Get visualization
Base URL
https://{kibana_url}
Auth
Stack
9.5+
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.
Availability
Generally available since 9.5
This functionality is generally available and ready for production usage.
Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.
This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Returns a single Lens visualization by its ID.
Expand all
space_id
string optional
An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
id
string required
The visualization identifier, as returned by the create or search endpoints.
data
union anyOf required
Any of:
−
Hide 12 properties
type
enum required
Values:
metric
breakdown_by
union anyOf
Any of:
Date Histogram
Terms
Histogram
Ranges
Filters
−
Hide 9 properties
operation
enum required
Values:
date_histogram
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
columns
number · default: 3
Number of columns.
drop_partial_intervals
boolean · default: false
When true, drops partial intervals from the results.
field
string required
Field to be used for the date histogram.
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
suggested_interval
string · default: auto
Suggested time interval.
use_original_time_range
boolean · default: false
When true, uses the original time range instead of the current query time range.
−
Hide 12 properties
operation
enum required
Values:
terms
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
columns
number · default: 3
Number of columns.
excludes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to exclude.
fields
string [] · min items: 1 · max items: 4 required
format
union anyOf
Number display format for the dimension value.
Any of:
includes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to include.
increase_accuracy
boolean
When true, increases accuracy at the cost of performance.
label
string
Label for the operation
limit
number · default: 5
Number of terms to return.
other_bucket
object
+
Show 1 property
include_documents_without_field
boolean required
When true, includes documents that do not have the specified field.
rank_by
union anyOf
Any of:
Alphabetical
Rarity
Significance
Metric
Custom Operation
Custom Last Value Operation
Custom Count Operation
Percentile Operation
Percentile Rank Operation
Terms ranked alphabetically.
−
Hide 2 properties
direction
enum required
Direction
Values:
asc
desc
type
enum required
Values:
alphabetical
−
Hide 2 properties
max
number required
Maximum number of rare terms to include.
type
enum required
Values:
rare
Terms ranked by significance.
−
Hide 1 property
type
enum required
Values:
significant
Terms ranked by a linked metric.
−
Hide 3 properties
direction
enum required
Direction
Values:
asc
desc
metric_index
number · min: 0 · default: 0
Zero-based index into the metrics array identifying which metric to rank by.
type
enum required
Values:
metric
Terms ranked by custom operation.
−
Hide 4 properties
direction
enum required
Direction
Values:
asc
desc
field
string required
Numeric field to be used for the custom operation.
operation
enum required
Values:
min
max
average
median
standard_deviation
unique_count
sum
type
enum required
Values:
custom
Terms ranked by the last value of a field.
−
Hide 5 properties
direction
enum required
Direction
Values:
asc
desc
field
string required
Numeric field to be used for the custom operation.
operation
enum required
Values:
last_value
time_field
string · min length: 1
Time field used to determine document recency for the last-value ranking.
type
enum required
Values:
custom
Terms ranked by count, either of all documents or of a specific field.
−
Hide 4 properties
direction
enum required
Direction
Values:
asc
desc
field
string
Numeric field to be used for the custom operation.
operation
enum required
Values:
count
type
enum required
Values:
custom
Terms ranked by a percentile of a numeric field, for example the 95th percentile of response time.
−
Hide 5 properties
direction
enum required
Direction
Values:
asc
desc
field
string required
Numeric field to be used for the custom operation.
operation
enum required
Values:
percentile
percentile
number · default: 95
The percentile threshold (0–100) at which to compute the field value used for ranking terms.
type
enum required
Values:
custom
Terms ranked by the percentile rank of a single value: the proportion of field values at or below that value.
−
Hide 5 properties
direction
enum required
Direction
Values:
asc
desc
field
string required
Numeric field to be used for the custom operation.
operation
enum required
Values:
percentile_rank
rank
number · default: 0
The numeric value for which to compute the percentile rank (the percentage of field values at or below this value).
type
enum required
Values:
custom
−
Hide 8 properties
operation
enum required
Values:
histogram
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
columns
number · default: 3
Number of columns.
field
string required
Field to be used for the histogram.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
granularity
union number | enum · default: auto
Values:
auto
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
−
Hide 7 properties
operation
enum required
Values:
range
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
columns
number · default: 3
Number of columns.
field
string required
Field to be used for the range.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
ranges
object [] · max items: 100 required
−
Hide 3 properties
lte
number
Less than or equal to.
−
Hide 5 properties
operation
enum required
Values:
filters
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
columns
number · default: 3
Number of columns.
filters
object [] · max items: 100 required
−
Hide 2 properties
filter
object required
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
−
Hide 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
label
string
Label for the filter
label
string
Label for the operation
data_source
union oneOf required
One of:
(determined by type)
type: data_view_reference
−
Hide 2 properties
type
enum required
Values:
data_view_reference
ref_id
string required
The id of the Kibana data view to use as the data source. Example: "my-data-view".
type: data_view_spec
−
Hide 7 properties
type
enum required
Values:
data_view_spec
allow_hidden_indices
boolean
When true, allows the data view to match hidden indices.
field_filters
string [] · max items: 10000
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as user* which filters fields starting with 'user'.
field_settings
map string to anyOf
Settings for individual fields, keyed by field name. To change how Kibana displays a field from the backing indices, set its label, description, or format. To define a runtime field, use the runtime field name and set type.
<string>
union anyOf
+
Show 3 properties
Any of:
Composite runtime field
Runtime field
Field settings
−
Hide 3 properties
fields
map string to object required
<string>
object
+
Show 4 properties
custom_description
string · min length: 1
Add a description to the field. It's displayed next to the field on the Discover, Lens, and Data View Management pages.
custom_label
string · min length: 1
Create a label to display in place of the field name in Discover, Maps, Lens, Visualize, and TSVB. Useful for shortening a long field name. Queries and filters use the original field name.
format
union anyOf
Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover.
Any of:
type
enum required
The type of the runtime field (e.g., "keyword", "long", "date").
Values:
keyword
long
double
date
ip
boolean
geo_point
script
string · min length: 1
The script that defines the runtime field. This should be a painless script that computes the field value at query time. Runtime fields without a script retrieve values from _source. If the field doesn't exist in _source, a search request returns no value.
type
enum required
Values:
composite
−
Hide 5 properties
custom_description
string · min length: 1
Add a description to the field. It's displayed next to the field on the Discover, Lens, and Data View Management pages.
custom_label
string · min length: 1
Create a label to display in place of the field name in Discover, Maps, Lens, Visualize, and TSVB. Useful for shortening a long field name. Queries and filters use the original field name.
format
union anyOf
Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover.
Same options as
formatin
fields
script
string · min length: 1
The script that defines the runtime field. This should be a painless script that computes the field value at query time. Runtime fields without a script retrieve values from _source. If the field doesn't exist in _source, a search request returns no value.
type
enum required
The type of the runtime field (e.g., "keyword", "long", "date").
Values:
keyword
long
double
date
ip
boolean
geo_point
Display overrides for a field. These settings can define a custom label, description, and format.
−
Hide 3 properties
custom_description
string · min length: 1
Add a description to the field. It's displayed next to the field on the Discover, Lens, and Data View Management pages.
custom_label
string · min length: 1
Create a label to display in place of the field name in Discover, Maps, Lens, Visualize, and TSVB. Useful for shortening a long field name. Queries and filters use the original field name.
format
union anyOf
Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover.
Same options as
formatin
fields
index_pattern
string · min length: 1 required
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
name
string · min length: 1 · max length: 256
The name of the data view. Example: "Sample data view".
time_field
string
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
One of:
condition
group
dsl
spatial
A filter that evaluates a single field condition such as equality, range, or existence.
−
Hide 8 properties
type
enum required
Values:
condition
condition
union oneOf required
A filter condition with strict operator/value type matching.
One of:
(determined by operator)
is
is_one_of
range
exists
operator: is
Matches documents where field equals a single specified value.
−
Hide 4 properties
operator
enum required
Values:
is
field
string required
Name of the document field the condition evaluates.
negate
boolean
When true, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to false.
value
union string | number | boolean required
Single value to compare against the field.
operator: is_one_of
Matches documents where field equals any value in a provided list.
−
Hide 4 properties
operator
enum required
Values:
is_one_of
field
string required
Name of the document field the condition evaluates.
negate
boolean
When true, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to false.
value
union string [] | number [] | boolean [] required
Homogeneous array of values to match against the field.
operator: range
Matches documents where field falls within a specified numeric or date range.
−
Hide 4 properties
operator
enum required
Values:
range
field
string required
Name of the document field the condition evaluates.
negate
boolean
When true, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to false.
value
object required
Boundary values for a range comparison.
−
Hide 5 properties
format
string
Elasticsearch date format string applied when parsing date boundary values. For example, strict_date_optional_time or epoch_millis.
gt
number | string
Greater than.
gte
number | string
Greater than or equal to.
lt
number | string
Less than.
lte
number | string
Less than or equal to.
operator: exists
Matches documents where field exists and contains a non-null value.
