Byte Format** Data size format in bits or bytes, with optional decimal places and suffix. - `decimals` (number · default: 2) — optional Number of decimal places to display. - `suffix` (string) — optional Suffix appended to the formatted value. - `type` (enum) — required Data size unit: `bits` or `bytes`. Values: `bits`, `bytes` - **Duration Format** Duration format between time units. - `compact` (boolean) — optional When `true`, uses short unit suffixes (for example, `ms` instead of `Milliseconds`). Defaults to `true`. Ignored for `auto-approximate`. - `decimals` (number) — optional Number of decimal places to display. Defaults to `0`. Ignored for `auto-approximate`. - `from` (enum) — required Source time unit of the raw field value, including fine-grained units (`ps`, `ns`, `us`) in addition to standard units. This describes how the stored data is encoded, not a query duration literal. Values: `ps`, `ns`, `us`, `ms`, `s`, `min`, `h`, `d`, `w`, `mo`, `y` - `suffix` (string) — optional Suffix appended to the formatted value. - `to` (enum) — required Display time unit: `auto` (precise), `auto-approximate`, or a fixed conversion unit. Values: `auto`, `auto-approximate`, `ms`, `s`, `min`, `h`, `d`, `w`, `mo`, `y` - `type` (enum) — required Values: `duration` - **Custom Format** Custom format using a Kibana field format pattern string. - `pattern` (string) — required Kibana field format pattern string. - `type` (enum) — required Values: `custom` - `includes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to include. - `increase_accuracy` (boolean) — optional When `true`, increases accuracy at the cost of performance. - `label` (string) — optional Label for the operation - `limit` (number · default: 5) — optional Number of terms to return. - `other_bucket` (object) — optional - `include_documents_without_field` (boolean) — required When `true`, includes documents that do not have the specified field. - `rank_by` (union anyOf) — optional - **Terms Rank By Alphabetical** Terms ranked alphabetically. - `direction` (enum) — required Direction Values: `asc`, `desc` - `type` (enum) — required Values: `alphabetical` - **Terms Rank By Rarity** Terms ranked by rarity. - `max` (number) — required Maximum number of rare terms to include. - `type` (enum) — required Values: `rare` - **Terms Rank By Significance** Terms ranked by significance. - `type` (enum) — required Values: `significant` - **Terms Rank By Metric** Terms ranked by a linked metric. - `direction` (enum) — required Direction Values: `asc`, `desc` - `metric_index` (number · min: 0 · default: 0) — optional Zero-based index into the metrics array identifying which metric to rank by. - `type` (enum) — required Values: `metric` - **Terms Rank By Custom Operation** Terms ranked by custom operation. - `direction` (enum) — required Direction Values: `asc`, `desc` - `field` (string) — required Numeric field to be used for the custom operation. - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation`, `unique_count`, `sum` - `type` (enum) — required Values: `custom` - **Terms Rank By Custom Last Value Operation** Terms ranked by the last value of a field. - `direction` (enum) — required Direction Values: `asc`, `desc` - `field` (string) — required Numeric field to be used for the custom operation. - `operation` (enum) — required Values: `last_value` - `time_field` (string · min length: 1) — optional Time field used to determine document recency for the last-value ranking. - `type` (enum) — required Values: `custom` - **Terms Rank By Custom Count Operation** Terms ranked by count, either of all documents or of a specific field. - `direction` (enum) — required Direction Values: `asc`, `desc` - `field` (string) — optional Numeric field to be used for the custom operation. - `operation` (enum) — required Values: `count` - `type` (enum) — required Values: `custom` - **Terms Rank By Percentile Operation** Terms ranked by a percentile of a numeric field, for example the 95th percentile of response time. - `direction` (enum) — required Direction Values: `asc`, `desc` - `field` (string) — required Numeric field to be used for the custom operation. - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional The percentile threshold (0–100) at which to compute the field value used for ranking terms. - `type` (enum) — required Values: `custom` - **Terms Rank By Percentile Rank Operation** Terms ranked by the percentile rank of a single value: the proportion of field values at or below that value. - `direction` (enum) — required Direction Values: `asc`, `desc` - `field` (string) — required Numeric field to be used for the custom operation. - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional The numeric value for which to compute the percentile rank (the percentage of field values at or below this value). - `type` (enum) — required Values: `custom` - **Histogram Operation** - `operation` (enum) — required Values: `histogram` - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `columns` (number · default: 3) — optional Number of columns. - `field` (string) — required Field to be used for the histogram. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `granularity` (union number | enum · default: auto) — optional Values: `auto` - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - **Ranges Operation** - `operation` (enum) — required Values: `range` - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `columns` (number · default: 3) — optional Number of columns. - `field` (string) — required Field to be used for the range. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `ranges` (object[] · max items: 100) — required - `gt` (number) — optional Greater than. - `label` (string) — optional Label. - `lte` (number) — optional Less than or equal to. - **Filters Operation** - `operation` (enum) — required Values: `filters` - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `columns` (number · default: 3) — optional Number of columns. - `filters` (object[] · max items: 100) — required - `filter` (object) — required A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `label` (string) — optional Label for the filter - `label` (string) — optional Label for the operation - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `metrics` (union anyOf[] · min items: 1 · max items: 2) — required Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric. - **type: primary** - `type` (enum) — required Values: `primary` - `apply_color_to` (enum) — optional Color target: `value` colors the metric text, `background` colors the cell or panel background. Values: `value`, `background` - `background_chart` (union anyOf) — optional Secondary visualization displayed behind the primary metric value, either a bar chart (with optional max value) or a trend line. - **type: bar** - `type` (enum) — required Values: `bar` - `max_value` (union anyOf) — required Metric dimension configuration, supporting field-based aggregations (count, sum, average, median, standard deviation, unique count, last value), percentile operations, time-series operations (differences, moving average, cumulative sum, counter rate), and mathematical formulas. - **Formula Operation** - `operation` (enum) — required Values: `formula` - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `formula` (string) — required Formula - `label` (string) — optional Label for the operation - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (enum) — optional Time scale Values: `s`, `m`, `h`, `d` - **Static Operation Definition** - `operation` (enum) — required Values: `static_value` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `value` (number · default: 100) — optional Static value - **Field Metric Operations** Any of: - **Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `unique_count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Stats Metric Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Sum Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `operation` (enum) — required Values: `last_value` - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Differences Operation** - `operation` (enum) — required Values: `differences` - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required - **Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `unique_count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Stats Metric Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Sum Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `operation` (enum) — required Values: `last_value` - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Moving Average Operation** - `operation` (enum) — required Values: `moving_average` - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required Same options as `of` in `Differences Operation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - `window` (number · default: 5) — optional Window - **Cumulative Sum Operation** - `operation` (enum) — required Values: `cumulative_sum` - `field` (string) — optional Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records. - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Counter Rate Operation** - `operation` (enum) — required Values: `counter_rate` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Count Metric Operation** - `operation` (enum) — required Values: `count` - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `operation` (enum) — required Values: `unique_count` - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `operation` (enum) — required Values: `last_value` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `operation` (enum) — required Values: `percentile` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `operation` (enum) — required Values: `percentile_rank` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - `orientation` (enum) — optional Orientation Values: `horizontal`, `vertical` - **type: trend** - `type` (enum) — required Values: `trend` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for the primary metric value or background. - **Color By Value** Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes. Any of: - **Color By Value (Absolute)** Color by absolute value configuration - `range` (enum) — required Values: `absolute` - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `dynamic` - **Color By Value (Percentage)** Color by percentage value configuration - `range` (enum) — required Values: `percentage` - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `dynamic` - **Color By Value (Palette)** Color by value using a palette, with colors distributed across the range of values. - `palette` (enum) — required The name of the palette to apply across the value range. Values: `status`, `temperature`, `complementary`, `negative`, `positive`, `cool`, `warm`, `gray` - `type` (enum) — required Values: `distributed_palette` - **Legacy color by value** Legacy color by value configuration - `palette` (string) — required The legacy palette name. - `range` (enum) — required Determines whether the range is interpreted as absolute or as a percentage of the data. Values: `absolute`, `percentage` - `shift` (boolean) — required When `true`, shifts the palette colors so they start from a different offset. Defaults to `false`. - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `legacy_dynamic` - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `subtitle` (string) — optional Subtitle below the primary metric value. Any of: - **Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `unique_count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Stats Metric Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Sum Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `operation` (enum) — required Values: `last_value` - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Differences Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required Same options as `of` in `Differences Operation` - `operation` (enum) — required Values: `differences` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Moving Average Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required Same options as `of` in `Differences Operation` - `operation` (enum) — required Values: `moving_average` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - `window` (number · default: 5) — optional Window - **Cumulative Sum Operation** - `field` (string) — optional Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records. - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `cumulative_sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Counter Rate Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `counter_rate` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Formula Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `formula` (string) — required Formula - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `formula` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (enum) — optional Time scale Values: `s`, `m`, `h`, `d` - **type: secondary** - `type` (enum) — required Values: `secondary` - `color` (union anyOf · default: {"type":"none"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **No Color** Explicitly disables coloring - `type` (enum) — required Values: `none` - `compare` (union anyOf) — optional Compare the secondary metric to a baseline value or to the primary metric. - **Compare To Baseline** - `to` (enum) — required Values: `baseline` - `baseline` (number · default: 0) — optional Baseline value. - `icon` (boolean · default: true) — optional When `true`, displays the icon for the secondary value. - `palette` (string · default: compare_to) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - `value` (boolean · default: true) — optional When `true`, displays the secondary value. - **Compare To Primary** - `to` (enum) — required Values: `primary` - `icon` (boolean · default: true) — optional When `true`, displays the icon for the secondary value. - `palette` (string · default: compare_to) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - `value` (boolean · default: true) — optional When `true`, displays the secondary value. Any of: - **Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `unique_count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Stats Metric Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Sum Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `operation` (enum) — required Values: `last_value` - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Differences Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required Same options as `of` in `Differences Operation` - `operation` (enum) — required Values: `differences` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Moving Average Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required Same options as `of` in `Differences Operation` - `operation` (enum) — required Values: `moving_average` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - `window` (number · default: 5) — optional Window - **Cumulative Sum Operation** - `field` (string) — optional Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records. - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `cumulative_sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Counter Rate Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `counter_rate` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Formula Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `formula` (string) — required Formula - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `formula` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (enum) — optional Time scale Values: `s`, `m`, `h`, `d` - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `density` (enum · default: default) — optional Density preset for the metric chart layout. Use `compact` for a compact layout, or `default` for increased padding, element spacing, and font size. Values: `compact`, `default` - `icon` (object) — optional Icon configuration for the metric chart - `alignment` (enum · default: right) — optional Icon alignment. Accepted values: `left`, `right`. Defaults to `right`. Values: `left`, `right` - `name` (enum) — required Icon name Values: `alert`, `asterisk`, `bell`, `bolt`, `bug`, `compute`, `editor_comment`, `flag`, `globe`, `heart`, `map_marker`, `pin`, `popout`, `sort_down`, `sort_up`, `star_empty`, `tag`, `temperature` - `primary` (object) — optional - `labels` (object) — optional Labels (title and subtitle) configuration - `alignment` (enum · default: left) — optional Horizontal alignment for the title and subtitle text. Accepted values: `left`, `center`, `right`. Defaults to `left`. Values: `left`, `center`, `right` - `position` (enum · default: bottom) — optional Position of the primary metric value (top, middle, or bottom). Values: `top`, `middle`, `bottom` - `value` (object) — optional Primary metric value configuration - `alignment` (enum · default: right) — optional Alignment for the primary metric value. Accepted values: `left`, `center`, `right`. Defaults to `right`. Values: `left`, `center`, `right` - `sizing` (enum · default: auto) — optional Controls how the primary value text is sized within the panel. 'auto' selects a font size from predefined breakpoints based on panel height, then shrinks if the text overflows horizontally. 'fill' scales the text to be as large as possible, filling all available space. Values: `auto`, `fill` - `secondary` (object) — optional - `label` (object) — optional - `placement` (enum · default: before) — optional How the secondary metric name is shown: before the value, after the value, or in a tooltip. Ignored when the label is not visible. Values: `before`, `after`, `tooltip` - `visible` (boolean · default: false) — optional When `true`, displays the secondary metric name as its label. - `value` (object) — optional Secondary metric value configuration - `alignment` (enum · default: right) — optional Alignment for secondary values. Accepted values: `left`, `center`, `right`. Defaults to `right`. Values: `left`, `center`, `right` - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `metric` - **Metric Chart (ES|QL)** Metric chart configuration for ES|QL queries - `breakdown_by` (object) — optional - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `column` (string) — required Column to use - `columns` (number · default: 3) — optional Number of columns. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `metrics` (union anyOf[] · min items: 1 · max items: 2) — required Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric. - **type: primary** - `type` (enum) — required Values: `primary` - `apply_color_to` (enum) — optional Color target: `value` colors the metric text, `background` colors the cell or panel background. Values: `value`, `background` - `background_chart` (union anyOf) — optional Bar chart or trendline shown behind the primary metric value. - **Complementary Bar** - `type` (enum) — required Values: `bar` - `max_value` (object) — required - `column` (string) — required Column to use - `label` (string) — optional Label for the operation - `orientation` (enum) — optional Orientation Values: `horizontal`, `vertical` - **Complementary Trend** - `type` (enum) — required Values: `trend` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for the primary metric value or background. Same options as `color` in `type: primary` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `subtitle` (string) — optional Subtitle below the primary metric value. - **type: secondary** - `type` (enum) — required Values: `secondary` - `color` (union anyOf · default: {"type":"none"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **No Color** Explicitly disables coloring - `type` (enum) — required Values: `none` - `column` (string) — required Column to use - `compare` (union anyOf) — optional Compare the secondary metric to a baseline value or to the primary metric. - **Compare To Baseline** - `to` (enum) — required Values: `baseline` - `baseline` (number · default: 0) — optional Baseline value. - `icon` (boolean · default: true) — optional When `true`, displays the icon for the secondary value. - `palette` (string · default: compare_to) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - `value` (boolean · default: true) — optional When `true`, displays the secondary value. - **Compare To Primary** - `to` (enum) — required Values: `primary` - `icon` (boolean · default: true) — optional When `true`, displays the icon for the secondary value. - `palette` (string · default: compare_to) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - `value` (boolean · default: true) — optional When `true`, displays the secondary value. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options Same fields as `styling` in `Metric Chart (DSL)` - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `metric` - **Legacy Metric Chart (DSL)** Legacy Metric configuration using a data view. Superseded by the Metric chart type. - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `metric` (union anyOf) — required - **Count Metric Operation** - `apply_color_to` (enum) — optional Color target: `value` colors the metric text, `background` colors the cell or panel background. Values: `value`, `background` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration based on the metric value. - **Color By Value (Absolute)** Color by absolute value configuration - `type` (enum) — required Values: `dynamic` - `range` (enum) — required Values: `absolute` - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - **Color By Value (Palette)** Color by value using a palette, with colors distributed across the range of values. - `type` (enum) — required Values: `distributed_palette` - `palette` (enum) — required The name of the palette to apply across the value range. Values: `status`, `temperature`, `complementary`, `negative`, `positive`, `cool`, `warm`, `gray` - **Legacy color by value (absolute)** Legacy color by absolute value configuration - `type` (enum) — required Values: `legacy_dynamic` - `palette` (string) — required The legacy palette name. - `range` (enum) — required Values: `absolute` - `shift` (boolean) — required When `true`, shifts the palette colors so they start from a different offset. Defaults to `false`. - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `labels` (object) — optional Labels configuration - `alignment` (enum · default: top) — optional Label alignment Values: `top`, `bottom` - `size` (enum · default: m) — optional Font size for the label and value Values: `xs`, `s`, `m`, `l`, `xl`, `xxl` - `values` (object) — optional Values configuration - `alignment` (enum · default: left) — optional Value alignment Values: `left`, `center`, `right` - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `apply_color_to` (enum) — optional Color target: `value` colors the metric text, `background` colors the cell or panel background. Values: `value`, `background` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration based on the metric value. Same options as `color` in `Count Metric Operation` - `labels` (object) — optional Labels configuration - `alignment` (enum · default: top) — optional Label alignment Values: `top`, `bottom` - `size` (enum · default: m) — optional Font size for the label and value Values: `xs`, `s`, `m`, `l`, `xl`, `xxl` - `values` (object) — optional Values configuration - `alignment` (enum · default: left) — optional Value alignment Values: `left`, `center`, `right` - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `unique_count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Stats Metric Operation** - `apply_color_to` (enum) — optional Color target: `value` colors the metric text, `background` colors the cell or panel background. Values: `value`, `background` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration based on the metric value. Same options as `color` in `Count Metric Operation` - `labels` (object) — optional Labels configuration - `alignment` (enum · default: top) — optional Label alignment Values: `top`, `bottom` - `size` (enum · default: m) — optional Font size for the label and value Values: `xs`, `s`, `m`, `l`, `xl`, `xxl` - `values` (object) — optional Values configuration - `alignment` (enum · default: left) — optional Value alignment Values: `left`, `center`, `right` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Sum Metric Operation** - `apply_color_to` (enum) — optional Color target: `value` colors the metric text, `background` colors the cell or panel background. Values: `value`, `background` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration based on the metric value. Same options as `color` in `Count Metric Operation` - `labels` (object) — optional Labels configuration - `alignment` (enum · default: top) — optional Label alignment Values: `top`, `bottom` - `size` (enum · default: m) — optional Font size for the label and value Values: `xs`, `s`, `m`, `l`, `xl`, `xxl` - `values` (object) — optional Values configuration - `alignment` (enum · default: left) — optional Value alignment Values: `left`, `center`, `right` - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `apply_color_to` (enum) — optional Color target: `value` colors the metric text, `background` colors the cell or panel background. Values: `value`, `background` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration based on the metric value. Same options as `color` in `Count Metric Operation` - `labels` (object) — optional Labels configuration - `alignment` (enum · default: top) — optional Label alignment Values: `top`, `bottom` - `size` (enum · default: m) — optional Font size for the label and value Values: `xs`, `s`, `m`, `l`, `xl`, `xxl` - `values` (object) — optional Values configuration - `alignment` (enum · default: left) — optional Value alignment Values: `left`, `center`, `right` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `operation` (enum) — required Values: `last_value` - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `apply_color_to` (enum) — optional Color target: `value` colors the metric text, `background` colors the cell or panel background. Values: `value`, `background` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration based on the metric value. Same options as `color` in `Count Metric Operation` - `labels` (object) — optional Labels configuration - `alignment` (enum · default: top) — optional Label alignment Values: `top`, `bottom` - `size` (enum · default: m) — optional Font size for the label and value Values: `xs`, `s`, `m`, `l`, `xl`, `xxl` - `values` (object) — optional Values configuration - `alignment` (enum · default: left) — optional Value alignment Values: `left`, `center`, `right` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `apply_color_to` (enum) — optional Color target: `value` colors the metric text, `background` colors the cell or panel background. Values: `value`, `background` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration based on the metric value. Same options as `color` in `Count Metric Operation` - `labels` (object) — optional Labels configuration - `alignment` (enum · default: top) — optional Label alignment Values: `top`, `bottom` - `size` (enum · default: m) — optional Font size for the label and value Values: `xs`, `s`, `m`, `l`, `xl`, `xxl` - `values` (object) — optional Values configuration - `alignment` (enum · default: left) — optional Value alignment Values: `left`, `center`, `right` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Formula Operation** - `apply_color_to` (enum) — optional Color target: `value` colors the metric text, `background` colors the cell or panel background. Values: `value`, `background` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration based on the metric value. Same options as `color` in `Count Metric Operation` - `labels` (object) — optional Labels configuration - `alignment` (enum · default: top) — optional Label alignment Values: `top`, `bottom` - `size` (enum · default: m) — optional Font size for the label and value Values: `xs`, `s`, `m`, `l`, `xl`, `xxl` - `values` (object) — optional Values configuration - `alignment` (enum · default: left) — optional Value alignment Values: `left`, `center`, `right` - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `formula` (string) — required Formula - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `formula` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (enum) — optional Time scale Values: `s`, `m`, `h`, `d` - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `legacy_metric` - **XY Chart** XY chart configuration Any of: - **XY Chart (DSL)** XY chart configuration for DSL queries - `axis` (object) — optional Axis configuration for X, Y, and Y2 axes. The Y axis is on the start (leading) side, the Y2 axis is on the end (trailing) side. - `x` (object) — optional X-axis configuration - `domain` (union anyOf) — optional X-axis domain configuration - **type: fit** Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion. - `type` (enum) — required Values: `fit` - `rounding` (boolean · default: true) — optional Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max. - **type: custom** Uses explicitly provided domain bounds (min and max). - `type` (enum) — required Values: `custom` - `max` (number) — required Max domain value - `min` (number) — required Min domain value - `rounding` (boolean · default: true) — optional Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max. - `grid` (object) — optional Axis grid lines configuration - `visible` (boolean) — required Show grid lines for this axis - `labels` (object) — optional Label configuration - `orientation` (enum) — optional Orientation Values: `horizontal`, `vertical`, `angled` - `scale` (enum) — optional X-axis scale type. Use 'temporal' for timestamp/date fields (for example, @timestamp or DATE_TRUNC results). Use 'ordinal' for categorical/text fields. Use 'linear' for numeric fields. Values: `ordinal`, `temporal`, `linear` - `ticks` (object) — optional Axis tick marks configuration - `visible` (boolean) — required Show tick marks on the axis - `title` (object) — optional Axis title configuration - `text` (string) — optional Axis title text. - `visible` (boolean) — optional When `true`, displays the title. - `y` (object) — optional Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts). - `domain` (union oneOf · default: {"rounding":true,"type":"full"}) — optional Y-axis domain configuration - **type: full** (`type: full`) Uses the full chart domain, including baseline expansion when applicable (for example, includes zero for bar-like series). - `type` (enum) — required Values: `full` - `rounding` (boolean · default: true) — optional Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max. - **type: fit** (`type: fit`) Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion. - `type` (enum) — required Values: `fit` - `rounding` (boolean · default: true) — optional Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max. - **type: custom** (`type: custom`) Uses explicitly provided domain bounds (min and max). - `type` (enum) — required Values: `custom` - `max` (number) — required Max domain value - `min` (number) — required Min domain value - `rounding` (boolean · default: true) — optional Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max. - `grid` (object) — optional Axis grid lines configuration - `visible` (boolean) — required Show grid lines for this axis - `labels` (object) — optional Label configuration - `orientation` (enum) — optional Orientation Values: `horizontal`, `vertical`, `angled` - `scale` (enum) — optional Y-axis scale type for data transformation Values: `linear`, `log`, `sqrt` - `ticks` (object) — optional Axis tick marks configuration - `visible` (boolean) — required Show tick marks on the axis - `title` (object) — optional Axis title configuration - `text` (string) — optional Axis title text. - `visible` (boolean) — optional When `true`, displays the title. - `y2` (object) — optional Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts). - `domain` (union oneOf · default: {"rounding":true,"type":"full"}) — optional Y-axis domain configuration - **type: full** (`type: full`) Uses the full chart domain, including baseline expansion when applicable (for example, includes zero for bar-like series). - `type` (enum) — required Values: `full` - `rounding` (boolean · default: true) — optional Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max. - **type: fit** (`type: fit`) Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion. - `type` (enum) — required Values: `fit` - `rounding` (boolean · default: true) — optional Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max. - **type: custom** (`type: custom`) Uses explicitly provided domain bounds (min and max). - `type` (enum) — required Values: `custom` - `max` (number) — required Max domain value - `min` (number) — required Min domain value - `rounding` (boolean · default: true) — optional Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max. - `grid` (object) — optional Axis grid lines configuration - `visible` (boolean) — required Show grid lines for this axis - `labels` (object) — optional Label configuration - `orientation` (enum) — optional Orientation Values: `horizontal`, `vertical`, `angled` - `scale` (enum) — optional Y-axis scale type for data transformation Values: `linear`, `log`, `sqrt` - `ticks` (object) — optional Axis tick marks configuration - `visible` (boolean) — required Show tick marks on the axis - `title` (object) — optional Axis title configuration - `text` (string) — optional Axis title text. - `visible` (boolean) — optional When `true`, displays the title. - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `layers` (union anyOf[] · min items: 1 · max items: 100) — required Chart layers - **Layer (DSL)** Data layer for standard queries with metrics and buckets - `breakdown_by` (union anyOf) — optional - **Date Histogram Operation** - `operation` (enum) — required Values: `date_histogram` - `aggregate_first` (boolean) — optional When `true`, aggregates data before splitting into series. Defaults to `false`. - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` - **Categorical Color Mapping** Palette color assignment for specific categorical values. Unmapped values receive the unassigned color. - `mode` (enum) — required Values: `categorical` - `mapping` (object[] · max items: 1000) — required - `color` (union anyOf) — required - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - `values` (union anyOf[] · max items: 1000) — required - **string** - **number** - **boolean** - **Multi Value Cell** Values of a multi-value cell. - **Range Key** Identifies a range bucket. Omit either bound for an open end. - `type` (enum) — required Values: `range_key` - `from` (number | string) — optional - `ranges` (object[] · max items: 100) — required - `from` (number | string) — optional - `label` (string) — required - `to` (number | string) — optional - `to` (number | string) — optional - **Multi Field Key** Composite key from a multi-terms bucket. - `type` (enum) — required Values: `multi_field_key` - `keys` (string[] · max items: 100) — required - `palette` (string) — required Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - `unassigned` (union anyOf) — optional The color to use for unassigned values. - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - **Gradient Color Mapping** Gradient color mapping across categorical values. - `mode` (enum) — required Values: `gradient` - `gradient` (union anyOf[] · max items: 3) — optional - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - `mapping` (object[] · max items: 100) — optional - `values` (union anyOf[] · max items: 100) — required - **string** - **number** - **boolean** - **Multi Value Cell** Values of a multi-value cell. - **Range Key** Identifies a range bucket. Omit either bound for an open end. - `type` (enum) — required Values: `range_key` - `from` (number | string) — optional - `ranges` (object[] · max items: 100) — required - `from` (number | string) — optional - `label` (string) — required - `to` (number | string) — optional - `to` (number | string) — optional - **Multi Field Key** Composite key from a multi-terms bucket. - `type` (enum) — required Values: `multi_field_key` - `keys` (string[] · max items: 100) — required - `palette` (string) — required Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - `sort` (enum) — optional Sort direction Values: `asc`, `desc` - `unassigned` (union anyOf) — optional The color to use for unassigned values. - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - `drop_partial_intervals` (boolean · default: false) — optional When `true`, drops partial intervals from the results. - `field` (string) — required Field to be used for the date histogram. - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - `suggested_interval` (string · default: auto) — optional Suggested time interval. - `use_original_time_range` (boolean · default: false) — optional When `true`, uses the original time range instead of the current query time range. - **Terms Operation** - `operation` (enum) — required Values: `terms` - `aggregate_first` (boolean) — optional When `true`, aggregates data before splitting into series. Defaults to `false`. - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `excludes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to exclude. - `fields` (string[] · min items: 1 · max items: 4) — required - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `includes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to include. - `increase_accuracy` (boolean) — optional When `true`, increases accuracy at the cost of performance. - `label` (string) — optional Label for the operation - `limit` (number · default: 5) — optional Number of terms to return. - `other_bucket` (object) — optional - `include_documents_without_field` (boolean) — required When `true`, includes documents that do not have the specified field. - `rank_by` (union anyOf) — optional Same options as `rank_by` in `Terms Operation` - **Histogram Operation** - `operation` (enum) — required Values: `histogram` - `aggregate_first` (boolean) — optional When `true`, aggregates data before splitting into series. Defaults to `false`. - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `field` (string) — required Field to be used for the histogram. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `granularity` (union number | enum · default: auto) — optional Values: `auto` - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - **Ranges Operation** - `operation` (enum) — required Values: `range` - `aggregate_first` (boolean) — optional When `true`, aggregates data before splitting into series. Defaults to `false`. - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `field` (string) — required Field to be used for the range. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `ranges` (object[] · max items: 100) — required - `gt` (number) — optional Greater than. - `label` (string) — optional Label. - `lte` (number) — optional Less than or equal to. - **Filters Operation** - `operation` (enum) — required Values: `filters` - `aggregate_first` (boolean) — optional When `true`, aggregates data before splitting into series. Defaults to `false`. - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `filters` (object[] · max items: 100) — required - `filter` (object) — required A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `label` (string) — optional Label for the filter - `label` (string) — optional Label for the operation - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `type` (enum) — required Chart type for the data layer Values: `area`, `area_percentage`, `area_stacked`, `bar`, `bar_horizontal`, `bar_horizontal_stacked`, `bar_horizontal_percentage`, `bar_percentage`, `bar_stacked`, `line` - `x` (union anyOf) — optional - **Date Histogram Operation** - `operation` (enum) — required Values: `date_histogram` - `drop_partial_intervals` (boolean · default: false) — optional When `true`, drops partial intervals from the results. - `field` (string) — required Field to be used for the date histogram. - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - `suggested_interval` (string · default: auto) — optional Suggested time interval. - `use_original_time_range` (boolean · default: false) — optional When `true`, uses the original time range instead of the current query time range. - **Terms Operation** - `operation` (enum) — required Values: `terms` - `excludes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to exclude. - `fields` (string[] · min items: 1 · max items: 4) — required - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `includes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to include. - `increase_accuracy` (boolean) — optional When `true`, increases accuracy at the cost of performance. - `label` (string) — optional Label for the operation - `limit` (number · default: 5) — optional Number of terms to return. - `other_bucket` (object) — optional - `include_documents_without_field` (boolean) — required When `true`, includes documents that do not have the specified field. - `rank_by` (union anyOf) — optional Same options as `rank_by` in `Terms Operation` - **Histogram Operation** - `operation` (enum) — required Values: `histogram` - `field` (string) — required Field to be used for the histogram. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `granularity` (union number | enum · default: auto) — optional Values: `auto` - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - **Ranges Operation** - `operation` (enum) — required Values: `range` - `field` (string) — required Field to be used for the range. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `ranges` (object[] · max items: 100) — required - `gt` (number) — optional Greater than. - `label` (string) — optional Label. - `lte` (number) — optional Less than or equal to. - **Filters Operation** - `operation` (enum) — required Values: `filters` - `filters` (object[] · max items: 100) — required - `filter` (object) — required A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `label` (string) — optional Label for the filter - `label` (string) — optional Label for the operation - `y` (union anyOf[] · max items: 100) — required Array of metrics to display on Y-axis - `axis` (enum · default: y) — optional The Y axis this metric is plotted on. Values match the root axis configuration keys (axis.y, axis.y2). If omitted, defaults to the Y axis start (leading) side. Values: `y`, `y2` - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - **Reference Line Layer (DSL)** Reference line layer for standard queries - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `thresholds` (union anyOf[] · min items: 1 · max items: 100) — required Array of reference line thresholds - `axis` (enum · default: y) — optional The axis this reference line is drawn on. Values match the root axis configuration keys. If omitted, defaults to the primary Y axis. Values: `x`, `y`, `y2` - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `fill` (enum) — optional Fill direction for reference line Values: `above`, `below` - `icon` (enum) — optional Icon to display on the reference line Values: `asterisk`, `alert`, `bell`, `bolt`, `bug`, `circle`, `editor_comment`, `flag`, `heart`, `map_marker`, `pin_filled`, `star_empty`, `star_filled`, `tag`, `triangle` - `position` (enum) — optional Position of the icon and label relative to the reference line Values: `auto`, `left`, `right` - `stroke_dash` (enum) — optional Line style Values: `solid`, `dashed`, `dotted` - `stroke_width` (number · min: 1 · max: 10) — optional Line width in pixels - `text` (object) — optional Reference line text label configuration - `visible` (boolean) — required Show text label on the reference line - `type` (enum) — required Values: `reference_lines` - **Annotation Layer (DSL)** Layer containing annotations (query-based, points, and ranges) - `data_source` (union oneOf) — optional Same options as `data_source` in `header_row_height: auto` - `events` (union anyOf[] · min items: 1 · max items: 100) — required Array of annotation configurations - **type: query** Annotation from query results matching a filter - `type` (enum) — required Values: `query` - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `extra_fields` (string[] · max items: 100) — optional Additional fields for annotation tooltip - `icon` (enum) — optional Icon to display at the annotation point Values: `asterisk`, `alert`, `bell`, `bolt`, `bug`, `circle`, `editor_comment`, `flag`, `heart`, `map_marker`, `pin_filled`, `star_empty`, `star_filled`, `tag`, `triangle` - `label` (string) — optional Label text for the annotation - `line` (object) — optional Vertical line configuration for point annotation - `stroke_dash` (enum) — required Vertical line style Values: `solid`, `dashed`, `dotted` - `stroke_width` (number · min: 1 · max: 10) — required Vertical line width in pixels - `query` (object) — required A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `text` (object) — optional Annotation text label configuration - `field` (string) — optional Field name for text label source - `visible` (boolean) — required Show text label on the annotation - `time_field` (string) — required Field containing the timestamp - `visible` (boolean) — optional Show the annotation - **type: point** Manual point annotation at specific timestamp - `type` (enum) — required Values: `point` - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `icon` (enum) — optional Icon to display at the annotation point Values: `asterisk`, `alert`, `bell`, `bolt`, `bug`, `circle`, `editor_comment`, `flag`, `heart`, `map_marker`, `pin_filled`, `star_empty`, `star_filled`, `tag`, `triangle` - `label` (string) — optional Label text for the annotation - `line` (object) — optional Vertical line configuration for point annotation - `stroke_dash` (enum) — required Vertical line style Values: `solid`, `dashed`, `dotted` - `stroke_width` (number · min: 1 · max: 10) — required Vertical line width in pixels - `text` (object) — optional Annotation text label visibility - `visible` (boolean) — required Show text label on the annotation - `timestamp` (union number | string) — required - `visible` (boolean) — optional Show the annotation - **type: range** Manual range annotation spanning time interval - `type` (enum) — required Values: `range` - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `fill` (enum · default: inside) — optional Fill direction for range Values: `inside`, `outside` - `interval` (object) — required Time range for annotation - `from` (union number | string) — required - `to` (union number | string) — required - `label` (string) — optional Label text for the annotation - `visible` (boolean) — optional Show the annotation - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `type` (enum) — required Values: `annotations` - **Annotation Layer (By Reference)** Reference to a library annotation group - `group_id` (string) — required ID of the linked annotation group from the library - `type` (enum) — required Values: `annotation_group` - `legend` (union anyOf) — optional Legend configuration for XY chart - **Outside horizontal** Outside legend positioned horizontal (top/bottom) of the chart - `layout` (union anyOf) — optional - **type: grid** - `type` (enum) — required Values: `grid` - `truncate` (object) — optional - `enabled` (boolean) — optional Enable truncation of legend items - `max_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - **type: list** - `type` (enum) — required Values: `list` - `placement` (enum) — optional Values: `outside` - `position` (enum) — optional Values: `top`, `bottom` - `series_header` (object) — optional Legend table series header configuration. - `text` (string) — optional Legend table series header text. - `visible` (boolean) — optional When true, shows the legend table series header. - `statistics` (enum[] · max items: 17) — optional Statistics to display in legend Values: `min`, `max`, `avg`, `median`, `range`, `last_value`, `last_non_null_value`, `first_value`, `first_non_null_value`, `difference`, `difference_percentage`, `count`, `total`, `standard_deviation`, `variance`, `distinct_count`, `current_and_last_value` - `visibility` (enum) — optional Legend visibility. Values: `auto`, `visible`, `hidden` - **Outside vertical** Outside legend positioned vertical (left/right) of the chart - `layout` (object) — optional - `truncate` (object) — optional - `enabled` (boolean) — optional Enable truncation of legend items - `max_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `type` (enum) — required Values: `grid` - `placement` (enum) — optional Values: `outside` - `position` (enum) — optional Values: `left`, `right` - `series_header` (object) — optional Legend table series header configuration. - `text` (string) — optional Legend table series header text. - `visible` (boolean) — optional When true, shows the legend table series header. - `size` (union anyOf) — optional Legend size. Values: `auto`, `s`, `m`, `l`, `xl` - `statistics` (enum[] · max items: 17) — optional Statistics to display in legend Values: `min`, `max`, `avg`, `median`, `range`, `last_value`, `last_non_null_value`, `first_value`, `first_non_null_value`, `difference`, `difference_percentage`, `count`, `total`, `standard_deviation`, `variance`, `distinct_count`, `current_and_last_value` - `visibility` (enum) — optional Legend visibility. Values: `auto`, `visible`, `hidden` - **Inside** Inside legend - `columns` (number · min: 1 · max: 5) — optional Number of legend columns - `layout` (object) — optional - `truncate` (object) — optional - `enabled` (boolean) — optional Enable truncation of legend items - `max_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `type` (enum) — required Values: `grid` - `placement` (enum) — required Values: `inside` - `position` (enum) — optional Legend position inside the chart Values: `top_left`, `top_right`, `bottom_left`, `bottom_right` - `series_header` (object) — optional Legend table series header configuration. - `text` (string) — optional Legend table series header text. - `visible` (boolean) — optional When true, shows the legend table series header. - `statistics` (enum[] · max items: 17) — optional Statistics to display in legend Values: `min`, `max`, `avg`, `median`, `range`, `last_value`, `last_non_null_value`, `first_value`, `first_non_null_value`, `difference`, `difference_percentage`, `count`, `total`, `standard_deviation`, `variance`, `distinct_count`, `current_and_last_value` - `visibility` (enum) — optional Legend visibility. Values: `auto`, `visible`, `hidden` - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `styling` (object) — optional Visual styling options for the chart - `areas` (object) — optional Area-specific rendering settings - `fill` (enum · default: gradient) — optional Area fill type: solid or gradient. Values: `solid`, `gradient` - `fill_opacity` (number · min: 0 · max: 2 · default: 0.3) — optional Area fill opacity (0-1 typical, max 2 for legacy) - `bars` (object) — optional Bar-specific rendering settings - `data_labels` (object) — optional Data label configuration for bar series - `visible` (boolean · default: false) — optional Display value labels on bar data points - `minimum_height` (number · min: 0 · default: 1) — optional Minimum bar height in pixels - `fitting` (object) — optional Missing data interpolation configuration for line and area series - `emphasize` (boolean) — optional Visually distinguish fitted segments with a dashed line style and reduced area opacity - `extend` (enum) — optional How to render line and area edges when data does not cover the full X domain Values: `none`, `zero`, `nearest` - `type` (enum) — required Fitting function type for missing data Values: `none`, `zero`, `linear`, `carry`, `lookahead`, `average`, `nearest` - `interpolation` (enum) — optional Curve interpolation method for line and area series. Defaults to linear. Values: `linear`, `smooth`, `stepped` - `overlays` (object) — optional Visual overlays drawn on top of the chart canvas - `current_time_marker` (object) — optional Current time marker configuration - `visible` (boolean · default: false) — optional Show current time marker line - `partial_buckets` (object) — optional Partial (incomplete) bucket indicator configuration - `visible` (boolean · default: false) — optional Show partial bucket indicators at time range edges - `points` (object) — optional Data point marker settings for line and area series - `visibility` (enum · default: auto) — optional Data point marker visibility on line and area series Values: `auto`, `visible`, `hidden` - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `xy` - **XY Chart (ES|QL)** XY chart configuration for ES|QL queries - `axis` (object) — optional Axis configuration for X, Y, and Y2 axes. The Y axis is on the start (leading) side, the Y2 axis is on the end (trailing) side. Same fields as `axis` in `XY Chart (DSL)` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `layers` (union anyOf[] · min items: 1 · max items: 100) — required ES|QL chart layers - **Layer (ES|QL)** Data layer for ES|QL queries with column references - `breakdown_by` (object) — optional ES|QL column for breakdown - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `type` (enum) — required Chart type for the data layer Values: `area`, `area_percentage`, `area_stacked`, `bar`, `bar_horizontal`, `bar_horizontal_stacked`, `bar_horizontal_percentage`, `bar_percentage`, `bar_stacked`, `line` - `x` (object) — optional - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `y` (object[] · max items: 100) — required Array of ES|QL columns for Y-axis metrics - `axis` (enum · default: y) — optional The Y axis this metric is plotted on. Values match the root axis configuration keys (axis.y, axis.y2). If omitted, defaults to the Y axis start (leading) side. Values: `y`, `y2` - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - **Static Reference Line Layer for ES|QL Charts** Reference lines defined by constant numeric values on ES|QL charts. - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `thresholds` (object[] · min items: 1 · max items: 100) — required Array of static value reference line thresholds - `axis` (enum · default: y) — optional The axis this reference line is drawn on. Values match the root axis configuration keys. If omitted, defaults to the primary Y axis. Values: `x`, `y`, `y2` - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `fill` (enum) — optional Fill direction for reference line Values: `above`, `below` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `icon` (enum) — optional Icon to display on the reference line Values: `asterisk`, `alert`, `bell`, `bolt`, `bug`, `circle`, `editor_comment`, `flag`, `heart`, `map_marker`, `pin_filled`, `star_empty`, `star_filled`, `tag`, `triangle` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `static_value` - `position` (enum) — optional Position of the icon and label relative to the reference line Values: `auto`, `left`, `right` - `stroke_dash` (enum) — optional Line style Values: `solid`, `dashed`, `dotted` - `stroke_width` (number · min: 1 · max: 10) — optional Line width in pixels - `text` (object) — optional Reference line text label configuration - `visible` (boolean) — required Show text label on the reference line - `value` (number · default: 100) — optional Static value - `type` (enum) — required Values: `reference_lines` - **ES|QL Reference Line Layer** Reference lines defined by numeric columns from a layer-specific ES|QL query. - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `thresholds` (object[] · min items: 1 · max items: 100) — required Array of ES|QL-based reference line thresholds - `axis` (enum · default: y) — optional The axis this reference line is drawn on. Values match the root axis configuration keys. If omitted, defaults to the primary Y axis. Values: `x`, `y`, `y2` - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `column` (string) — required Column to use - `fill` (enum) — optional Fill direction for reference line Values: `above`, `below` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `icon` (enum) — optional Icon to display on the reference line Values: `asterisk`, `alert`, `bell`, `bolt`, `bug`, `circle`, `editor_comment`, `flag`, `heart`, `map_marker`, `pin_filled`, `star_empty`, `star_filled`, `tag`, `triangle` - `label` (string) — optional Label for the operation - `position` (enum) — optional Position of the icon and label relative to the reference line Values: `auto`, `left`, `right` - `stroke_dash` (enum) — optional Line style Values: `solid`, `dashed`, `dotted` - `stroke_width` (number · min: 1 · max: 10) — optional Line width in