−
Hide 3 properties
operator
enum required
Values:
exists
field
string required
Name of the document field the condition evaluates.
negate
boolean
When true, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to false.
controlled_by
string
Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.
data_view_id
string
Identifier of the data view used as context for this filter.
disabled
boolean
When true, the filter is inactive and does not affect query results. Defaults to false.
is_multi_index
boolean
When true, the filter can be applied across multiple indices. Defaults to false.
label
string
Human-readable label for the filter, used for display purposes.
negate
boolean
When true, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to false.
A filter that combines multiple conditions or nested groups using a logical and or or operator.
−
Hide 8 properties
type
enum required
Values:
group
controlled_by
string
Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.
data_view_id
string
Identifier of the data view used as context for this filter.
disabled
boolean
When true, the filter is inactive and does not affect query results. Defaults to false.
group
object required
Logical group that combines one or more conditions or nested groups.
−
Hide 2 properties
conditions
union anyOf [] required
Ordered list of conditions or nested groups combined by the group operator.
Any of:
operator
enum required
Logical operator applied across all entries in conditions. Use and to require all conditions, or or to require at least one.
Values:
and
or
is_multi_index
boolean
When true, the filter can be applied across multiple indices. Defaults to false.
label
string
Human-readable label for the filter, used for display purposes.
negate
boolean
When true, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to false.
A filter expressed as a raw Elasticsearch Query DSL object, used for queries that cannot be represented by condition or group filters.
−
Hide 10 properties
type
enum required
Values:
dsl
controlled_by
string
Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.
data_view_id
string
Identifier of the data view used as context for this filter.
disabled
boolean
When true, the filter is inactive and does not affect query results. Defaults to false.
dsl
map string to object required
Elasticsearch Query DSL object passed directly to the query.
field
string
Field name for scripted filters where the field cannot be extracted from the DSL query.
is_multi_index
boolean
When true, the filter can be applied across multiple indices. Defaults to false.
label
string
Human-readable label for the filter, used for display purposes.
negate
boolean
When true, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to false.
params
object
Filter parameters metadata. May contain display values, formats, and parameters for scripted filters.
A filter that applies an Elasticsearch geo query, used for geographic boundary and shape matching.
−
Hide 8 properties
type
enum required
Values:
spatial
controlled_by
string
Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.
data_view_id
string
Identifier of the data view used as context for this filter.
disabled
boolean
When true, the filter is inactive and does not affect query results. Defaults to false.
dsl
map string to object required
Elasticsearch geo query DSL object.
is_multi_index
boolean
When true, the filter can be applied across multiple indices. Defaults to false.
label
string
Human-readable label for the filter, used for display purposes.
negate
boolean
When true, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to false.
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
metrics
union anyOf [] · min items: 1 · max items: 2 required
Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric.
Any of:
−
Hide 17 properties
type
enum required
Values:
primary
apply_color_to
enum
Color target: value colors the metric text, background colors the cell or panel background.
Values:
value
background
background_chart
union anyOf
Secondary visualization displayed behind the primary metric value, either a bar chart (with optional max value) or a trend line.
Any of:
−
Hide 3 properties
type
enum required
Values:
bar
max_value
union anyOf required
Metric dimension configuration, supporting field-based aggregations (count, sum, average, median, standard deviation, unique count, last value), percentile operations, time-series operations (differences, moving average, cumulative sum, counter rate), and mathematical formulas.
Any of:
−
Hide 4 properties
operation
enum required
Values:
static_value
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
value
number · default: 100
Static value
−
Hide 7 properties
Any of:
Count Metric
Unique Count Metric
Stats Metric
Sum Metric
Last Value
Percentile
Percentile Ranks
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
unique_count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
operation
enum required
Values:
last_value
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile_rank
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
operation
enum required
Values:
differences
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Any of:
Count Metric
Unique Count Metric
Stats Metric
Sum Metric
Last Value
Percentile
Percentile Ranks
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
unique_count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
operation
enum required
Values:
last_value
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile_rank
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
operation
enum required
Values:
moving_average
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Same options as
ofin
Differences Operation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
window
number · default: 5
Window
−
Hide 8 properties
operation
enum required
Values:
cumulative_sum
field
string
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
operation
enum required
Values:
counter_rate
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
operation
enum required
Values:
count
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
operation
enum required
Values:
unique_count
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
operation
enum required
Values:
last_value
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
operation
enum required
Values:
percentile
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
operation
enum required
Values:
percentile_rank
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
orientation
enum
Orientation
Values:
horizontal
vertical
−
Hide 1 property
type
enum required
Values:
trend
color
union anyOf · default: {"type":"auto"}
Color configuration for the primary metric value or background.
Any of:
Color By Value
Static Color
Auto Color
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
−
Hide 4 properties
Any of:
Color By Value (Absolute)
Color By Value (Percentage)
Color By Value (Palette)
Legacy color by value
Color by absolute value configuration
−
Hide 3 properties
range
enum required
Values:
absolute
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
dynamic
Color by percentage value configuration
−
Hide 3 properties
range
enum required
Values:
percentage
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
dynamic
Color by value using a palette, with colors distributed across the range of values.
−
Hide 2 properties
palette
enum required
The name of the palette to apply across the value range.
Values:
status
temperature
complementary
negative
positive
cool
warm
gray
type
enum required
Values:
distributed_palette
Legacy color by value configuration
−
Hide 5 properties
palette
string required
The legacy palette name.
range
enum required
Determines whether the range is interpreted as absolute or as a percentage of the data.
Values:
absolute
percentage
shift
boolean required
When true, shifts the palette colors so they start from a different offset. Defaults to false.
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
legacy_dynamic
Fixed color for all values in the dimension.
−
Hide 2 properties
type
enum required
Values:
static
color
string required
The static color to be used for all values.
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
subtitle
string
Subtitle below the primary metric value.
Any of:
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
unique_count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
min
max
average
median
standard_deviation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
operation
enum required
Values:
last_value
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile_rank
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Same options as
ofin
Differences Operation
operation
enum required
Values:
differences
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Same options as
ofin
Differences Operation
operation
enum required
Values:
moving_average
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
window
number · default: 5
Window
−
Hide 8 properties
field
string
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
cumulative_sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
counter_rate
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 15 properties
type
enum required
Values:
secondary
color
union anyOf · default: {"type":"none"}
Any of:
Fixed color for all values in the dimension.
−
Hide 2 properties
type
enum required
Values:
static
color
string required
The static color to be used for all values.
Explicitly disables coloring
−
Hide 1 property
type
enum required
Values:
none
compare
union anyOf
Compare the secondary metric to a baseline value or to the primary metric.
Any of:
−
Hide 5 properties
to
enum required
Values:
baseline
baseline
number · default: 0
Baseline value.
icon
boolean · default: true
When true, displays the icon for the secondary value.
palette
string · default: compare_to
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
value
boolean · default: true
When true, displays the secondary value.
−
Hide 4 properties
to
enum required
Values:
primary
icon
boolean · default: true
When true, displays the icon for the secondary value.
palette
string · default: compare_to
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
value
boolean · default: true
When true, displays the secondary value.
Any of:
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
unique_count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
min
max
average
median
standard_deviation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
operation
enum required
Values:
last_value
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile_rank
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Same options as
ofin
Differences Operation
operation
enum required
Values:
differences
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Same options as
ofin
Differences Operation
operation
enum required
Values:
moving_average
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
window
number · default: 5
Window
−
Hide 8 properties
field
string
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
cumulative_sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
counter_rate
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
styling
object
Visual chart styling options
+
Show 4 properties
density
enum · default: default
Density preset for the metric chart layout. Use compact for a compact layout, or default for increased padding, element spacing, and font size.
Values:
compact
default
icon
object
Icon configuration for the metric chart
+
Show 2 properties
alignment
enum · default: right
Icon alignment. Accepted values: left, right. Defaults to right.
Values:
left
right
name
enum required
Icon name
Values:
alert
asterisk
bell
bolt
bug
compute
editor_comment
flag
globe
heart
map_marker
pin
popout
sort_down
sort_up
star_empty
tag
temperature
primary
object
+
Show 3 properties
labels
object
Labels (title and subtitle) configuration
+
Show 1 property
alignment
enum · default: left
Horizontal alignment for the title and subtitle text. Accepted values: left, center, right. Defaults to left.
Values:
left
center
right
position
enum · default: bottom
Position of the primary metric value (top, middle, or bottom).
Values:
top
middle
bottom
value
object
Primary metric value configuration
+
Show 2 properties
alignment
enum · default: right
Alignment for the primary metric value. Accepted values: left, center, right. Defaults to right.
Values:
left
center
right
sizing
enum · default: auto
Controls how the primary value text is sized within the panel. 'auto' selects a font size from predefined breakpoints based on panel height, then shrinks if the text overflows horizontally. 'fill' scales the text to be as large as possible, filling all available space.
Values:
auto
fill
secondary
object
+
Show 2 properties
label
object
+
Show 2 properties
placement
enum · default: before
How the secondary metric name is shown: before the value, after the value, or in a tooltip. Ignored when the label is not visible.
Values:
before
after
tooltip
visible
boolean · default: false
When true, displays the secondary metric name as its label.
value
object
Secondary metric value configuration
+
Show 1 property
alignment
enum · default: right
Alignment for secondary values. Accepted values: left, center, right. Defaults to right.
Values:
left
center
right
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
−
Hide 10 properties
type
enum required
Values:
legacy_metric
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
Same options as
filtersin
Metric Chart (library)
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
metric
union anyOf required
Any of:
Count Metric
Unique Count Metric
Stats Metric
Sum Metric
Last Value
Percentile
Percentile Ranks
Formula
−
Hide 14 properties
apply_color_to
enum
Color target: value colors the metric text, background colors the cell or panel background.
Values:
value
background
color
union anyOf · default: {"type":"auto"}
Color configuration based on the metric value.
Any of:
Color By Value (Absolute)
Color By Value (Palette)
Legacy color by value (absolute)
Auto Color
Color by absolute value configuration
−
Hide 3 properties
type
enum required
Values:
dynamic
range
enum required
Values:
absolute
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
Color by value using a palette, with colors distributed across the range of values.
−
Hide 2 properties
type
enum required
Values:
distributed_palette
palette
enum required
The name of the palette to apply across the value range.
Values:
status
temperature
complementary
negative
positive
cool
warm
gray
Legacy color by absolute value configuration
−
Hide 5 properties
type
enum required
Values:
legacy_dynamic
palette
string required
The legacy palette name.
range
enum required
Values:
absolute
shift
boolean required
When true, shifts the palette colors so they start from a different offset. Defaults to false.
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
labels
object
Labels configuration
+
Show 1 property
alignment
enum · default: top
Label alignment
Values:
top
bottom
size
enum · default: m
Font size for the label and value
Values:
xs
s
m
l
xl
xxl
values
object
Values configuration
+
Show 1 property
alignment
enum · default: left
Value alignment
Values:
left
center
right
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 14 properties
apply_color_to
enum
Color target: value colors the metric text, background colors the cell or panel background.
Values:
value
background
color
union anyOf · default: {"type":"auto"}
Color configuration based on the metric value.
Same options as
colorin
Count Metric Operation
labels
object
Labels configuration
+
Show 1 property
alignment
enum · default: top
Label alignment
Values:
top
bottom
size
enum · default: m
Font size for the label and value
Values:
xs
s
m
l
xl
xxl
values
object
Values configuration
+
Show 1 property
alignment
enum · default: left
Value alignment
Values:
left
center
right
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
unique_count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 13 properties
apply_color_to
enum
Color target: value colors the metric text, background colors the cell or panel background.
Values:
value
background
color
union anyOf · default: {"type":"auto"}
Color configuration based on the metric value.
Same options as
colorin
Count Metric Operation
labels
object
Labels configuration
+
Show 1 property
alignment
enum · default: top
Label alignment
Values:
top
bottom
size
enum · default: m
Font size for the label and value
Values:
xs
s
m
l
xl
xxl
values
object
Values configuration
+
Show 1 property
alignment
enum · default: left
Value alignment
Values:
left
center
right
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
min
max
average
median
standard_deviation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 14 properties
apply_color_to
enum
Color target: value colors the metric text, background colors the cell or panel background.
Values:
value
background
color
union anyOf · default: {"type":"auto"}
Color configuration based on the metric value.
Same options as
colorin
Count Metric Operation
labels
object
Labels configuration
+
Show 1 property
alignment
enum · default: top
Label alignment
Values:
top
bottom
size
enum · default: m
Font size for the label and value
Values:
xs
s
m
l
xl
xxl
values
object
Values configuration
+
Show 1 property
alignment
enum · default: left
Value alignment
Values:
left
center
right
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 15 properties
apply_color_to
enum
Color target: value colors the metric text, background colors the cell or panel background.
Values:
value
background
color
union anyOf · default: {"type":"auto"}
Color configuration based on the metric value.
Same options as
colorin
Count Metric Operation
labels
object
Labels configuration
+
Show 1 property
alignment
enum · default: top
Label alignment
Values:
top
bottom
size
enum · default: m
Font size for the label and value
Values:
xs
s
m
l
xl
xxl
values
object
Values configuration
+
Show 1 property
alignment
enum · default: left
Value alignment
Values:
left
center
right
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
operation
enum required
Values:
last_value
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 14 properties
apply_color_to
enum
Color target: value colors the metric text, background colors the cell or panel background.
Values:
value
background
color
union anyOf · default: {"type":"auto"}
Color configuration based on the metric value.
Same options as
colorin
Count Metric Operation
labels
object
Labels configuration
+
Show 1 property
alignment
enum · default: top
Label alignment
Values:
top
bottom
size
enum · default: m
Font size for the label and value
Values:
xs
s
m
l
xl
xxl
values
object
Values configuration
+
Show 1 property
alignment
enum · default: left
Value alignment
Values:
left
center
right
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 14 properties
apply_color_to
enum
Color target: value colors the metric text, background colors the cell or panel background.
Values:
value
background
color
union anyOf · default: {"type":"auto"}
Color configuration based on the metric value.
Same options as
colorin
Count Metric Operation
labels
object
Labels configuration
+
Show 1 property
alignment
enum · default: top
Label alignment
Values:
top
bottom
size
enum · default: m
Font size for the label and value
Values:
xs
s
m
l
xl
xxl
values
object
Values configuration
+
Show 1 property
alignment
enum · default: left
Value alignment
Values:
left
center
right
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile_rank
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
−
Hide 10 properties
type
enum required
Values:
xy
axis
object
Axis configuration for X, Y, and Y2 axes. The Y axis is on the start (leading) side, the Y2 axis is on the end (trailing) side.
+
Show 3 properties
x
object
X-axis configuration
+
Show 6 properties
domain
union anyOf
X-axis domain configuration
Any of:
Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion.
−
Hide 2 properties
type
enum required
Values:
fit
rounding
boolean · default: true
Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max.
Uses explicitly provided domain bounds (min and max).
−
Hide 4 properties
type
enum required
Values:
custom
max
number required
Max domain value
min
number required
Min domain value
rounding
boolean · default: true
Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max.
grid
object
Axis grid lines configuration
+
Show 1 property
visible
boolean required
Show grid lines for this axis
labels
object
Label configuration
+
Show 1 property
orientation
enum
Orientation
Values:
horizontal
vertical
angled
scale
enum
X-axis scale type. Use 'temporal' for timestamp/date fields (for example, @timestamp or DATE_TRUNC results). Use 'ordinal' for categorical/text fields. Use 'linear' for numeric fields.
Values:
ordinal
temporal
linear
ticks
object
Axis tick marks configuration
+
Show 1 property
visible
boolean required
Show tick marks on the axis
title
object
Axis title configuration
+
Show 2 properties
text
string
Axis title text.
visible
boolean
When true, displays the title.
y
object
Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts).
+
Show 6 properties
domain
union oneOf · default: {"rounding":true,"type":"full"}
Y-axis domain configuration
One of:
(determined by type)
type: full
Uses the full chart domain, including baseline expansion when applicable (for example, includes zero for bar-like series).
−
Hide 2 properties
type
enum required
Values:
full
rounding
boolean · default: true
Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max.
type: fit
Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion.
−
Hide 2 properties
type
enum required
Values:
fit
rounding
boolean · default: true
Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max.
type: custom
Uses explicitly provided domain bounds (min and max).
−
Hide 4 properties
type
enum required
Values:
custom
max
number required
Max domain value
min
number required
Min domain value
rounding
boolean · default: true
Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max.
grid
object
Axis grid lines configuration
+
Show 1 property
visible
boolean required
Show grid lines for this axis
labels
object
Label configuration
+
Show 1 property
orientation
enum
Orientation
Values:
horizontal
vertical
angled
scale
enum
Y-axis scale type for data transformation
Values:
linear
log
sqrt
ticks
object
Axis tick marks configuration
+
Show 1 property
visible
boolean required
Show tick marks on the axis
title
object
Axis title configuration
+
Show 2 properties
text
string
Axis title text.
visible
boolean
When true, displays the title.
y2
object
Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts).
+
Show 6 properties
domain
union oneOf · default: {"rounding":true,"type":"full"}
Y-axis domain configuration
One of:
(determined by type)
type: full
Uses the full chart domain, including baseline expansion when applicable (for example, includes zero for bar-like series).
−
Hide 2 properties
type
enum required
Values:
full
rounding
boolean · default: true
Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max.
type: fit
Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion.
−
Hide 2 properties
type
enum required
Values:
fit
rounding
boolean · default: true
Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max.
type: custom
Uses explicitly provided domain bounds (min and max).