pixels - `text` (object) — optional Reference line text label configuration - `visible` (boolean) — required Show text label on the reference line - `type` (enum) — required Values: `reference_lines` - **Annotation Layer (ES|QL)** Layer containing annotations (points and ranges) - `events` (union anyOf[] · min items: 1 · max items: 100) — required Array of static annotation configurations - **type: point** Manual point annotation at specific timestamp - `type` (enum) — required Values: `point` - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `icon` (enum) — optional Icon to display at the annotation point Values: `asterisk`, `alert`, `bell`, `bolt`, `bug`, `circle`, `editor_comment`, `flag`, `heart`, `map_marker`, `pin_filled`, `star_empty`, `star_filled`, `tag`, `triangle` - `label` (string) — optional Label text for the annotation - `line` (object) — optional Vertical line configuration for point annotation - `stroke_dash` (enum) — required Vertical line style Values: `solid`, `dashed`, `dotted` - `stroke_width` (number · min: 1 · max: 10) — required Vertical line width in pixels - `text` (object) — optional Annotation text label visibility - `visible` (boolean) — required Show text label on the annotation - `timestamp` (union number | string) — required - `visible` (boolean) — optional Show the annotation - **type: range** Manual range annotation spanning time interval - `type` (enum) — required Values: `range` - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `fill` (enum · default: inside) — optional Fill direction for range Values: `inside`, `outside` - `interval` (object) — required Time range for annotation - `from` (union number | string) — required - `to` (union number | string) — required - `label` (string) — optional Label text for the annotation - `visible` (boolean) — optional Show the annotation - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `type` (enum) — required Values: `annotations` - `legend` (union anyOf) — optional Legend configuration for XY chart Same options as `legend` in `XY Chart (DSL)` - `styling` (object) — optional Visual styling options for the chart Same fields as `styling` in `XY Chart (DSL)` - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `xy` - **Gauge Chart** A gauge chart with a metric value and optional minimum, maximum, and goal markers, in bullet or circular shape. Any of: - **Gauge Chart (DSL)** Gauge configuration using a data view. - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `metric` (union anyOf) — required - **Count Metric Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for the gauge fill. - **Color By Value** Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes. Any of: - **Color By Value (Absolute)** Color by absolute value configuration - `range` (enum) — required Values: `absolute` - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `dynamic` - **Color By Value (Percentage)** Color by percentage value configuration - `range` (enum) — required Values: `percentage` - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `dynamic` - **Color By Value (Palette)** Color by value using a palette, with colors distributed across the range of values. - `palette` (enum) — required The name of the palette to apply across the value range. Values: `status`, `temperature`, `complementary`, `negative`, `positive`, `cool`, `warm`, `gray` - `type` (enum) — required Values: `distributed_palette` - **Legacy color by value** Legacy color by value configuration - `palette` (string) — required The legacy palette name. - `range` (enum) — required Determines whether the range is interpreted as absolute or as a percentage of the data. Values: `absolute`, `percentage` - `shift` (boolean) — required When `true`, shifts the palette colors so they start from a different offset. Defaults to `false`. - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `legacy_dynamic` - **No Color** Explicitly disables coloring - `type` (enum) — required Values: `none` - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `goal` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. - **Field Metric Operations** Any of: - **Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `unique_count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Stats Metric Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Sum Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `operation` (enum) — required Values: `last_value` - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Static Operation Definition** - `operation` (enum) — required Values: `static_value` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `value` (number · default: 100) — optional Static value - **Formula Operation** - `operation` (enum) — required Values: `formula` - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `formula` (string) — required Formula - `label` (string) — optional Label for the operation - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (enum) — optional Time scale Values: `s`, `m`, `h`, `d` - `max` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `min` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `subtitle` (string) — optional Subtitle below the gauge value. - `ticks` (object) — optional Ticks configuration - `mode` (enum · default: bands) — optional Tick placement mode. Values: `auto`, `bands` - `visible` (boolean · default: true) — optional When `true`, displays tick marks on the gauge. - `title` (object) — optional Title configuration - `text` (string) — optional Title text. - `visible` (boolean · default: true) — optional When `true`, displays the title. - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for the gauge fill. Same options as `color` in `Count Metric Operation` - `goal` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `max` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `min` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `subtitle` (string) — optional Subtitle below the gauge value. - `ticks` (object) — optional Ticks configuration - `mode` (enum · default: bands) — optional Tick placement mode. Values: `auto`, `bands` - `visible` (boolean · default: true) — optional When `true`, displays tick marks on the gauge. - `title` (object) — optional Title configuration - `text` (string) — optional Title text. - `visible` (boolean · default: true) — optional When `true`, displays the title. - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `unique_count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Stats Metric Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for the gauge fill. Same options as `color` in `Count Metric Operation` - `goal` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `max` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `min` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `subtitle` (string) — optional Subtitle below the gauge value. - `ticks` (object) — optional Ticks configuration - `mode` (enum · default: bands) — optional Tick placement mode. Values: `auto`, `bands` - `visible` (boolean · default: true) — optional When `true`, displays tick marks on the gauge. - `title` (object) — optional Title configuration - `text` (string) — optional Title text. - `visible` (boolean · default: true) — optional When `true`, displays the title. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Sum Metric Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for the gauge fill. Same options as `color` in `Count Metric Operation` - `goal` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `max` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `min` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `subtitle` (string) — optional Subtitle below the gauge value. - `ticks` (object) — optional Ticks configuration - `mode` (enum · default: bands) — optional Tick placement mode. Values: `auto`, `bands` - `visible` (boolean · default: true) — optional When `true`, displays tick marks on the gauge. - `title` (object) — optional Title configuration - `text` (string) — optional Title text. - `visible` (boolean · default: true) — optional When `true`, displays the title. - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for the gauge fill. Same options as `color` in `Count Metric Operation` - `goal` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `max` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `min` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `subtitle` (string) — optional Subtitle below the gauge value. - `ticks` (object) — optional Ticks configuration - `mode` (enum · default: bands) — optional Tick placement mode. Values: `auto`, `bands` - `visible` (boolean · default: true) — optional When `true`, displays tick marks on the gauge. - `title` (object) — optional Title configuration - `text` (string) — optional Title text. - `visible` (boolean · default: true) — optional When `true`, displays the title. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `operation` (enum) — required Values: `last_value` - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for the gauge fill. Same options as `color` in `Count Metric Operation` - `goal` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `max` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `min` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `subtitle` (string) — optional Subtitle below the gauge value. - `ticks` (object) — optional Ticks configuration - `mode` (enum · default: bands) — optional Tick placement mode. Values: `auto`, `bands` - `visible` (boolean · default: true) — optional When `true`, displays tick marks on the gauge. - `title` (object) — optional Title configuration - `text` (string) — optional Title text. - `visible` (boolean · default: true) — optional When `true`, displays the title. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for the gauge fill. Same options as `color` in `Count Metric Operation` - `goal` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `max` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `min` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `subtitle` (string) — optional Subtitle below the gauge value. - `ticks` (object) — optional Ticks configuration - `mode` (enum · default: bands) — optional Tick placement mode. Values: `auto`, `bands` - `visible` (boolean · default: true) — optional When `true`, displays tick marks on the gauge. - `title` (object) — optional Title configuration - `text` (string) — optional Title text. - `visible` (boolean · default: true) — optional When `true`, displays the title. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Formula Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for the gauge fill. Same options as `color` in `Count Metric Operation` - `goal` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `max` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `min` (union anyOf) — optional Metric dimension using a field-based aggregation, a static value, or a mathematical formula. Same options as `goal` in `Count Metric Operation` - `subtitle` (string) — optional Subtitle below the gauge value. - `ticks` (object) — optional Ticks configuration - `mode` (enum · default: bands) — optional Tick placement mode. Values: `auto`, `bands` - `visible` (boolean · default: true) — optional When `true`, displays tick marks on the gauge. - `title` (object) — optional Title configuration - `text` (string) — optional Title text. - `visible` (boolean · default: true) — optional When `true`, displays the title. - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `formula` (string) — required Formula - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `formula` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (enum) — optional Time scale Values: `s`, `m`, `h`, `d` - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `shape` (union anyOf) — optional Default: `{"orientation":"horizontal","type":"bullet"}` - **Shape (Bullet)** Bullet gauge shape. - `orientation` (enum) — optional Orientation Values: `horizontal`, `vertical` - `type` (enum) — required Values: `bullet` - **Shape (Circular)** Circular gauge shape. - `type` (enum) — required Values: `circle`, `semi_circle`, `arc` - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `gauge` - **Gauge Chart (ES|QL)** Gauge configuration using an ES|QL query. - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `metric` (object) — required - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for the gauge fill. Same options as `color` in `Count Metric Operation` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `goal` (object) — optional - `column` (string) — required Column to use - `label` (string) — optional Label for the operation - `label` (string) — optional Label for the operation - `max` (object) — optional - `column` (string) — required Column to use - `label` (string) — optional Label for the operation - `min` (object) — optional - `column` (string) — required Column to use - `label` (string) — optional Label for the operation - `subtitle` (string) — optional Subtitle below the gauge value. - `ticks` (object) — optional Ticks configuration - `mode` (enum · default: bands) — optional Tick placement mode. Values: `auto`, `bands` - `visible` (boolean · default: true) — optional When `true`, displays tick marks on the gauge. - `title` (object) — optional Title configuration - `text` (string) — optional Title text. - `visible` (boolean · default: true) — optional When `true`, displays the title. - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `shape` (union anyOf) — optional Default: `{"orientation":"horizontal","type":"bullet"}` - **Shape (Bullet)** Bullet gauge shape. - `orientation` (enum) — optional Orientation Values: `horizontal`, `vertical` - `type` (enum) — required Values: `bullet` - **Shape (Circular)** Circular gauge shape. - `type` (enum) — required Values: `circle`, `semi_circle`, `arc` - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `gauge` - **Heatmap Chart** A grid of colored cells where color intensity represents the metric value at each X/Y intersection. Any of: - **Heatmap Chart (DSL)** Heatmap configuration using a data view. - `axis` (object) — optional Axis configuration for X and Y axes - `x` (object) — optional X axis configuration - `labels` (object) — optional - `orientation` (enum) — optional Orientation Values: `horizontal`, `vertical`, `angled` - `visible` (boolean · default: true) — optional Show axis labels - `scale` (enum) — required X-axis scale type. Use 'temporal' for timestamp/date fields (for example, @timestamp or DATE_TRUNC results). Use 'ordinal' for categorical/text fields. Use 'linear' for numeric fields. Values: `ordinal`, `temporal`, `linear` - `sort` (enum) — optional Axis sort order; omit or use undefined for no sorting Values: `asc`, `desc` - `title` (object) — optional - `text` (string) — optional Axis title text. - `visible` (boolean) — optional When `true`, displays the title. - `y` (object) — optional Y axis configuration - `labels` (object) — optional - `visible` (boolean · default: true) — optional Show axis labels - `sort` (enum) — optional Axis sort order; omit or use undefined for no sorting Values: `asc`, `desc` - `title` (object) — optional - `text` (string) — optional Axis title text. - `visible` (boolean) — optional When `true`, displays the title. - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `legend` (object) — optional Legend configuration - `position` (enum) — optional Values: `top`, `bottom`, `left`, `right` - `size` (union anyOf) — optional Legend size. Values: `auto`, `s`, `m`, `l`, `xl` - `truncate_after_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `visibility` (enum) — optional Legend visibility. Values: `visible`, `hidden` - `metric` (union anyOf) — required - **Count Metric Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. - **Color By Value** Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes. Any of: - **Color By Value (Absolute)** Color by absolute value configuration - `range` (enum) — required Values: `absolute` - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `dynamic` - **Color By Value (Percentage)** Color by percentage value configuration - `range` (enum) — required Values: `percentage` - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `dynamic` - **Color By Value (Palette)** Color by value using a palette, with colors distributed across the range of values. - `palette` (enum) — required The name of the palette to apply across the value range. Values: `status`, `temperature`, `complementary`, `negative`, `positive`, `cool`, `warm`, `gray` - `type` (enum) — required Values: `distributed_palette` - **Legacy color by value** Legacy color by value configuration - `palette` (string) — required The legacy palette name. - `range` (enum) — required Determines whether the range is interpreted as absolute or as a percentage of the data. Values: `absolute`, `percentage` - `shift` (boolean) — required When `true`, shifts the palette colors so they start from a different offset. Defaults to `false`. - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `legacy_dynamic` - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `unique_count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Stats Metric Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Sum Metric Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `operation` (enum) — required Values: `last_value` - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Differences Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required Same options as `of` in `Differences Operation` - `operation` (enum) — required Values: `differences` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Moving Average Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required Same options as `of` in `Differences Operation` - `operation` (enum) — required Values: `moving_average` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - `window` (number · default: 5) — optional Window - **Cumulative Sum Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `field` (string) — optional Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records. - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `cumulative_sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Counter Rate Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `counter_rate` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Formula Operation** - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `formula` (string) — required Formula - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `formula` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (enum) — optional Time scale Values: `s`, `m`, `h`, `d` - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `cells` (object) — optional Cells configuration - `labels` (object) — optional - `visible` (boolean · default: false) — optional Show cell labels - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `heatmap` - `x` (union anyOf) — required Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters. - **Date Histogram Operation** - `operation` (enum) — required Values: `date_histogram` - `drop_partial_intervals` (boolean · default: false) — optional When `true`, drops partial intervals from the results. - `field` (string) — required Field to be used for the date histogram. - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - `suggested_interval` (string · default: auto) — optional Suggested time interval. - `use_original_time_range` (boolean · default: false) — optional When `true`, uses the original time range instead of the current query time range. - **Terms Operation** - `operation` (enum) — required Values: `terms` - `excludes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to exclude. - `fields` (string[] · min items: 1 · max items: 4) — required - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `includes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to include. - `increase_accuracy` (boolean) — optional When `true`, increases accuracy at the cost of performance. - `label` (string) — optional Label for the operation - `limit` (number · default: 5) — optional Number of terms to return. - `other_bucket` (object) — optional - `include_documents_without_field` (boolean) — required When `true`, includes documents that do not have the specified field. - `rank_by` (union anyOf) — optional Same options as `rank_by` in `Terms Operation` - **Histogram Operation** - `operation` (enum) — required Values: `histogram` - `field` (string) — required Field to be used for the histogram. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `granularity` (union number | enum · default: auto) — optional Values: `auto` - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - **Ranges Operation** - `operation` (enum) — required Values: `range` - `field` (string) — required Field to be used for the range. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `ranges` (object[] · max items: 100) — required - `gt` (number) — optional Greater than. - `label` (string) — optional Label. - `lte` (number) — optional Less than or equal to. - **Filters Operation** - `operation` (enum) — required Values: `filters` - `filters` (object[] · max items: 100) — required - `filter` (object) — required A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `label` (string) — optional Label for the filter - `label` (string) — optional Label for the operation - `y` (union anyOf) — optional Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters. Same options as `x` in `Heatmap Chart (DSL)` - **Heatmap Chart (ES|QL)** Heatmap configuration using an ES|QL query. - `axis` (object) — optional Axis configuration for X and Y axes Same fields as `axis` in `Heatmap Chart (DSL)` - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `legend` (object) — optional Legend configuration - `position` (enum) — optional Values: `top`, `bottom`, `left`, `right` - `size` (union anyOf) — optional Legend size. Values: `auto`, `s`, `m`, `l`, `xl` - `truncate_after_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `visibility` (enum) — optional Legend visibility. Values: `visible`, `hidden` - `metric` (object) — required - `color` (union anyOf · default: {"type":"auto"}) — optional Color scale configuration for the heatmap cells. Same options as `color` in `Count Metric Operation` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `cells` (object) — optional Cells configuration - `labels` (object) — optional - `visible` (boolean · default: false) — optional Show cell labels - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `heatmap` - `x` (object) — required - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `y` (object) — optional - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - **Tag Cloud Chart** A word cloud with terms sized by metric value. Any of: - **Tag Cloud Chart (DSL)** Tag Cloud configuration using a data view. - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `metric` (union anyOf) — required - **Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `unique_count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Stats Metric Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Sum Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `operation` (enum) — required Values: `last_value` - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Differences Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required Same options as `of` in `Differences Operation` - `operation` (enum) — required Values: `differences` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Moving Average Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required Same options as `of` in `Differences Operation` - `operation` (enum) — required Values: `moving_average` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - `window` (number · default: 5) — optional Window - **Cumulative Sum Operation** - `field` (string) — optional Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records. - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `cumulative_sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Counter Rate Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `counter_rate` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Formula Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `formula` (string) — required Formula - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `formula` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (enum) — optional Time scale Values: `s`, `m`, `h`, `d` - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `caption` (object) — optional Caption configuration representing the metric and the tag_by operations labels - `visible` (boolean · default: true) — optional When `true`, displays the caption. - `font_size` (object) — optional Font size range for tags. - `max` (number · max: 120 · default: 72) — optional Maximum font size. - `min` (number · min: 1 · default: 18) — optional Minimum font size. - `orientation` (enum) — optional Orientation Values: `horizontal`, `vertical`, `angled` - `tag_by` (union anyOf) — required - **Date Histogram Operation** - `operation` (enum) — required Values: `date_histogram` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `drop_partial_intervals` (boolean · default: false) — optional When `true`, drops partial intervals from the results. - `field` (string) — required Field to be used for the date histogram. - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - `suggested_interval` (string · default: auto) — optional Suggested time interval. - `use_original_time_range` (boolean · default: false) — optional When `true`, uses the original time range instead of the current query time range. - **Terms Operation** - `operation` (enum) — required Values: `terms` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `excludes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to exclude. - `fields` (string[] · min items: 1 · max items: 4) — required - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `includes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to include. - `increase_accuracy` (boolean) — optional When `true`, increases accuracy at the cost of performance. - `label` (string) — optional Label for the operation - `limit` (number · default: 5) — optional Number of terms to return. - `other_bucket` (object) — optional - `include_documents_without_field` (boolean) — required When `true`, includes documents that do not have the specified field. - `rank_by` (union anyOf) — optional Same options as `rank_by` in `Terms Operation` - **Histogram Operation** - `operation` (enum) — required Values: `histogram` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `field` (string) — required Field to be used for the histogram. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `granularity` (union number | enum · default: auto) — optional Values: `auto` - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - **Ranges Operation** - `operation` (enum) — required Values: `range` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `field` (string) — required Field to be used for the range. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `ranges` (object[] · max items: 100) — required - `gt` (number) — optional Greater than. - `label` (string) — optional Label. - `lte` (number) — optional Less than or equal to. - **Filters Operation** - `operation` (enum) — required Values: `filters` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `filters` (object[] · max items: 100) — required - `filter` (object) — required A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `label` (string) — optional Label for the filter - `label` (string) — optional Label for the operation - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `tag_cloud` - **Tag Cloud Chart (ES|QL)** Tag Cloud configuration using an ES|QL query. - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `metric` (object) — required - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `caption` (object) — optional Caption configuration representing the metric and the tag_by operations labels - `visible` (boolean · default: true) — optional When `true`, displays the caption. - `font_size` (object) — optional Font size range for tags. - `max` (number · max: 120 · default: 72) — optional Maximum font size. - `min` (number · min: 1 · default: 18) — optional Minimum font size. - `orientation` (enum) — optional Orientation Values: `horizontal`, `vertical`, `angled` - `tag_by` (object) — required - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `tag_cloud` - **Region Map** A choropleth map with geographic regions colored by the aggregated metric value. Any of: - **Region Map (DSL)** Region Map configuration using a data view, mapping metric values to geographic regions by color. - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `metric` (union anyOf) — required Metric dimension using a field-based aggregation or a mathematical formula. - **Field Metric Operations** Any of: - **Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `unique_count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Stats Metric Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Sum Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `operation` (enum) — required Values: `last_value` - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Formula Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `formula` (string) — required Formula - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `formula` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (enum) — optional Time scale Values: `s`, `m`, `h`, `d` - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `region` (union anyOf) — required - **Date Histogram Operation** - `operation` (enum) — required Values: `date_histogram` - `ems` (object) — optional - `boundaries` (string) — required EMS boundaries - `join` (string) — required EMS join field - `drop_partial_intervals` (boolean · default: false) — optional When `true`, drops partial intervals from the results. - `field` (string) — required Field to be used for the date histogram. - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - `suggested_interval` (string · default: auto) — optional Suggested time interval. - `use_original_time_range` (boolean · default: false) — optional When `true`, uses the original time range instead of the current query time range. - **Terms Operation** - `operation` (enum) — required Values: `terms` - `ems` (object) — optional - `boundaries` (string) — required EMS boundaries - `join` (string) — required EMS join field - `excludes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to exclude. - `fields` (string[] · min items: 1 · max items: 4) — required - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `includes` (object) — optional - `as_regex` (boolean) — optional When `true`, treats the values as regular expressions. - `values` (union string[] | number[]) — required Values to include. - `increase_accuracy` (boolean) — optional When `true`, increases accuracy at the cost of performance. - `label` (string) — optional Label for the operation - `limit` (number · default: 5) — optional Number of terms to return. - `other_bucket` (object) — optional - `include_documents_without_field` (boolean) — required When `true`, includes documents that do not have the specified field. - `rank_by` (union anyOf) — optional Same options as `rank_by` in `Terms Operation` - **Histogram Operation** - `operation` (enum) — required Values: `histogram` - `ems` (object) — optional - `boundaries` (string) — required EMS boundaries - `join` (string) — required EMS join field - `field` (string) — required Field to be used for the histogram. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `granularity` (union number | enum · default: auto) — optional Values: `auto` - `include_empty_rows` (boolean · default: true) — optional When `true`, includes empty rows in the results. - `label` (string) — optional Label for the operation - **Ranges Operation** - `operation` (enum) — required Values: `range` - `ems` (object) — optional - `boundaries` (string) — required EMS boundaries - `join` (string) — required EMS join field - `field` (string) — required Field to be used for the range. - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `ranges` (object[] · max items: 100) — required - `gt` (number) — optional Greater than. - `label` (string) — optional Label. - `lte` (number) — optional Less than or equal to. - **Filters Operation** - `operation` (enum) — required Values: `filters` - `ems` (object) — optional - `boundaries` (string) — required EMS boundaries - `join` (string) — required EMS join field - `filters` (object[] · max items: 100) — required - `filter` (object) — required A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `label` (string) — optional Label for the filter - `label` (string) — optional Label for the operation - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `region_map` - **Region Map (ES|QL)** Region Map configuration using an ES|QL query, mapping metric values to geographic regions by color. - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `metric` (object) — required - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `region` (object) — required - `column` (string) — required Column to use - `ems` (object) — optional - `boundaries` (string) — required EMS boundaries - `join` (string) — required EMS join field - `label` (string) — optional Label for the operation - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `region_map` - **Datatable** Datatable chart configuration: DSL or ES|QL query based Any of: - **Datatable (DSL)** Datatable state configuration for standard queries - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `metrics` (union anyOf[] · min items: 1 · max items: 1000) — required Array of metrics to display as columns in the datatable - `alignment` (enum · default: right) — optional Alignment of the columns. Values: `left`, `center`, `right` - `apply_color_to` (enum) — optional Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay. Values: `value`, `background`, `badge` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data. - **Color By Value** Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes. Any of: - **Color By Value (Absolute)** Color by absolute value configuration - `range` (enum) — required Values: `absolute` - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `dynamic` - **Color By Value (Percentage)** Color by percentage value configuration - `range` (enum) — required Values: `percentage` - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `dynamic` - **Color By Value (Palette)** Color by value using a palette, with colors distributed across the range of values. - `palette` (enum) — required The name of the palette to apply across the value range. Values: `status`, `temperature`, `complementary`, `negative`, `positive`, `cool`, `warm`, `gray` - `type` (enum) — required Values: `distributed_palette` - **Legacy color by value** Legacy color by value configuration - `palette` (string) — required The legacy palette name. - `range` (enum) — required Determines whether the range is interpreted as absolute or as a percentage of the data. Values: `absolute`, `percentage` - `shift` (boolean) — required When `true`, shifts the palette colors so they start from a different offset. Defaults to `false`. - `steps` (object[] · min items: 1 · max items: 100) — required Array of ordered color steps defining the range each color is applied. - `color` (string) — required The color to use for this step. - `gte` (number) — optional — nullable The lower bound of range from which this color applies (inclusive). - `lt` (number) — optional — nullable The upper bound of range to which this color applies (exclusive). - `lte` (number) — optional — nullable The upper bound of range to which this color applies (inclusive). - `type` (enum) — required Values: `legacy_dynamic` - **Color Mapping** Color mapping for dimension values, either categorical (for specific values) or as a gradient. Any of: - **Categorical Color Mapping** Palette color assignment for specific categorical values. Unmapped values receive the unassigned color. - `mode` (enum) — required Values: `categorical` - `mapping` (object[] · max items: 1000) — required - `color` (union anyOf) — required - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - `values` (union anyOf[] · max items: 1000) — required - **string** - **number** - **boolean** - **Multi Value Cell** Values of a multi-value cell. - **Range Key** Identifies a range bucket. Omit either bound for an open end. - `type` (enum) — required Values: `range_key` - `from` (number | string) — optional - `ranges` (object[] · max items: 100) — required - `from` (number | string) — optional - `label` (string) — required - `to` (number | string) — optional - `to` (number | string) — optional - **Multi Field Key** Composite key from a multi-terms bucket. - `type` (enum) — required Values: `multi_field_key` - `keys` (string[] · max items: 100) — required - `palette` (string) — required Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - `unassigned` (union anyOf) — optional The color to use for unassigned values. - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - **Gradient Color Mapping** Gradient color mapping across categorical values. - `mode` (enum) — required Values: `gradient` - `gradient` (union anyOf[] · max items: 3) — optional - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - `mapping` (object[] · max items: 100) — optional - `values` (union anyOf[] · max items: 100) — required - **string** - **number** - **boolean** - **Multi Value Cell** Values of a multi-value cell. - **Range Key** Identifies a range bucket. Omit either bound for an open end. - `type` (enum) — required Values: `range_key` - `from` (number | string) — optional - `ranges` (object[] · max items: 100) — required - `from` (number | string) — optional - `label` (string) — required - `to` (number | string) — optional - `to` (number | string) — optional - **Multi Field Key** Composite key from a multi-terms bucket. - `type` (enum) — required Values: `multi_field_key` - `keys` (string[] · max items: 100) — required - `palette` (string) — required Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - `sort` (enum) — optional Sort direction Values: `asc`, `desc` - `unassigned` (union anyOf) — optional The color to use for unassigned values. - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `summary` (object) — optional Summary row configuration - `label` (string) — optional Summary row label. - `type` (enum) — required Type of summary function to apply to the column. Values: `sum`, `avg`, `count`, `min`, `max` - `visible` (boolean · default: true) — optional When `false`, hides the column from the datatable. - `width` (number · min: 0) — optional Column width in pixels. - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `rows` (union anyOf[] · min items: 1 · max items: 50) — optional Array of operations to split the datatable rows by - `alignment` (enum · default: left) — optional Alignment of the rows. Values: `left`, `center`, `right` - `apply_color_to` (enum) — optional Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay. Values: `value`, `background`, `badge` - `click_filter` (boolean · default: false) — optional When `true`, enables one-click filtering on cell values. - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf · default: {"type":"auto"}) — optional - **Color Mapping** Color mapping for dimension values, either categorical (for specific values) or as a gradient. Any of: - **Categorical Color Mapping** Palette color assignment for specific categorical values. Unmapped values receive the unassigned color. - `mode` (enum) — required Values: `categorical` - `mapping` (object[] · max items: 1000) — required - `color` (union anyOf) — required - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - `values` (union anyOf[] · max items: 1000) — required - **string** - **number** - **boolean** - **Multi Value Cell** Values of a multi-value cell. - **Range Key** Identifies a range bucket. Omit either bound for an open end. - `type` (enum) — required Values: `range_key` - `from` (number | string) — optional - `ranges` (object[] · max items: 100) — required - `from` (number | string) — optional - `label` (string) — required - `to` (number | string) — optional - `to` (number | string) — optional - **Multi Field Key** Composite key from a multi-terms bucket. - `type` (enum) — required Values: `multi_field_key` - `keys` (string[] · max items: 100) — required - `palette` (string) — required Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - `unassigned` (union anyOf) — optional The color to use for unassigned values. - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - **Gradient Color Mapping** Gradient color mapping across categorical values. - `mode` (enum) — required Values: `gradient` - `gradient` (union anyOf[] · max items: 3) — optional - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - `mapping` (object[] · max items: 100) — optional - `values` (union anyOf[] · max items: 100) — required - **string** - **number** - **boolean** - **Multi Value Cell** Values of a multi-value cell. - **Range Key** Identifies a range bucket. Omit either bound for an open end. - `type` (enum) — required Values: `range_key` - `from` (number | string) — optional - `ranges` (object[] · max items: 100) — required - `from` (number | string) — optional - `label` (string) — required - `to` (number | string) — optional - `to` (number | string) — optional - **Multi Field Key** Composite key from a multi-terms bucket. - `type` (enum) — required Values: `multi_field_key` - `keys` (string[] · max items: 100) — required - `palette` (string) — required Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - `sort` (enum) — optional Sort direction Values: `asc`, `desc` - `unassigned` (union anyOf) — optional The color to use for unassigned values. - **Color From Palette** Color at a fixed index position in a named palette. - `type` (enum) — required Values: `from_palette` - `index` (number) — required The index of the color in the palette. - `palette` (string) — optional Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to `default`. - **Color Code** A color specified as a hex or CSS color code string. - `type` (enum) — required Values: `color_code` - `value` (string) — required The static color value to use. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `visible` (boolean · default: true) — optional When `false`, hides the column from the datatable. - `width` (number · min: 0) — optional Column width in pixels. - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `split_metrics_by` (union anyOf[] · min items: 1 · max items: 20) — optional Array of operations to split the metric columns by Same options as `x` in `Heatmap Chart (DSL)` - `styling` (object) — optional Visual chart styling options - `density` (object) — optional Density configuration for the datatable. - `height` (object) — optional - `header` (union anyOf) — optional Number of lines before the header is truncated. - **type: auto** - `type` (enum) — required Values: `auto` - **type: custom** - `type` (enum) — required Values: `custom` - `max_lines` (number · min: 1 · max: 5 · default: 3) — optional - `value` (union anyOf) — optional Number of lines to display per table body cell. - **type: auto** - `type` (enum) — required Values: `auto` - **type: custom** - `type` (enum) — required Values: `custom` - `lines` (number · min: 1 · max: 20 · default: 1) — optional - `mode` (enum · default: default) — optional Display density mode. Values: `compact`, `default`, `expanded` - `paging` (enum) — optional Rows per page. When set, pagination is enabled with the specified number of rows. Values: `10`, `20`, `30`, `50`, `100` - `row_numbers` (object) — optional Configuration for row numbers - `visible` (boolean) — required When `true`, displays row numbers. - `sort_by` (union anyOf) — optional Sorting configuration. Only one column can be sorted at a time. Use "column_type" to specify the column type. - **object** Sort by a metric or row column - `column_type` (enum) — required Type of column to sort by. Values: `metric`, `row` - `direction` (enum) — required Direction Values: `asc`, `desc` - `index` (number · min: 0) — required Index of the column or row to sort by (0-based). - **column_type: pivoted_metric** Sort by a pivoted metric column (created when metrics are pivoted by split_metrics_by) - `column_type` (enum) — required Values: `pivoted_metric` - `direction` (enum) — required Direction Values: `asc`, `desc` - `index` (number · min: 0) — required 0-based index into the "metrics" array for the metric to sort; use "values" to identify the pivoted column - `values` (string[] · min items: 1 · max items: 20) — required Array of pivot values, one for each split_metrics_by column in order - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `data_table` - **Datatable (ES|QL)** Datatable state configuration for ES|QL queries - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `metrics` (object[] · min items: 1 · max items: 1000) — optional Array of metrics to display as columns in the datatable - `alignment` (enum · default: right) — optional Alignment of the columns. Values: `left`, `center`, `right` - `apply_color_to` (enum) — optional Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay. Values: `value`, `background`, `badge` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data. Same options as `color` in `metrics` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `summary` (object) — optional Summary row configuration - `label` (string) — optional Summary row label. - `type` (enum) — required Type of summary function to apply to the column. Values: `sum`, `avg`, `count`, `min`, `max` - `visible` (boolean · default: true) — optional When `false`, hides the column from the datatable. - `width` (number · min: 0) — optional Column width in pixels. - `rows` (object[] · min items: 1 · max items: 50) — optional Array of operations to split the datatable rows by - `alignment` (enum · default: left) — optional Alignment of the rows. Values: `left`, `center`, `right` - `apply_color_to` (enum) — optional Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay. Values: `value`, `background`, `badge` - `click_filter` (boolean · default: false) — optional When `true`, enables one-click filtering on cell values. - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf · default: {"type":"auto"}) — optional Color configuration for ESQL datatable rows. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data. Same options as `color` in `metrics` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `visible` (boolean · default: true) — optional When `false`, hides the column from the datatable. - `width` (number · min: 0) — optional Column width in pixels. - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `split_metrics_by` (object[] · min items: 1 · max items: 20) — optional Array of operations to split the metric columns by - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `styling` (object) — optional Visual chart styling options Same fields as `styling` in `Datatable (DSL)` - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `data_table` - **Pie Chart** Pie chart state: standard query or ES|QL query Any of: - **Pie Chart (DSL)** Pie chart configuration for standard queries - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `group_by` (union anyOf[] · min items: 1 · max items: 100) — optional Array of breakdown dimensions (minimum 1) - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `legend` (object) — optional Legend configuration for pie chart - `nested` (boolean · default: false) — optional Show nested legend with hierarchical breakdown levels - `position` (enum · default: right) — optional Legend Position. Values: `top`, `bottom`, `left`, `right` - `size` (union anyOf) — optional Legend size. Values: `auto`, `s`, `m`, `l`, `xl` - `truncate_after_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `visibility` (enum) — optional Legend visibility. Values: `auto`, `visible`, `hidden` - `metrics` (union anyOf[] · min items: 1 · max items: 100) — required Array of metric configurations (minimum 1) - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `donut_hole` (enum) — optional Donut hole size. Accepted values: `none` (full pie), `s`, `m`, `l`. Values: `none`, `s`, `m`, `l` - `labels` (object) — optional Label configuration for pie chart slice labels inside or outside the pie - `position` (enum) — optional Slice label position: `inside` or `outside`. Values: `inside`, `outside` - `visible` (boolean) — optional When `true`, displays slice labels. - `values` (object) — optional Configure the visibility and the format of the values rendered on each chart partition section - `mode` (enum) — optional How to format values when visible. Values: `absolute`, `percentage` - `percent_decimals` (number · min: 0 · max: 10 · default: 2) — optional Decimal places for percentage display (0-10) - `visible` (boolean) — optional Show metric values on the chart - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `pie` - **Pie Chart (ES|QL)** Pie chart configuration for ES|QL queries - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `group_by` (object[] · min items: 1 · max items: 100) — optional Array of breakdown dimensions (minimum 1) - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `legend` (object) — optional Legend configuration for pie chart - `nested` (boolean · default: false) — optional Show nested legend with hierarchical breakdown levels - `position` (enum · default: right) — optional Legend Position. Values: `top`, `bottom`, `left`, `right` - `size` (union anyOf) — optional Legend size. Values: `auto`, `s`, `m`, `l`, `xl` - `truncate_after_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `visibility` (enum) — optional Legend visibility. Values: `auto`, `visible`, `hidden` - `metrics` (object[] · min items: 1 · max items: 100) — required Array of metric configurations (minimum 1) - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `donut_hole` (enum) — optional Donut hole size. Accepted values: `none` (full pie), `s`, `m`, `l`. Values: `none`, `s`, `m`, `l` - `labels` (object) — optional Label configuration for pie chart slice labels inside or outside the pie - `position` (enum) — optional Slice label position: `inside` or `outside`. Values: `inside`, `outside` - `visible` (boolean) — optional When `true`, displays slice labels. - `values` (object) — optional Configure the visibility and the format of the values rendered on each chart partition section - `mode` (enum) — optional How to format values when visible. Values: `absolute`, `percentage` - `percent_decimals` (number · min: 0 · max: 10 · default: 2) — optional Decimal places for percentage display (0-10) - `visible` (boolean) — optional Show metric values on the chart - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `pie` - **Mosaic Chart** Mosaic chart configuration schema supporting both data source queries (non-ES|QL) and ES|QL query modes Any of: - **Mosaic Chart (DSL)** Mosaic chart configuration schema for data source queries (non-ES|QL mode), defining metrics and breakdown dimensions - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `group_breakdown_by` (union anyOf[] · min items: 1 · max items: 100) — optional Array of group breakdown dimensions (minimum 1) - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `group_by` (union anyOf[] · min items: 1 · max items: 100) — optional Array of breakdown dimensions (minimum 1) - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `legend` (object) — optional Legend configuration for mosaic chart appearance and behavior - `nested` (boolean · default: false) — optional Show nested legend with hierarchical breakdown levels - `position` (enum · default: right) — optional Legend Position. Values: `top`, `bottom`, `left`, `right` - `size` (union anyOf) — optional Legend size. Values: `auto`, `s`, `m`, `l`, `xl` - `truncate_after_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `visibility` (enum) — optional Legend visibility. Values: `auto`, `visible`, `hidden` - `metric` (union anyOf) — required - **Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — optional Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Unique Count Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `unique_count` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Stats Metric Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `min`, `max`, `average`, `median`, `standard_deviation` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Sum Metric Operation** - `empty_as_null` (boolean · default: false) — optional When `true`, treats empty buckets as null instead of zero. - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Last Value Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `multi_value` (boolean · default: false) — optional Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array. - `operation` (enum) — required Values: `last_value` - `reduced_time_range` (string) — optional Reduced time range - `time_field` (string) — required Time field used to determine document recency - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile` - `percentile` (number · default: 95) — optional Percentile - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Percentile Ranks Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `percentile_rank` - `rank` (number · default: 0) — optional Percentile Rank - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Differences Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required Same options as `of` in `Differences Operation` - `operation` (enum) — required Values: `differences` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Moving Average Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `of` (union anyOf) — required Same options as `of` in `Differences Operation` - `operation` (enum) — required Values: `moving_average` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - `window` (number · default: 5) — optional Window - **Cumulative Sum Operation** - `field` (string) — optional Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records. - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `cumulative_sum` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Counter Rate Operation** - `field` (string) — required Field to be used for the metric - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `counter_rate` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (union anyOf) — optional Time scale Values: `s`, `m`, `h`, `d` - `time_shift` (string) — optional Time shift - **Formula Operation** - `filter` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `formula` (string) — required Formula - `label` (string) — optional Label for the operation - `operation` (enum) — required Values: `formula` - `reduced_time_range` (string) — optional Reduced time range - `time_scale` (enum) — optional Time scale Values: `s`, `m`, `h`, `d` - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `values` (object) — optional Configure the visibility and the format of the values rendered on each chart partition section - `mode` (enum) — optional How to format values when visible. Values: `absolute`, `percentage` - `percent_decimals` (number · min: 0 · max: 10 · default: 2) — optional Decimal places for percentage display (0-10) - `visible` (boolean) — optional Show metric values on the chart - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `mosaic` - **Mosaic Chart (ES|QL)** Mosaic chart configuration schema for ES|QL queries, defining metrics and breakdown dimensions using column-based configuration - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `group_breakdown_by` (object[] · min items: 1 · max items: 100) — optional Array of group breakdown dimensions (minimum 1) - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `group_by` (object[] · min items: 1 · max items: 100) — optional Array of breakdown dimensions (minimum 1) - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `legend` (object) — optional Legend configuration for mosaic chart appearance and behavior - `nested` (boolean · default: false) — optional Show nested legend with hierarchical breakdown levels - `position` (enum · default: right) — optional Legend Position. Values: `top`, `bottom`, `left`, `right` - `size` (union anyOf) — optional Legend size. Values: `auto`, `s`, `m`, `l`, `xl` - `truncate_after_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `visibility` (enum) — optional Legend visibility. Values: `auto`, `visible`, `hidden` - `metric` (object) — required Metric configuration for ES|QL mode, combining generic options, primary metric options, and column selection - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `values` (object) — optional Configure the visibility and the format of the values rendered on each chart partition section - `mode` (enum) — optional How to format values when visible. Values: `absolute`, `percentage` - `percent_decimals` (number · min: 0 · max: 10 · default: 2) — optional Decimal places for percentage display (0-10) - `visible` (boolean) — optional Show metric values on the chart - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `mosaic` - **Treemap Chart** Treemap chart configuration schema supporting both data source queries (non-ES|QL) and ES|QL query modes Any of: - **Treemap Chart (DSL)** Treemap chart configuration schema for data source queries (non-ES|QL mode), defining metrics and breakdown dimensions - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `group_by` (union anyOf[] · min items: 1 · max items: 100) — optional Array of breakdown dimensions (minimum 1) - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `legend` (object) — optional Configuration for the treemap chart legend appearance and behavior - `nested` (boolean · default: false) — optional Show nested legend with hierarchical breakdown levels - `position` (enum · default: right) — optional Legend Position. Values: `top`, `bottom`, `left`, `right` - `size` (union anyOf) — optional Legend size. Values: `auto`, `s`, `m`, `l`, `xl` - `truncate_after_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `visibility` (enum) — optional Legend visibility. Values: `auto`, `visible`, `hidden` - `metrics` (union anyOf[] · min items: 1 · max items: 100) — required Array of metric configurations (minimum 1) - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `labels` (object) — optional Labels configuration - `visible` (boolean) — optional Show category labels - `values` (object) — optional Configure the visibility and the format of the values rendered on each chart partition section - `mode` (enum) — optional How to format values when visible. Values: `absolute`, `percentage` - `percent_decimals` (number · min: 0 · max: 10 · default: 2) — optional Decimal places for percentage display (0-10) - `visible` (boolean) — optional Show metric values on the chart - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `treemap` - **Treemap Chart (ES|QL)** Treemap chart configuration schema for ES|QL queries, defining metrics and breakdown dimensions using column-based configuration - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `group_by` (object[] · min items: 1 · max items: 100) — optional Array of breakdown dimensions (minimum 1) - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `legend` (object) — optional Configuration for the treemap chart legend appearance and behavior - `nested` (boolean · default: false) — optional Show nested legend with hierarchical breakdown levels - `position` (enum · default: right) — optional Legend Position. Values: `top`, `bottom`, `left`, `right` - `size` (union anyOf) — optional Legend size. Values: `auto`, `s`, `m`, `l`, `xl` - `truncate_after_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `visibility` (enum) — optional Legend visibility. Values: `auto`, `visible`, `hidden` - `metrics` (object[] · min items: 1 · max items: 100) — required Array of metric configurations (minimum 1) - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `labels` (object) — optional Labels configuration - `visible` (boolean) — optional Show category labels - `values` (object) — optional Configure the visibility and the format of the values rendered on each chart partition section - `mode` (enum) — optional How to format values when visible. Values: `absolute`, `percentage` - `percent_decimals` (number · min: 0 · max: 10 · default: 2) — optional Decimal places for percentage display (0-10) - `visible` (boolean) — optional Show metric values on the chart - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `treemap` - **Waffle Chart** Waffle chart configuration: DSL or ES|QL query based Any of: - **Waffle Chart (DSL)** Waffle chart configuration for standard queries - `data_source` (union oneOf) — required Same options as `data_source` in `header_row_height: auto` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `group_by` (union anyOf[] · min items: 1 · max items: 100) — optional Array of breakdown dimensions (minimum 1) - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `legend` (object) — optional Legend configuration for waffle chart - `position` (enum · default: right) — optional Legend Position. Values: `top`, `bottom`, `left`, `right` - `size` (union anyOf) — optional Legend size. Values: `auto`, `s`, `m`, `l`, `xl` - `truncate_after_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `values` (enum[] · min items: 1 · max items: 1) — optional Values: `absolute` - `visibility` (enum) — optional Legend visibility. Values: `auto`, `visible`, `hidden` - `metrics` (union anyOf[] · min items: 1 · max items: 100) — required Array of metric configurations (minimum 1) - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `query` (object) — optional A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters. - `expression` (string) — required A query expression in KQL or Lucene syntax - `language` (enum · default: kql) — optional Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`. Values: `kql`, `lucene` - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `values` (object) — optional Configure the visibility and the format of the values rendered on each chart partition section - `mode` (enum) — optional How to format values when visible. Values: `absolute`, `percentage` - `percent_decimals` (number · min: 0 · max: 10 · default: 2) — optional Decimal places for percentage display (0-10) - `visible` (boolean) — optional Show metric values on the chart - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `waffle` - **Waffle Chart (ES|QL)** Waffle chart configuration for ES|QL queries - `data_source` (object) — required Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields. - `query` (string) — required An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name". - `type` (enum) — required Values: `esql` - `description` (string) — optional The description of the chart. Optional. Any string value or undefined. - `filters` (union oneOf[] · max items: 100) — optional Filters applied to the panel Same options as `filters` - `group_by` (object[] · min items: 1 · max items: 100) — optional Array of ES|QL breakdown columns (minimum 1) - `collapse_by` (union anyOf) — optional Aggregation function used to collapse a breakdown dimension into a single value. Values: `avg`, `sum`, `max`, `min` - `color` (union anyOf) — optional Color mapping for dimension values, either categorical (for specific values) or as a gradient. Default: `{"mapping":[],"mode":"categorical","palette":"default"}` Same options as `color` in `Date Histogram Operation` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `ignore_global_filters` (boolean · default: false) — optional When `true`, ignores global filters when fetching data for this layer. Defaults to `false`. - `legend` (object) — optional Legend configuration for waffle chart - `position` (enum · default: right) — optional Legend Position. Values: `top`, `bottom`, `left`, `right` - `size` (union anyOf) — optional Legend size. Values: `auto`, `s`, `m`, `l`, `xl` - `truncate_after_lines` (number · min: 1 · max: 10 · default: 1) — optional Number of lines before legend items are truncated. - `values` (enum[] · min items: 1 · max items: 1) — optional Values: `absolute` - `visibility` (enum) — optional Legend visibility. Values: `auto`, `visible`, `hidden` - `metrics` (object[] · min items: 1 · max items: 100) — required Array of metric configurations (minimum 1) - `color` (union anyOf · default: {"type":"auto"}) — optional - **Static Color** Fixed color for all values in the dimension. - `type` (enum) — required Values: `static` - `color` (string) — required The static color to be used for all values. - **Auto Color** Coloring determined at runtime based on chart defaults - `type` (enum) — required Values: `auto` - `column` (string) — required Column to use - `format` (union anyOf) — optional Number display format for the dimension value. Same options as `format` in `Terms Operation` - `label` (string) — optional Label for the operation - `sampling` (number · min: 0 · max: 1 · default: 1) — optional Sampling factor between 0 (no sampling) and 1 (full sampling). - `styling` (object) — optional Visual chart styling options - `values` (object) — optional Configure the visibility and the format of the values rendered on each chart partition section - `mode` (enum) — optional How to format values when visible. Values: `absolute`, `percentage` - `percent_decimals` (number · min: 0 · max: 10 · default: 2) — optional Decimal places for percentage display (0-10) - `visible` (boolean) — optional Show metric values on the chart - `title` (string) — optional The title of the chart displayed in the panel. Optional. Any string value or undefined. - `type` (enum) — required Values: `waffle` - **By reference** Panel configuration stored in a linked library item - `description` (string) — optional A short description of the panel. - `drilldowns` (union anyOf[] · max items: 100) — optional Same options as `drilldowns` in `By value` - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `ref_id` (string) — required - `references` (object[]) — optional - `id` (string) — required - `name` (string) — required - `type` (string) — required - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `type` (enum) — required Values: `vis` - **Section** A collapsible group of panels. - `collapsed` (boolean · default: false) — optional When `true`, the section is collapsed and its panels are not rendered until expanded. Useful for improving initial load time on large dashboards. Defaults to `false`. - `grid` (object) — required - `y` (number) — required The y coordinate of the section in grid units. - `id` (string) — optional The unique ID of the section. - `panels` (union oneOf[] · max items: 1000) — optional The panels that belong to the section. - **Anomaly charts** - `type` (enum) — required Values: `ml_anomaly_charts` - `config` (object) — required Anomaly Charts embeddable Same fields as `config` in `Anomaly charts` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Anomaly swim lane** - `type` (enum) — required Values: `ml_anomaly_swimlane` - `config` (union anyOf) — required Anomaly Swim Lane embeddable Same options as `config` in `Anomaly swim lane` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **APM Service map** - `type` (enum) — required Values: `apm_service_map` - `config` (object) — required APM service map embeddable schema Same fields as `config` in `APM Service map` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Change point charts** - `type` (enum) — required Values: `change_point_grid` - `config` (object) — required Panel configuration stored inline - `apply_dashboard_context` (boolean · default: true) — optional When true, the panel uses the dashboard filters, query, and ES|QL variables. When false, it uses static_context. - `description` (string) — optional A short description of the panel. - `esql` (string · max length: 10000) — required The ES|QL query that detects the change points. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `static_context` (object) — optional Filters, query, and ES|QL variables captured from Discover. Used only when apply_dashboard_context is false. - `esql_variables` (object[] · max items: 50) — optional ES|QL variable values captured from Discover. - `key` (string · max length: 256) — required - `type` (enum) — required Values: `time_literal`, `fields`, `values`, `multi_values`, `functions` - `value` (union string | number | number[]) — required Any of: `(string | number)[]` or `string` or `number` - `filters` (union oneOf[] · max items: 100) — optional Filters captured from Discover. Same options as `filters` - `query` (object) — optional A search query consisting of an expression and its language. Supports KQL and Lucene syntax. - `expression` (string) — required A query expression in KQL or Lucene syntax. - `language` (enum) — required Query language. Use `kql` for Kibana Query Language (KQL) or `lucene` for Lucene query syntax. Values: `kql`, `lucene` - `time_range` (object) — optional Panel time range. When set, it overrides the dashboard time range. - `from` (string · max length: 128) — required The start of the time range. Accepts date math (for example, now-7d) or an ISO 8601 timestamp. - `mode` (enum) — optional Use absolute for fixed timestamps, or relative for date math that is re-evaluated at query time. Values: `absolute`, `relative` - `to` (string · max length: 128) — required The end of the time range. Accepts date math (for example, now) or an ISO 8601 timestamp. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Change point detection chart** - `type` (enum) — required Values: `aiops_change_point_chart` - `config` (object) — required Change point detection chart embeddable schema Same fields as `config` in `Change point detection chart` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Custom panel** - `type` (enum) — required Values: `custom_content` - `config` (object) — required - `description` (string) — optional A short description of the panel. - `esql_query` (string[] · max items: 1) — optional - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `template` (string · max length: 510000) — optional - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Discover session** - `type` (enum) — required Values: `discover_session` - `config` (union anyOf) — required Same options as `config` in `Discover session` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **ES|QL variable control** - `type` (enum) — required Values: `esql_control` - `config` (union oneOf) — required Same options as `config` in `ES|QL variable control` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Field statistics table** - `type` (enum) — required Values: `field_stats_table` - `config` (union oneOf) — required Field statistics table embeddable schema Same options as `config` in `Field statistics table` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Image** - `type` (enum) — required Values: `image` - `config` (object) — required Image embeddable schema - `description` (string) — optional A short description of the panel. - `drilldowns` (union anyOf[] · max items: 100) — optional Same options as `drilldowns` in `config` - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `image_config` (object) — required - `alt_text` (string) — optional - `background_color` (string) — optional - `object_fit` (enum · default: contain) — optional How the image should be sized within its container Values: `fill`, `contain`, `cover`, `none` - `src` (union anyOf) — required Image source - **file** - `type` (enum) — required Values: `file` - `file_id` (string) — required - **url** - `type` (enum) — required Values: `url` - `url` (string) — required URL of the image - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Links** - `type` (enum) — required Values: `links` - `config` (union anyOf) — required Links embeddable schema Same options as `config` in `Links` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Log rate analysis** - `type` (enum) — required Values: `aiops_log_rate_analysis` - `config` (object) — required Log rate analysis embeddable schema - `data_view_id` (string · min length: 1 · max length: 1000) — required The data view ID used to run log rate analysis. - `description` (string) — optional A short description of the panel. - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Markdown** - `type` (enum) — required Values: `markdown` - `config` (union anyOf) — required Markdown panel config Same options as `config` in `Markdown` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Options list control** - `type` (enum) — required Values: `options_list_control` - `config` (union oneOf) — required Same options as `config` in `Options list control` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Pattern analysis** - `type` (enum) — required Values: `aiops_pattern_analysis` - `config` (object) — required Log Pattern Analysis embeddable schema Same fields as `config` in `Pattern analysis` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Range slider control** - `type` (enum) — required Values: `range_slider_control` - `config` (union oneOf) — required Same options as `config` in `Range slider control` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Single metric viewer** - `type` (enum) — required Values: `ml_single_metric_viewer` - `config` (object) — required Single Metric Viewer embeddable Same fields as `config` in `Single metric viewer` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **SLO alerts** - `type` (enum) — required Values: `slo_alerts` - `config` (object) — required SLO Alerts embeddable schema Same fields as `config` in `SLO alerts` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **SLO burn rate** - `type` (enum) — required Values: `slo_burn_rate` - `config` (object) — required SLO Burn Rate embeddable schema Same fields as `config` in `SLO burn rate` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **SLO error budget** - `type` (enum) — required Values: `slo_error_budget` - `config` (object) — required SLO Error Budget embeddable schema Same fields as `config` in `SLO error budget` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **SLO overview** - `type` (enum) — required Values: `slo_overview` - `config` (union oneOf) — required SLO Overview embeddable schema Same options as `config` in `SLO overview` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Synthetics monitors** - `type` (enum) — required Values: `synthetics_monitors` - `config` (object) — required Synthetics monitors embeddable schema - `description` (string) — optional A short description of the panel. - `filters` (object) — optional - `locations` (object[] · max items: 100) — optional Filter by monitor locations - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `monitor_ids` (object[] · max items: 5000) — optional Filter by monitor IDs - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `monitor_types` (object[] · max items: 10) — optional Filter by monitor types - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `projects` (object[] · max items: 100) — optional Filter by project - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `tags` (object[] · max items: 100) — optional Filter by tags - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `title` (string) — optional The panel title. - `view` (enum) — optional View mode for the monitors embeddable (defaults to cardView) Values: `cardView`, `compactView` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Synthetics stats overview** - `type` (enum) — required Values: `synthetics_stats_overview` - `config` (object) — required Synthetics stats overview embeddable schema - `description` (string) — optional A short description of the panel. - `drilldowns` (union[] · max items: 100) — optional - **url_drilldown** - `encode_url` (boolean · default: true) — optional When true, URL is escaped using percent encoding - `label` (string) — required - `open_in_new_tab` (boolean · default: true) — optional - `trigger` (enum) — required Values: `on_open_panel_menu` - `type` (enum) — required Values: `url_drilldown` - `url` (string) — required Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable - `filters` (object) — optional - `locations` (object[] · max items: 100) — optional Filter by monitor locations - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `monitor_ids` (object[] · max items: 5000) — optional Filter by monitor IDs - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `monitor_types` (object[] · max items: 10) — optional Filter by monitor types - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `projects` (object[] · max items: 100) — optional Filter by project - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `tags` (object[] · max items: 100) — optional Filter by tags - `label` (string) — required Display label for the filter option - `value` (string) — required Value for the filter option - `hide_border` (boolean) — optional When true, the panel border is hidden. Defaults to false. - `hide_title` (boolean) — optional When true, the panel title is hidden. Defaults to false. - `title` (string) — optional The panel title. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Time slider control** - `type` (enum) — required Values: `time_slider_control` - `config` (object) — required - `end_percentage_of_time_range` (number · min: 0 · max: 1 · default: 1) — optional The end of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range. - `is_anchored` (boolean · default: false) — optional When `true`, the start of the time window is fixed at the beginning of the global time range. Only the end of the window can be adjusted. Defaults to `false`. - `start_percentage_of_time_range` (number · min: 0 · max: 1 · default: 0) — optional The start of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range. - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - **Visualization** - `type` (enum) — required Values: `vis` - `config` (union anyOf) — required Lens embeddable schema Same options as `config` in `Visualization` - `grid` (object) — required The position and size of the panel on the dashboard grid. - `h` (number · min: 1 · default: 15) — optional The height of the panel in grid units. Minimum `1`. Defaults to `15`. - `w` (number · min: 1 · max: 48 · default: 24) — optional The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`. - `x` (number) — required The x coordinate of the panel in grid units. - `y` (number) — required The y coordinate of the panel in grid units. - `id` (string) — optional The unique ID of the panel. - `title` (string) — required The title of the section. - `pinned_panels` (union oneOf[] · max items: 100) — optional An array of control panels and their state in the control group. - **esql_control** An ES|QL variable control whose selected value is injected into ES|QL visualizations using the `?variable_name` syntax. Options can come from a fixed list or an ES|QL query. Define the options source in `config`. - `type` (enum) — required Values: `esql_control` - `config` (union oneOf) — required Same options as `config` in `ES|QL variable control` - `grow` (boolean · default: false) — optional When `true`, the control expands to fill any available horizontal space. Defaults to `false`. - `id` (string) — optional The unique ID of the control - `width` (enum · default: medium) — optional Minimum width of the control panel. Values: `small`, `medium`, `large` - **options_list_control** A dropdown control that filters data by selecting field values from a data view. Define the data view, field, and selection settings in `config`. - `type` (enum) — required Values: `options_list_control` - `config` (union oneOf) — required Same options as `config` in `Options list control` - `grow` (boolean · default: false) — optional When `true`, the control expands to fill any available horizontal space. Defaults to `false`. - `id` (string) — optional The unique ID of the control - `width` (enum · default: medium) — optional Minimum width of the control panel. Values: `small`, `medium`, `large` - **range_slider_control** A slider control that filters data by selecting a numeric range for the configured field. Define the data view, field, and selection settings in `config`. - `type` (enum) — required Values: `range_slider_control` - `config` (union oneOf) — required Same options as `config` in `Range slider control` - `grow` (boolean · default: false) — optional When `true`, the control expands to fill any available horizontal space. Defaults to `false`. - `id` (string) — optional The unique ID of the control - `width` (enum · default: medium) — optional Minimum width of the control panel. Values: `small`, `medium`, `large` - **time_slider_control** A control panel that filters a time field to a selected sub-range of the global time range. Define the start and end positions in `config` as fractions of the global range (0 to 1). - `type` (enum) — required Values: `time_slider_control` - `config` (object) — required - `end_percentage_of_time_range` (number · min: 0 · max: 1 · default: 1) — optional The end of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range. - `is_anchored` (boolean · default: false) — optional When `true`, the start of the time window is fixed at the beginning of the global time range. Only the end of the window can be adjusted. Defaults to `false`. - `start_percentage_of_time_range` (number · min: 0 · max: 1 · default: 0) — optional The start of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range. - `grow` (boolean · default: false) — optional When `true`, the control expands to fill any available horizontal space. Defaults to `false`. - `id` (string) — optional The unique ID of the control - `width` (enum · default: medium) — optional Minimum width of the control panel. Values: `small`, `medium`, `large` - `project_routing` (string) — optional Controls [cross-project search](https://www.elastic.co/docs/explore-analyze/cross-project-search/cross-project-search-project-routing) behavior for this dashboard (Serverless only). Set to `_alias:_origin` to scope data to the current project, or `_alias:*` to search across all projects. When omitted, the space default applies. - `query` (object) — optional A search query consisting of an expression and its language. Supports KQL and Lucene syntax. - `expression` (string) — required A query expression in KQL or Lucene syntax. - `language` (enum) — required Query language. Use `kql` for Kibana Query Language (KQL) or `lucene` for Lucene query syntax. Values: `kql`, `lucene` - `refresh_interval` (object) — optional Specifies the auto-refresh interval for the object. - `pause` (boolean) — required When `true`, auto-refresh is paused. - `value` (number) — required The refresh interval in milliseconds. - `tags` (string[] · max items: 1000 · default: []) — optional Tag IDs to associate with this dashboard. - `time_range` (object) — optional Specifies the time range for a query. - `from` (string) — required The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) — optional The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) — required The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string · min length: 1) — required A human-readable title for the dashboard. ## Responses #### `201` created `application/json` - `data` (object) - `access_control` (object) Access control settings for the dashboard. - `access_mode` (enum) Controls edit access to the dashboard. Set to `write_restricted` to prevent edits by users without explicit write permission. Defaults to `default` (all viewers can edit). Values: `write_restricted`, `default` - `description` (string) A short description of the dashboard. - `esql_approximation` (boolean) When `true`, ES|QL visualizations that use `STATS` run with [approximate execution](https://www.elastic.co/docs/reference/query-languages/esql/esql-query-approximation) for faster, estimated results. - `filters` (union oneOf[] · max items: 500) Filters applied across all panels, including pinned panels. Same options as `filters` - `options` (object) Display and behavior settings for the dashboard. Default: `{"auto_apply_filters":true,"hide_panel_borders":false,"hide_panel_titles":false,"sync_colors":false,"sync_cursor":true,"sync_tooltips":false,"use_margins":true}` - `auto_apply_filters` (boolean · default: true) When `true`, control filter changes are applied automatically. When `false`, control filter changes are applied manually through the dashboard's search update button. Defaults to `true`. - `hide_panel_borders` (boolean · default: false) When `true`, panel borders are hidden. Defaults to `false`. - `hide_panel_titles` (boolean · default: false) When `true`, panel titles are hidden. Defaults to `false`. - `sync_colors` (boolean · default: false) When `true`, colors are synchronized across panels that share a data source. Defaults to `false`. - `sync_cursor` (boolean · default: true) When `true`, the cursor position is synchronized across panels. Defaults to `true`. - `sync_tooltips` (boolean · default: false) When `true`, tooltips are synchronized across panels. Defaults to `false`. - `use_margins` (boolean · default: true) When `true`, panels are separated by a margin. Defaults to `true`. - `panels` (union anyOf[] · max items: 1000) Panels and sections in the dashboard. Each entry is either a panel (with a `type` and `config`) or a collapsible section (with a `title`, `collapsed` state, and nested `panels`). Same options as `panels` - `pinned_panels` (union oneOf[] · max items: 100) An array of control panels and their state in the control group. Same options as `pinned_panels` - `project_routing` (string) Controls [cross-project search](https://www.elastic.co/docs/explore-analyze/cross-project-search/cross-project-search-project-routing) behavior for this dashboard (Serverless only). Set to `_alias:_origin` to scope data to the current project, or `_alias:*` to search across all projects. When omitted, the space default applies. - `query` (object) A search query consisting of an expression and its language. Supports KQL and Lucene syntax. - `expression` (string) A query expression in KQL or Lucene syntax. - `language` (enum) Query language. Use `kql` for Kibana Query Language (KQL) or `lucene` for Lucene query syntax. Values: `kql`, `lucene` - `refresh_interval` (object) Specifies the auto-refresh interval for the object. - `pause` (boolean) When `true`, auto-refresh is paused. - `value` (number) The refresh interval in milliseconds. - `tags` (string[] · max items: 1000 · default: []) Tag IDs to associate with this dashboard. - `time_range` (object) Specifies the time range for a query. - `from` (string) The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps. - `mode` (enum) The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`). Values: `absolute`, `relative` - `to` (string) The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps. - `title` (string · min length: 1) A human-readable title for the dashboard. - `id` (string) The unique ID of the dashboard, as returned by the create or search endpoints. - `meta` (object) - `created_at` (string) Timestamp when the object was created (ISO 8601). - `created_by` (string) User profile ID of the user who created the object. - `managed` (boolean) When `true`, the object is managed by Kibana and cannot be edited by users. - `owner` (string) Identifier of the plugin or team that owns this object. - `updated_at` (string) Timestamp when the object was last updated (ISO 8601). - `updated_by` (string) User profile ID of the user who last updated the object. - `version` (string) Internal version identifier for optimistic concurrency control. #### `400` invalid request #### `403` forbidden ## Code examples #### Console ```console POST kbn:/api/dashboards { "panels": [ { "config": { "content": "## Web logs overview\n\n\u0026nbsp;\n\nCreated with the [Dashboards API](https://www.elastic.co/docs/api/doc/kibana) using the Kibana sample web logs dataset (\u0060kibana_sample_data_logs\u0060). Contains:\n- This markdown panel\n- 2 metrics, showing request count and average response size\n- A line chart based on an ES|QL query\n\n\u0026nbsp;\n\n\u0026nbsp;\n\n[Learn more about dashboards](https://www.elastic.co/docs/explore-analyze/dashboards)" }, "grid": { "h": 15, "w": 24, "x": 0, "y": 0 }, "type": "markdown" }, { "config": { "data_source": { "index_pattern": "kibana_sample_data_logs", "time_field": "timestamp", "type": "data_view_spec" }, "metrics": [ { "operation": "count", "type": "primary" } ], "type": "metric" }, "grid": { "h": 5, "w": 12, "x": 24, "y": 0 }, "type": "vis" }, { "config": { "data_source": { "index_pattern": "kibana_sample_data_logs", "time_field": "timestamp", "type": "data_view_spec" }, "metrics": [ { "field": "bytes", "operation": "average", "type": "primary" } ], "type": "metric" }, "grid": { "h": 5, "w": 12, "x": 36, "y": 0 }, "type": "vis" }, { "config": { "axis": { "x": { "title": { "visible": false } } }, "layers": [ { "data_source": { "query": "FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)", "type": "esql" }, "type": "line", "x": { "column": "BUCKET(@timestamp, 75, ?_tstart, ?_tend)" }, "y": [ { "column": "count" } ] } ], "title": "Requests over time", "type": "xy" }, "grid": { "h": 10, "w": 24, "x": 24, "y": 5 }, "type": "vis" } ], "title": "Web logs overview" } ``` #### curl ```curl curl -X POST "${KIBANA_URL}/api/dashboards" \ -H "kbn-xsrf: true" \ -H "Authorization: ApiKey ${API_KEY}" \ -H "Content-Type: application/json" \ -d '{ "panels": [ { "config": { "content": "## Web logs overview\n\n\u0026nbsp;\n\nCreated with the [Dashboards API](https://www.elastic.co/docs/api/doc/kibana) using the Kibana sample web logs dataset (\u0060kibana_sample_data_logs\u0060). Contains:\n- This markdown panel\n- 2 metrics, showing request count and average response size\n- A line chart based on an ES|QL query\n\n\u0026nbsp;\n\n\u0026nbsp;\n\n[Learn more about dashboards](https://www.elastic.co/docs/explore-analyze/dashboards)" }, "grid": { "h": 15, "w": 24, "x": 0, "y": 0 }, "type": "markdown" }, { "config": { "data_source": { "index_pattern": "kibana_sample_data_logs", "time_field": "timestamp", "type": "data_view_spec" }, "metrics": [ { "operation": "count", "type": "primary" } ], "type": "metric" }, "grid": { "h": 5, "w": 12, "x": 24, "y": 0 }, "type": "vis" }, { "config": { "data_source": { "index_pattern": "kibana_sample_data_logs", "time_field": "timestamp", "type": "data_view_spec" }, "metrics": [ { "field": "bytes", "operation": "average", "type": "primary" } ], "type": "metric" }, "grid": { "h": 5, "w": 12, "x": 36, "y": 0 }, "type": "vis" }, { "config": { "axis": { "x": { "title": { "visible": false } } }, "layers": [ { "data_source": { "query": "FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)", "type": "esql" }, "type": "line", "x": { "column": "BUCKET(@timestamp, 75, ?_tstart, ?_tend)" }, "y": [ { "column": "count" } ] } ], "title": "Requests over time", "type": "xy" }, "grid": { "h": 10, "w": 24, "x": 24, "y": 5 }, "type": "vis" } ], "title": "Web logs overview" }' ``` ## Response examples #### Create dashboard response `application/json` Response to creating a dashboard. Returns the generated ID, the full dashboard state in `data`, and metadata. Default option values are always returned even when not explicitly set in the request. Panel `id` values are generated automatically. ```json { "data": { "access_control": { "access_mode": "write_restricted" }, "options": { "auto_apply_filters": true, "hide_panel_borders": false, "hide_panel_titles": false, "sync_colors": false, "sync_cursor": true, "sync_tooltips": false, "use_margins": true }, "panels": [ { "config": { "content": "## Web logs overview" }, "grid": { "h": 15, "w": 24, "x": 0, "y": 0 }, "id": "a1b2c3d4-0001-4000-8000-000000000001", "type": "markdown" }, { "config": { "data_source": { "index_pattern": "kibana_sample_data_logs", "time_field": "timestamp", "type": "data_view_spec" }, "ignore_global_filters": false, "metrics": [ { "empty_as_null": false, "operation": "count", "type": "primary" } ], "sampling": 1, "styling": { "primary": { "labels": { "alignment": "left" }, "position": "bottom", "value": { "alignment": "right", "sizing": "auto" } } }, "title": "", "type": "metric" }, "grid": { "h": 5, "w": 12, "x": 24, "y": 0 }, "id": "a1b2c3d4-0001-4000-8000-000000000002", "type": "vis" }, { "config": { "data_source": { "index_pattern": "kibana_sample_data_logs", "time_field": "timestamp", "type": "data_view_spec" }, "ignore_global_filters": false, "metrics": [ { "field": "bytes", "operation": "average", "type": "primary" } ], "sampling": 1, "styling": { "primary": { "labels": { "alignment": "left" }, "position": "bottom", "value": { "alignment": "right", "sizing": "auto" } } }, "title": "", "type": "metric" }, "grid": { "h": 5, "w": 12, "x": 36, "y": 0 }, "id": "a1b2c3d4-0001-4000-8000-000000000003", "type": "vis" }, { "config": { "axis": { "x": { "domain": { "rounding": false, "type": "fit" }, "grid": { "visible": true }, "labels": { "orientation": "horizontal" }, "scale": "ordinal", "ticks": { "visible": true }, "title": { "visible": false } }, "y": { "anchor": "start", "domain": { "rounding": true, "type": "full" }, "grid": { "visible": true }, "labels": { "orientation": "horizontal" }, "scale": "linear", "ticks": { "visible": true }, "title": { "visible": true } } }, "layers": [ { "data_source": { "query": "FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)", "type": "esql" }, "ignore_global_filters": false, "sampling": 1, "type": "line", "x": { "column": "BUCKET(@timestamp, 75, ?_tstart, ?_tend)" }, "y": [ { "axis_id": "y", "column": "count" } ] } ], "legend": { "layout": { "truncate": { "max_lines": 1 }, "type": "grid" }, "placement": "outside", "position": "right", "visibility": "hidden" }, "styling": { "interpolation": "linear", "overlays": { "current_time_marker": { "visible": false }, "partial_buckets": { "visible": false } }, "points": { "visibility": "auto" } }, "title": "Requests over time", "type": "xy" }, "grid": { "h": 10, "w": 24, "x": 24, "y": 5 }, "id": "a1b2c3d4-0001-4000-8000-000000000003", "type": "vis" } ], "pinned_panels": [], "title": "Web logs overview" }, "id": "3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b", "meta": { "created_at": "2026-04-13T10:00:00.000Z", "managed": false, "updated_at": "2026-04-13T10:00:00.000Z", "version": "WzEwMiwxXQ==" } } ```