−
Hide 4 properties
type
enum required
Values:
custom
max
number required
Max domain value
min
number required
Min domain value
rounding
boolean · default: true
Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max.
grid
object
Axis grid lines configuration
+
Show 1 property
visible
boolean required
Show grid lines for this axis
labels
object
Label configuration
+
Show 1 property
orientation
enum
Orientation
Values:
horizontal
vertical
angled
scale
enum
Y-axis scale type for data transformation
Values:
linear
log
sqrt
ticks
object
Axis tick marks configuration
+
Show 1 property
visible
boolean required
Show tick marks on the axis
title
object
Axis title configuration
+
Show 2 properties
text
string
Axis title text.
visible
boolean
When true, displays the title.
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
Same options as
filtersin
Metric Chart (library)
layers
union anyOf [] · min items: 1 · max items: 100 required
Chart layers
Any of:
Layer (DSL)
Reference Line Layer (DSL)
Annotation Layer (DSL)
Annotation Layer (By Reference)
Data layer for standard queries with metrics and buckets
−
Hide 7 properties
breakdown_by
union anyOf
Any of:
Date Histogram
Terms
Histogram
Ranges
Filters
−
Hide 10 properties
operation
enum required
Values:
date_histogram
aggregate_first
boolean
When true, aggregates data before splitting into series. Defaults to false.
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Any of:
Palette color assignment for specific categorical values. Unmapped values receive the unassigned color.
−
Hide 4 properties
mode
enum required
Values:
categorical
mapping
object [] · max items: 1000 required
−
Hide 2 properties
color
union anyOf required
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
values
union anyOf [] · max items: 1000 required
Any of:
string
number
boolean
Multi Value Cell
Range Key
Multi Field Key
Values of a multi-value cell.
Identifies a range bucket. Omit either bound for an open end.
−
Hide 4 properties
type
enum required
Values:
range_key
ranges
object [] · max items: 100 required
−
Hide 3 properties
Composite key from a multi-terms bucket.
−
Hide 2 properties
type
enum required
Values:
multi_field_key
keys
string [] · max items: 100 required
palette
string required
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
unassigned
union anyOf
The color to use for unassigned values.
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
Gradient color mapping across categorical values.
−
Hide 6 properties
mode
enum required
Values:
gradient
gradient
union anyOf [] · max items: 3
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
mapping
object [] · max items: 100
+
Show 1 property
values
union anyOf [] · max items: 100 required
Any of:
string
number
boolean
Multi Value Cell
Range Key
Multi Field Key
Values of a multi-value cell.
Identifies a range bucket. Omit either bound for an open end.
−
Hide 4 properties
type
enum required
Values:
range_key
ranges
object [] · max items: 100 required
+
Show 3 properties
Composite key from a multi-terms bucket.
−
Hide 2 properties
type
enum required
Values:
multi_field_key
keys
string [] · max items: 100 required
palette
string required
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
sort
enum
Sort direction
Values:
asc
desc
unassigned
union anyOf
The color to use for unassigned values.
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
drop_partial_intervals
boolean · default: false
When true, drops partial intervals from the results.
field
string required
Field to be used for the date histogram.
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
suggested_interval
string · default: auto
Suggested time interval.
use_original_time_range
boolean · default: false
When true, uses the original time range instead of the current query time range.
−
Hide 13 properties
operation
enum required
Values:
terms
aggregate_first
boolean
When true, aggregates data before splitting into series. Defaults to false.
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
excludes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to exclude.
fields
string [] · min items: 1 · max items: 4 required
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
includes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to include.
increase_accuracy
boolean
When true, increases accuracy at the cost of performance.
label
string
Label for the operation
limit
number · default: 5
Number of terms to return.
other_bucket
object
+
Show 1 property
include_documents_without_field
boolean required
When true, includes documents that do not have the specified field.
rank_by
union anyOf
Same options as
rank_byin
Terms Operation
−
Hide 9 properties
operation
enum required
Values:
histogram
aggregate_first
boolean
When true, aggregates data before splitting into series. Defaults to false.
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
field
string required
Field to be used for the histogram.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
granularity
union number | enum · default: auto
Values:
auto
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
−
Hide 8 properties
operation
enum required
Values:
range
aggregate_first
boolean
When true, aggregates data before splitting into series. Defaults to false.
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
field
string required
Field to be used for the range.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
ranges
object [] · max items: 100 required
−
Hide 3 properties
lte
number
Less than or equal to.
−
Hide 6 properties
operation
enum required
Values:
filters
aggregate_first
boolean
When true, aggregates data before splitting into series. Defaults to false.
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
filters
object [] · max items: 100 required
−
Hide 2 properties
filter
object required
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
−
Hide 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
label
string
Label for the filter
label
string
Label for the operation
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
type
enum required
Chart type for the data layer
Values:
area
area_percentage
area_stacked
bar
bar_horizontal
bar_horizontal_stacked
bar_horizontal_percentage
bar_percentage
bar_stacked
line
x
union anyOf
Any of:
Date Histogram
Terms
Histogram
Ranges
Filters
−
Hide 7 properties
operation
enum required
Values:
date_histogram
drop_partial_intervals
boolean · default: false
When true, drops partial intervals from the results.
field
string required
Field to be used for the date histogram.
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
suggested_interval
string · default: auto
Suggested time interval.
use_original_time_range
boolean · default: false
When true, uses the original time range instead of the current query time range.
−
Hide 10 properties
operation
enum required
Values:
terms
excludes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to exclude.
fields
string [] · min items: 1 · max items: 4 required
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
includes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to include.
increase_accuracy
boolean
When true, increases accuracy at the cost of performance.
label
string
Label for the operation
limit
number · default: 5
Number of terms to return.
other_bucket
object
+
Show 1 property
include_documents_without_field
boolean required
When true, includes documents that do not have the specified field.
rank_by
union anyOf
Same options as
rank_byin
Terms Operation
−
Hide 6 properties
operation
enum required
Values:
histogram
field
string required
Field to be used for the histogram.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
granularity
union number | enum · default: auto
Values:
auto
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
−
Hide 5 properties
operation
enum required
Values:
range
field
string required
Field to be used for the range.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
ranges
object [] · max items: 100 required
−
Hide 3 properties
lte
number
Less than or equal to.
−
Hide 3 properties
operation
enum required
Values:
filters
filters
object [] · max items: 100 required
−
Hide 2 properties
filter
object required
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
−
Hide 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
label
string
Label for the filter
label
string
Label for the operation
y
union anyOf [] · max items: 100 required
Array of metrics to display on Y-axis
Any of:
axis
enum · default: y
The Y axis this metric is plotted on. Values match the root axis configuration keys (axis.y, axis.y2). If omitted, defaults to the Y axis start (leading) side.
Values:
y
y2
color
union anyOf · default: {"type":"auto"}
Any of:
Fixed color for all values in the dimension.
−
Hide 2 properties
type
enum required
Values:
static
color
string required
The static color to be used for all values.
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
Reference line layer for standard queries
−
Hide 5 properties
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
thresholds
union anyOf [] · min items: 1 · max items: 100 required
Array of reference line thresholds
Any of:
axis
enum · default: y
The axis this reference line is drawn on. Values match the root axis configuration keys. If omitted, defaults to the primary Y axis.
Values:
x
y
y2
color
union anyOf · default: {"type":"auto"}
Any of:
Fixed color for all values in the dimension.
−
Hide 2 properties
type
enum required
Values:
static
color
string required
The static color to be used for all values.
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
fill
enum
Fill direction for reference line
Values:
above
below
icon
enum
Icon to display on the reference line
Values:
asterisk
alert
bell
bolt
bug
circle
editor_comment
flag
heart
map_marker
pin_filled
star_empty
star_filled
tag
triangle
position
enum
Position of the icon and label relative to the reference line
Values:
auto
left
right
stroke_dash
enum
Line style
Values:
solid
dashed
dotted
stroke_width
number · min: 1 · max: 10
Line width in pixels
text
object
Reference line text label configuration
+
Show 1 property
visible
boolean required
Show text label on the reference line
type
enum required
Values:
reference_lines
Layer containing annotations (query-based, points, and ranges)
−
Hide 4 properties
data_source
union oneOf
Same options as
data_sourcein
Metric Chart (library)
events
union anyOf [] · min items: 1 · max items: 100 required
Array of annotation configurations
Any of:
Annotation from query results matching a filter
−
Hide 10 properties
type
enum required
Values:
query
color
union anyOf · default: {"type":"auto"}
Any of:
Fixed color for all values in the dimension.
−
Hide 2 properties
type
enum required
Values:
static
color
string required
The static color to be used for all values.
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
Additional fields for annotation tooltip
icon
enum
Icon to display at the annotation point
Values:
asterisk
alert
bell
bolt
bug
circle
editor_comment
flag
heart
map_marker
pin_filled
star_empty
star_filled
tag
triangle
label
string
Label text for the annotation
line
object
Vertical line configuration for point annotation
+
Show 2 properties
stroke_dash
enum required
Vertical line style
Values:
solid
dashed
dotted
stroke_width
number · min: 1 · max: 10 required
Vertical line width in pixels
query
object required
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
−
Hide 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
text
object
Annotation text label configuration
+
Show 2 properties
field
string
Field name for text label source
visible
boolean required
Show text label on the annotation
time_field
string required
Field containing the timestamp
visible
boolean
Show the annotation
Manual point annotation at specific timestamp
−
Hide 8 properties
type
enum required
Values:
point
color
union anyOf · default: {"type":"auto"}
Any of:
Fixed color for all values in the dimension.
−
Hide 2 properties
type
enum required
Values:
static
color
string required
The static color to be used for all values.
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
icon
enum
Icon to display at the annotation point
Values:
asterisk
alert
bell
bolt
bug
circle
editor_comment
flag
heart
map_marker
pin_filled
star_empty
star_filled
tag
triangle
label
string
Label text for the annotation
line
object
Vertical line configuration for point annotation
+
Show 2 properties
stroke_dash
enum required
Vertical line style
Values:
solid
dashed
dotted
stroke_width
number · min: 1 · max: 10 required
Vertical line width in pixels
text
object
Annotation text label visibility
+
Show 1 property
visible
boolean required
Show text label on the annotation
timestamp
union number | string required
visible
boolean
Show the annotation
Manual range annotation spanning time interval
−
Hide 6 properties
type
enum required
Values:
range
color
union anyOf · default: {"type":"auto"}
Any of:
Fixed color for all values in the dimension.
−
Hide 2 properties
type
enum required
Values:
static
color
string required
The static color to be used for all values.
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
fill
enum · default: inside
Fill direction for range
Values:
inside
outside
interval
object required
Time range for annotation
−
Hide 2 properties
from
union number | string required
to
union number | string required
label
string
Label text for the annotation
visible
boolean
Show the annotation
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
type
enum required
Values:
annotations
Reference to a library annotation group
−
Hide 2 properties
group_id
string required
ID of the linked annotation group from the library
type
enum required
Values:
annotation_group
legend
union anyOf
Legend configuration for XY chart
Any of:
Outside horizontal
Outside vertical
Inside
Outside legend positioned horizontal (top/bottom) of the chart
−
Hide 6 properties
layout
union anyOf
Any of:
−
Hide 2 properties
type
enum required
Values:
grid
truncate
object
+
Show 2 properties
enabled
boolean
Enable truncation of legend items
max_lines
number · min: 1 · max: 10 · default: 1
Number of lines before legend items are truncated.
−
Hide 1 property
type
enum required
Values:
list
placement
enum
Values:
outside
position
enum
Values:
top
bottom
Legend table series header configuration.
+
Show 2 properties
statistics
enum [] · max items: 17
Statistics to display in legend
Values:
min
max
avg
median
range
last_value
last_non_null_value
first_value
first_non_null_value
difference
difference_percentage
count
total
standard_deviation
variance
distinct_count
current_and_last_value
visibility
enum
Legend visibility.
Values:
auto
visible
hidden
Outside legend positioned vertical (left/right) of the chart
−
Hide 7 properties
layout
object
+
Show 2 properties
truncate
object
+
Show 2 properties
enabled
boolean
Enable truncation of legend items
max_lines
number · min: 1 · max: 10 · default: 1
Number of lines before legend items are truncated.
type
enum required
Values:
grid
placement
enum
Values:
outside
position
enum
Values:
left
right
Legend table series header configuration.
+
Show 2 properties
size
union anyOf
Legend size.
Values:
auto
s
m
l
xl
statistics
enum [] · max items: 17
Statistics to display in legend
Values:
min
max
avg
median
range
last_value
last_non_null_value
first_value
first_non_null_value
difference
difference_percentage
count
total
standard_deviation
variance
distinct_count
current_and_last_value
visibility
enum
Legend visibility.
Values:
auto
visible
hidden
−
Hide 7 properties
columns
number · min: 1 · max: 5
Number of legend columns
layout
object
+
Show 2 properties
truncate
object
+
Show 2 properties
enabled
boolean
Enable truncation of legend items
max_lines
number · min: 1 · max: 10 · default: 1
Number of lines before legend items are truncated.
type
enum required
Values:
grid
placement
enum required
Values:
inside
position
enum
Legend position inside the chart
Values:
top_left
top_right
bottom_left
bottom_right
Legend table series header configuration.
+
Show 2 properties
statistics
enum [] · max items: 17
Statistics to display in legend
Values:
min
max
avg
median
range
last_value
last_non_null_value
first_value
first_non_null_value
difference
difference_percentage
count
total
standard_deviation
variance
distinct_count
current_and_last_value
visibility
enum
Legend visibility.
Values:
auto
visible
hidden
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
styling
object
Visual styling options for the chart
+
Show 6 properties
areas
object
Area-specific rendering settings
+
Show 2 properties
fill
enum · default: gradient
Stack
Planned
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.
Availability
Planned
We plan to add this functionality in a future Elastic Stack update. Subject to changes.
Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.
This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Area fill type: solid or gradient.
Values:
solid
gradient
fill_opacity
number · min: 0 · max: 2 · default: 0.3
Area fill opacity (0-1 typical, max 2 for legacy)
bars
object
Bar-specific rendering settings
+
Show 2 properties
data_labels
object
Data label configuration for bar series
+
Show 1 property
visible
boolean · default: false
Display value labels on bar data points
minimum_height
number · min: 0 · default: 1
Minimum bar height in pixels
fitting
object
Missing data interpolation configuration for line and area series
+
Show 3 properties
emphasize
boolean
Visually distinguish fitted segments with a dashed line style and reduced area opacity
extend
enum
How to render line and area edges when data does not cover the full X domain
Values:
none
zero
nearest
type
enum required
Fitting function type for missing data
Values:
none
zero
linear
carry
lookahead
average
nearest
interpolation
enum
Curve interpolation method for line and area series. Defaults to linear.
Values:
linear
smooth
stepped
overlays
object
Visual overlays drawn on top of the chart canvas
+
Show 2 properties
current_time_marker
object
Current time marker configuration
+
Show 1 property
visible
boolean · default: false
Show current time marker line
partial_buckets
object
Partial (incomplete) bucket indicator configuration
+
Show 1 property
visible
boolean · default: false
Show partial bucket indicators at time range edges
points
object
Data point marker settings for line and area series
+
Show 1 property
visibility
enum · default: auto
Data point marker visibility on line and area series
Values:
auto
visible
hidden
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
−
Hide 11 properties
type
enum required
Values:
gauge
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
Same options as
filtersin
Metric Chart (library)
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
metric
union anyOf required
Any of:
Count Metric
Unique Count Metric
Stats Metric
Sum Metric
Last Value
Percentile
Percentile Ranks
Formula
−
Hide 16 properties
color
union anyOf · default: {"type":"auto"}
Color configuration for the gauge fill.
Any of:
Color By Value
No Color
Auto Color
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
−
Hide 4 properties
Any of:
Color By Value (Absolute)
Color By Value (Percentage)
Color By Value (Palette)
Legacy color by value
Color by absolute value configuration
−
Hide 3 properties
range
enum required
Values:
absolute
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
dynamic
Color by percentage value configuration
−
Hide 3 properties
range
enum required
Values:
percentage
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
dynamic
Color by value using a palette, with colors distributed across the range of values.
−
Hide 2 properties
palette
enum required
The name of the palette to apply across the value range.
Values:
status
temperature
complementary
negative
positive
cool
warm
gray
type
enum required
Values:
distributed_palette
Legacy color by value configuration
−
Hide 5 properties
palette
string required
The legacy palette name.
range
enum required
Determines whether the range is interpreted as absolute or as a percentage of the data.
Values:
absolute
percentage
shift
boolean required
When true, shifts the palette colors so they start from a different offset. Defaults to false.
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
legacy_dynamic
Explicitly disables coloring
−
Hide 1 property
type
enum required
Values:
none
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
goal
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Any of:
Field Metric Operations
Static Operation Definition
Formula Operation
−
Hide 7 properties
Any of:
Count Metric
Unique Count Metric
Stats Metric
Sum Metric
Last Value
Percentile
Percentile Ranks
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
unique_count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
operation
enum required
Values:
last_value
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile_rank
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 4 properties
operation
enum required
Values:
static_value
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
value
number · default: 100
Static value
max
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
min
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
subtitle
string
Subtitle below the gauge value.
ticks
object
Ticks configuration
+
Show 2 properties
mode
enum · default: bands
Tick placement mode.
Values:
auto
bands
visible
boolean · default: true
When true, displays tick marks on the gauge.
title
object
Title configuration
+
Show 2 properties
visible
boolean · default: true
When true, displays the title.
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 16 properties
color
union anyOf · default: {"type":"auto"}
Color configuration for the gauge fill.
Same options as
colorin
Count Metric Operation
goal
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
max
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
min
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
subtitle
string
Subtitle below the gauge value.
ticks
object
Ticks configuration
+
Show 2 properties
mode
enum · default: bands
Tick placement mode.
Values:
auto
bands
visible
boolean · default: true
When true, displays tick marks on the gauge.
title
object
Title configuration
+
Show 2 properties
visible
boolean · default: true
When true, displays the title.
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
unique_count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 15 properties
color
union anyOf · default: {"type":"auto"}
Color configuration for the gauge fill.
Same options as
colorin
Count Metric Operation
goal
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
max
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
min
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
subtitle
string
Subtitle below the gauge value.
ticks
object
Ticks configuration
+
Show 2 properties
mode
enum · default: bands
Tick placement mode.
Values:
auto
bands
visible
boolean · default: true
When true, displays tick marks on the gauge.
title
object
Title configuration
+
Show 2 properties
visible
boolean · default: true
When true, displays the title.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
min
max
average
median
standard_deviation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 16 properties
color
union anyOf · default: {"type":"auto"}
Color configuration for the gauge fill.
Same options as
colorin
Count Metric Operation
goal
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
max
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
min
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
subtitle
string
Subtitle below the gauge value.
ticks
object
Ticks configuration
+
Show 2 properties
mode
enum · default: bands
Tick placement mode.
Values:
auto
bands
visible
boolean · default: true
When true, displays tick marks on the gauge.
title
object
Title configuration
+
Show 2 properties
visible
boolean · default: true
When true, displays the title.
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 17 properties
color
union anyOf · default: {"type":"auto"}
Color configuration for the gauge fill.
Same options as
colorin
Count Metric Operation
goal
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
max
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
min
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
subtitle
string
Subtitle below the gauge value.
ticks
object
Ticks configuration
+
Show 2 properties
mode
enum · default: bands
Tick placement mode.
Values:
auto
bands
visible
boolean · default: true
When true, displays tick marks on the gauge.
title
object
Title configuration
+
Show 2 properties
visible
boolean · default: true
When true, displays the title.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
operation
enum required
Values:
last_value
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 16 properties
color
union anyOf · default: {"type":"auto"}
Color configuration for the gauge fill.
Same options as
colorin
Count Metric Operation
goal
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
max
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
min
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
subtitle
string
Subtitle below the gauge value.
ticks
object
Ticks configuration
+
Show 2 properties
mode
enum · default: bands
Tick placement mode.
Values:
auto
bands
visible
boolean · default: true
When true, displays tick marks on the gauge.
title
object
Title configuration
+
Show 2 properties
visible
boolean · default: true
When true, displays the title.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 16 properties
color
union anyOf · default: {"type":"auto"}
Color configuration for the gauge fill.
Same options as
colorin
Count Metric Operation
goal
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
max
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
min
union anyOf
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
Same options as
goalin
Count Metric Operation
subtitle
string
Subtitle below the gauge value.
ticks
object
Ticks configuration
+
Show 2 properties
mode
enum · default: bands
Tick placement mode.
Values:
auto
bands
visible
boolean · default: true
When true, displays tick marks on the gauge.
title
object
Title configuration
+
Show 2 properties
visible
boolean · default: true
When true, displays the title.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile_rank
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
styling
object
Visual chart styling options
+
Show 1 property
shape
union anyOf
Default:
{"orientation":"horizontal","type":"bullet"}
Any of:
−
Hide 2 properties
orientation
enum
Orientation
Values:
horizontal
vertical
type
enum required
Values:
bullet
−
Hide 1 property
type
enum required
Values:
circle
semi_circle
arc
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
−
Hide 15 properties
type
enum required
Values:
heatmap
axis
object
Axis configuration for X and Y axes
+
Show 2 properties
x
object
X axis configuration
+
Show 4 properties
labels
object
+
Show 2 properties
orientation
enum
Orientation
Values:
horizontal
vertical
angled
visible
boolean · default: true
Show axis labels
scale
enum required
X-axis scale type. Use 'temporal' for timestamp/date fields (for example, @timestamp or DATE_TRUNC results). Use 'ordinal' for categorical/text fields. Use 'linear' for numeric fields.
Values:
ordinal
temporal
linear
sort
enum
Axis sort order; omit or use undefined for no sorting
Values:
asc
desc
title
object
+
Show 2 properties
text
string
Axis title text.
visible
boolean
When true, displays the title.
y
object
Y axis configuration
+
Show 3 properties
labels
object
+
Show 1 property
visible
boolean · default: true
Show axis labels
sort
enum
Axis sort order; omit or use undefined for no sorting
Values:
asc
desc
title
object
+
Show 2 properties
text
string
Axis title text.
visible
boolean
When true, displays the title.
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
Same options as
filtersin
Metric Chart (library)
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
legend
object
Legend configuration
+
Show 4 properties
position
enum
Values:
top
bottom
left
right
size
union anyOf
Legend size.
Values:
auto
s
m
l
xl
truncate_after_lines
number · min: 1 · max: 10 · default: 1
Number of lines before legend items are truncated.
visibility
enum
Legend visibility.
Values:
visible
hidden
metric
union anyOf required
Any of:
−
Hide 10 properties
color
union anyOf · default: {"type":"auto"}
Color scale configuration for the heatmap cells.
Any of:
Color By Value
Auto Color
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
−
Hide 4 properties
Any of:
Color By Value (Absolute)
Color By Value (Percentage)
Color By Value (Palette)
Legacy color by value
Color by absolute value configuration
−
Hide 3 properties
range
enum required
Values:
absolute
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
dynamic
Color by percentage value configuration
−
Hide 3 properties
range
enum required
Values:
percentage
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
dynamic
Color by value using a palette, with colors distributed across the range of values.
−
Hide 2 properties
palette
enum required
The name of the palette to apply across the value range.
Values:
status
temperature
complementary
negative
positive
cool
warm
gray
type
enum required
Values:
distributed_palette
Legacy color by value configuration
−
Hide 5 properties
palette
string required
The legacy palette name.
range
enum required
Determines whether the range is interpreted as absolute or as a percentage of the data.
Values:
absolute
percentage
shift
boolean required
When true, shifts the palette colors so they start from a different offset. Defaults to false.
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
legacy_dynamic
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
color
union anyOf · default: {"type":"auto"}
Color scale configuration for the heatmap cells.
Same options as
colorin
Count Metric Operation
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
unique_count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
color
union anyOf · default: {"type":"auto"}
Color scale configuration for the heatmap cells.
Same options as
colorin
Count Metric Operation
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
min
max
average
median
standard_deviation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
color
union anyOf · default: {"type":"auto"}
Color scale configuration for the heatmap cells.
Same options as
colorin
Count Metric Operation
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 11 properties
color
union anyOf · default: {"type":"auto"}
Color scale configuration for the heatmap cells.
Same options as
colorin
Count Metric Operation
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
operation
enum required
Values:
last_value
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
color
union anyOf · default: {"type":"auto"}
Color scale configuration for the heatmap cells.
Same options as
colorin
Count Metric Operation
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
color
union anyOf · default: {"type":"auto"}
Color scale configuration for the heatmap cells.
Same options as
colorin
Count Metric Operation
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile_rank
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
color
union anyOf · default: {"type":"auto"}
Color scale configuration for the heatmap cells.
Same options as
colorin
Count Metric Operation
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Same options as
ofin
Differences Operation
operation
enum required
Values:
differences
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
color
union anyOf · default: {"type":"auto"}
Color scale configuration for the heatmap cells.
Same options as
colorin
Count Metric Operation
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Same options as
ofin
Differences Operation
operation
enum required
Values:
moving_average
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
window
number · default: 5
Window
−
Hide 9 properties
color
union anyOf · default: {"type":"auto"}
Color scale configuration for the heatmap cells.
Same options as
colorin
Count Metric Operation
field
string
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
cumulative_sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
color
union anyOf · default: {"type":"auto"}
Color scale configuration for the heatmap cells.
Same options as
colorin
Count Metric Operation
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
counter_rate
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
styling
object
Visual chart styling options
+
Show 1 property
cells
object
Cells configuration
+
Show 1 property
labels
object
+
Show 1 property
visible
boolean · default: false
Show cell labels
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
x
union anyOf required
Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.
Any of:
Date Histogram
Terms
Histogram
Ranges
Filters
−
Hide 7 properties
operation
enum required
Values:
date_histogram
drop_partial_intervals
boolean · default: false
When true, drops partial intervals from the results.
field
string required
Field to be used for the date histogram.
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
suggested_interval
string · default: auto
Suggested time interval.
use_original_time_range
boolean · default: false
When true, uses the original time range instead of the current query time range.
−
Hide 10 properties
operation
enum required
Values:
terms
excludes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to exclude.
fields
string [] · min items: 1 · max items: 4 required
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
includes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to include.
increase_accuracy
boolean
When true, increases accuracy at the cost of performance.
label
string
Label for the operation
limit
number · default: 5
Number of terms to return.
other_bucket
object
+
Show 1 property
include_documents_without_field
boolean required
When true, includes documents that do not have the specified field.
rank_by
union anyOf
Same options as
rank_byin
Terms Operation
−
Hide 6 properties
operation
enum required
Values:
histogram
field
string required
Field to be used for the histogram.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
granularity
union number | enum · default: auto
Values:
auto
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
−
Hide 5 properties
operation
enum required
Values:
range
field
string required
Field to be used for the range.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
ranges
object [] · max items: 100 required
−
Hide 3 properties
lte
number
Less than or equal to.
−
Hide 3 properties
operation
enum required
Values:
filters
filters
object [] · max items: 100 required
−
Hide 2 properties
filter
object required
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
−
Hide 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
label
string
Label for the filter
label
string
Label for the operation
y
union anyOf
Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.
Same options as
xin
Heatmap Chart (library)
−
Hide 12 properties
type
enum required
Values:
tag_cloud
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
Same options as
filtersin
Metric Chart (library)
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
metric
union anyOf required
Any of:
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
unique_count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
min
max
average
median
standard_deviation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
operation
enum required
Values:
last_value
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile_rank
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Same options as
ofin
Differences Operation
operation
enum required
Values:
differences
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Same options as
ofin
Differences Operation
operation
enum required
Values:
moving_average
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
window
number · default: 5
Window
−
Hide 8 properties
field
string
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
cumulative_sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
counter_rate
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
styling
object
Visual chart styling options
+
Show 3 properties
caption
object
Caption configuration representing the metric and the tag_by operations labels
+
Show 1 property
visible
boolean · default: true
When true, displays the caption.
font_size
object
Font size range for tags.
+
Show 2 properties
max
number · max: 120 · default: 72
Maximum font size.
min
number · min: 1 · default: 18
Minimum font size.
orientation
enum
Orientation
Values:
horizontal
vertical
angled
tag_by
union anyOf required
Any of:
Date Histogram
Terms
Histogram
Ranges
Filters
−
Hide 8 properties
operation
enum required
Values:
date_histogram
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
drop_partial_intervals
boolean · default: false
When true, drops partial intervals from the results.
field
string required
Field to be used for the date histogram.
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
suggested_interval
string · default: auto
Suggested time interval.
use_original_time_range
boolean · default: false
When true, uses the original time range instead of the current query time range.
−
Hide 11 properties
operation
enum required
Values:
terms
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
excludes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to exclude.
fields
string [] · min items: 1 · max items: 4 required
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
includes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to include.
increase_accuracy
boolean
When true, increases accuracy at the cost of performance.
label
string
Label for the operation
limit
number · default: 5
Number of terms to return.
other_bucket
object
+
Show 1 property
include_documents_without_field
boolean required
When true, includes documents that do not have the specified field.
rank_by
union anyOf
Same options as
rank_byin
Terms Operation
−
Hide 7 properties
operation
enum required
Values:
histogram
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
field
string required
Field to be used for the histogram.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
granularity
union number | enum · default: auto
Values:
auto
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
−
Hide 6 properties
operation
enum required
Values:
range
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
field
string required
Field to be used for the range.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
ranges
object [] · max items: 100 required
−
Hide 3 properties
lte
number
Less than or equal to.
−
Hide 4 properties
operation
enum required
Values:
filters
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
filters
object [] · max items: 100 required
−
Hide 2 properties
filter
object required
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
−
Hide 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
label
string
Label for the filter
label
string
Label for the operation
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
−
Hide 11 properties
type
enum required
Values:
region_map
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
Same options as
filtersin
Metric Chart (library)
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
metric
union anyOf required
Metric dimension using a field-based aggregation or a mathematical formula.
Any of:
Field Metric Operations
Formula Operation
−
Hide 7 properties
Any of:
Count Metric
Unique Count Metric
Stats Metric
Sum Metric
Last Value
Percentile
Percentile Ranks
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
unique_count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
operation
enum required
Values:
last_value
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile_rank
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
region
union anyOf required
Any of:
Date Histogram
Terms
Histogram
Ranges
Filters
−
Hide 8 properties
operation
enum required
Values:
date_histogram
ems
object
+
Show 2 properties
boundaries
string required
EMS boundaries
join
string required
EMS join field
drop_partial_intervals
boolean · default: false
When true, drops partial intervals from the results.
field
string required
Field to be used for the date histogram.
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
suggested_interval
string · default: auto
Suggested time interval.
use_original_time_range
boolean · default: false
When true, uses the original time range instead of the current query time range.
−
Hide 11 properties
operation
enum required
Values:
terms
ems
object
+
Show 2 properties
boundaries
string required
EMS boundaries
join
string required
EMS join field
excludes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to exclude.
fields
string [] · min items: 1 · max items: 4 required
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
includes
object
+
Show 2 properties
as_regex
boolean
When true, treats the values as regular expressions.
values
union string [] | number [] required
Values to include.
increase_accuracy
boolean
When true, increases accuracy at the cost of performance.
label
string
Label for the operation
limit
number · default: 5
Number of terms to return.
other_bucket
object
+
Show 1 property
include_documents_without_field
boolean required
When true, includes documents that do not have the specified field.
rank_by
union anyOf
Same options as
rank_byin
Terms Operation
−
Hide 7 properties
operation
enum required
Values:
histogram
ems
object
+
Show 2 properties
boundaries
string required
EMS boundaries
join
string required
EMS join field
field
string required
Field to be used for the histogram.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
granularity
union number | enum · default: auto
Values:
auto
include_empty_rows
boolean · default: true
When true, includes empty rows in the results.
label
string
Label for the operation
−
Hide 6 properties
operation
enum required
Values:
range
ems
object
+
Show 2 properties
boundaries
string required
EMS boundaries
join
string required
EMS join field
field
string required
Field to be used for the range.
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
ranges
object [] · max items: 100 required
−
Hide 3 properties
lte
number
Less than or equal to.
−
Hide 4 properties
operation
enum required
Values:
filters
ems
object
+
Show 2 properties
boundaries
string required
EMS boundaries
join
string required
EMS join field
filters
object [] · max items: 100 required
−
Hide 2 properties
filter
object required
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
−
Hide 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
label
string
Label for the filter
label
string
Label for the operation
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
−
Hide 13 properties
type
enum required
Values:
data_table
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
Same options as
filtersin
Metric Chart (library)
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
metrics
union anyOf [] · min items: 1 · max items: 1000 required
Array of metrics to display as columns in the datatable
Any of:
alignment
enum · default: right
Alignment of the columns.
Values:
left
center
right
apply_color_to
enum
Column color target: value for cell text, background for cell background, or badge for a badge overlay.
Values:
value
background
badge
color
union anyOf · default: {"type":"auto"}
Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.
Any of:
Color By Value
Color Mapping
Auto Color
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
−
Hide 4 properties
Any of:
Color By Value (Absolute)
Color By Value (Percentage)
Color By Value (Palette)
Legacy color by value
Color by absolute value configuration
−
Hide 3 properties
range
enum required
Values:
absolute
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
dynamic
Color by percentage value configuration
−
Hide 3 properties
range
enum required
Values:
percentage
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
dynamic
Color by value using a palette, with colors distributed across the range of values.
−
Hide 2 properties
palette
enum required
The name of the palette to apply across the value range.
Values:
status
temperature
complementary
negative
positive
cool
warm
gray
type
enum required
Values:
distributed_palette
Legacy color by value configuration
−
Hide 5 properties
palette
string required
The legacy palette name.
range
enum required
Determines whether the range is interpreted as absolute or as a percentage of the data.
Values:
absolute
percentage
shift
boolean required
When true, shifts the palette colors so they start from a different offset. Defaults to false.
steps
object [] · min items: 1 · max items: 100 required
Array of ordered color steps defining the range each color is applied.
−
Hide 4 properties
color
string required
The color to use for this step.
gte
number nullable
The lower bound of range from which this color applies (inclusive).
lt
number nullable
The upper bound of range to which this color applies (exclusive).
lte
number nullable
The upper bound of range to which this color applies (inclusive).
type
enum required
Values:
legacy_dynamic
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
−
Hide 2 properties
Any of:
Palette color assignment for specific categorical values. Unmapped values receive the unassigned color.
−
Hide 4 properties
mode
enum required
Values:
categorical
mapping
object [] · max items: 1000 required
−
Hide 2 properties
color
union anyOf required
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
values
union anyOf [] · max items: 1000 required
Any of:
string
number
boolean
Multi Value Cell
Range Key
Multi Field Key
Values of a multi-value cell.
Identifies a range bucket. Omit either bound for an open end.
−
Hide 4 properties
type
enum required
Values:
range_key
ranges
object [] · max items: 100 required
−
Hide 3 properties
Composite key from a multi-terms bucket.
−
Hide 2 properties
type
enum required
Values:
multi_field_key
keys
string [] · max items: 100 required
palette
string required
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
unassigned
union anyOf
The color to use for unassigned values.
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
Gradient color mapping across categorical values.
−
Hide 6 properties
mode
enum required
Values:
gradient
gradient
union anyOf [] · max items: 3
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
mapping
object [] · max items: 100
+
Show 1 property
values
union anyOf [] · max items: 100 required
Any of:
string
number
boolean
Multi Value Cell
Range Key
Multi Field Key
Values of a multi-value cell.
Identifies a range bucket. Omit either bound for an open end.
−
Hide 4 properties
type
enum required
Values:
range_key
ranges
object [] · max items: 100 required
+
Show 3 properties
Composite key from a multi-terms bucket.
−
Hide 2 properties
type
enum required
Values:
multi_field_key
keys
string [] · max items: 100 required
palette
string required
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
sort
enum
Sort direction
Values:
asc
desc
unassigned
union anyOf
The color to use for unassigned values.
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
summary
object
Summary row configuration
+
Show 2 properties
label
string
Summary row label.
type
enum required
Type of summary function to apply to the column.
Values:
sum
avg
count
min
max
visible
boolean · default: true
When false, hides the column from the datatable.
width
number · min: 0
Column width in pixels.
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
rows
union anyOf [] · min items: 1 · max items: 50
Array of operations to split the datatable rows by
Any of:
alignment
enum · default: left
Alignment of the rows.
Values:
left
center
right
apply_color_to
enum
Column color target: value for cell text, background for cell background, or badge for a badge overlay.
Values:
value
background
badge
click_filter
boolean · default: false
When true, enables one-click filtering on cell values.
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
color
union anyOf · default: {"type":"auto"}
Any of:
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
−
Hide 2 properties
Any of:
Palette color assignment for specific categorical values. Unmapped values receive the unassigned color.
−
Hide 4 properties
mode
enum required
Values:
categorical
mapping
object [] · max items: 1000 required
−
Hide 2 properties
color
union anyOf required
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
values
union anyOf [] · max items: 1000 required
Any of:
string
number
boolean
Multi Value Cell
Range Key
Multi Field Key
Values of a multi-value cell.
Identifies a range bucket. Omit either bound for an open end.
−
Hide 4 properties
type
enum required
Values:
range_key
ranges
object [] · max items: 100 required
−
Hide 3 properties
Composite key from a multi-terms bucket.
−
Hide 2 properties
type
enum required
Values:
multi_field_key
keys
string [] · max items: 100 required
palette
string required
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
unassigned
union anyOf
The color to use for unassigned values.
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
Gradient color mapping across categorical values.
−
Hide 6 properties
mode
enum required
Values:
gradient
gradient
union anyOf [] · max items: 3
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
mapping
object [] · max items: 100
+
Show 1 property
values
union anyOf [] · max items: 100 required
Any of:
string
number
boolean
Multi Value Cell
Range Key
Multi Field Key
Values of a multi-value cell.
Identifies a range bucket. Omit either bound for an open end.
−
Hide 4 properties
type
enum required
Values:
range_key
ranges
object [] · max items: 100 required
+
Show 3 properties
Composite key from a multi-terms bucket.
−
Hide 2 properties
type
enum required
Values:
multi_field_key
keys
string [] · max items: 100 required
palette
string required
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
sort
enum
Sort direction
Values:
asc
desc
unassigned
union anyOf
The color to use for unassigned values.
Any of:
Color at a fixed index position in a named palette.
−
Hide 3 properties
type
enum required
Values:
from_palette
index
number required
The index of the color in the palette.
palette
string
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to default.
A color specified as a hex or CSS color code string.
−
Hide 2 properties
type
enum required
Values:
color_code
value
string required
The static color value to use.
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
visible
boolean · default: true
When false, hides the column from the datatable.
width
number · min: 0
Column width in pixels.
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
split_metrics_by
union anyOf [] · min items: 1 · max items: 20
Array of operations to split the metric columns by
Same options as
xin
Heatmap Chart (library)
styling
object
Visual chart styling options
+
Show 4 properties
density
object
Density configuration for the datatable.
+
Show 2 properties
height
object
+
Show 2 properties
Number of lines before the header is truncated.
Any of:
value
union anyOf
Number of lines to display per table body cell.
Any of:
−
Hide 1 property
type
enum required
Values:
auto
−
Hide 2 properties
type
enum required
Values:
custom
lines
number · min: 1 · max: 20 · default: 1
mode
enum · default: default
Display density mode.
Values:
compact
default
expanded
paging
enum
Rows per page. When set, pagination is enabled with the specified number of rows.
Values:
10
20
30
50
100
row_numbers
object
Configuration for row numbers
+
Show 1 property
visible
boolean required
When true, displays row numbers.
sort_by
union anyOf
Sorting configuration. Only one column can be sorted at a time. Use "column_type" to specify the column type.
Any of:
object
column_type: pivoted_metric
Sort by a metric or row column
−
Hide 3 properties
column_type
enum required
Type of column to sort by.
Values:
metric
row
direction
enum required
Direction
Values:
asc
desc
index
number · min: 0 required
Index of the column or row to sort by (0-based).
Sort by a pivoted metric column (created when metrics are pivoted by split_metrics_by)
−
Hide 4 properties
column_type
enum required
Values:
pivoted_metric
direction
enum required
Direction
Values:
asc
desc
index
number · min: 0 required
0-based index into the "metrics" array for the metric to sort; use "values" to identify the pivoted column
values
string [] · min items: 1 · max items: 20 required
Array of pivot values, one for each split_metrics_by column in order
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
−
Hide 13 properties
type
enum required
Values:
pie
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
Same options as
filtersin
Metric Chart (library)
group_by
union anyOf [] · min items: 1 · max items: 100
Array of breakdown dimensions (minimum 1)
Any of:
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
legend
object
Legend configuration for pie chart
+
Show 5 properties
nested
boolean · default: false
Show nested legend with hierarchical breakdown levels
position
enum · default: right
Legend Position.
Values:
top
bottom
left
right
size
union anyOf
Legend size.
Values:
auto
s
m
l
xl
truncate_after_lines
number · min: 1 · max: 10 · default: 1
Number of lines before legend items are truncated.
visibility
enum
Legend visibility.
Values:
auto
visible
hidden
metrics
union anyOf [] · min items: 1 · max items: 100 required
Array of metric configurations (minimum 1)
Any of:
color
union anyOf · default: {"type":"auto"}
Any of:
Fixed color for all values in the dimension.
−
Hide 2 properties
type
enum required
Values:
static
color
string required
The static color to be used for all values.
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
styling
object
Visual chart styling options
+
Show 3 properties
donut_hole
enum
Donut hole size. Accepted values: none (full pie), s, m, l.
Values:
none
s
m
l
labels
object
Label configuration for pie chart slice labels inside or outside the pie
+
Show 2 properties
position
enum
Slice label position: inside or outside.
Values:
inside
outside
visible
boolean
When true, displays slice labels.
values
object
Configure the visibility and the format of the values rendered on each chart partition section
+
Show 3 properties
mode
enum
How to format values when visible.
Values:
absolute
percentage
percent_decimals
number · min: 0 · max: 10 · default: 2
Decimal places for percentage display (0-10)
visible
boolean
Show metric values on the chart
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
−
Hide 14 properties
type
enum required
Values:
mosaic
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
Same options as
filtersin
Metric Chart (library)
group_breakdown_by
union anyOf [] · min items: 1 · max items: 100
Array of group breakdown dimensions (minimum 1)
Any of:
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
group_by
union anyOf [] · min items: 1 · max items: 100
Array of breakdown dimensions (minimum 1)
Any of:
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
legend
object
Legend configuration for mosaic chart appearance and behavior
+
Show 5 properties
nested
boolean · default: false
Show nested legend with hierarchical breakdown levels
position
enum · default: right
Legend Position.
Values:
top
bottom
left
right
size
union anyOf
Legend size.
Values:
auto
s
m
l
xl
truncate_after_lines
number · min: 1 · max: 10 · default: 1
Number of lines before legend items are truncated.
visibility
enum
Legend visibility.
Values:
auto
visible
hidden
metric
union anyOf required
Any of:
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
unique_count
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
min
max
average
median
standard_deviation
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
empty_as_null
boolean · default: false
When true, treats empty buckets as null instead of zero.
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 10 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
multi_value
boolean · default: false
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
operation
enum required
Values:
last_value
reduced_time_range
string
Reduced time range
time_field
string required
Time field used to determine document recency
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile
percentile
number · default: 95
Percentile
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
percentile_rank
rank
number · default: 0
Percentile Rank
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Same options as
ofin
Differences Operation
operation
enum required
Values:
differences
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 9 properties
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
of
union anyOf required
Same options as
ofin
Differences Operation
operation
enum required
Values:
moving_average
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
window
number · default: 5
Window
−
Hide 8 properties
field
string
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
cumulative_sum
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
−
Hide 8 properties
field
string required
Field to be used for the metric
filter
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
format
union anyOf
Number display format for the dimension value.
Same options as
formatin
Terms Operation
label
string
Label for the operation
operation
enum required
Values:
counter_rate
reduced_time_range
string
Reduced time range
time_scale
union anyOf
Time scale
Values:
s
m
h
d
time_shift
string
Time shift
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
styling
object
Visual chart styling options
+
Show 1 property
values
object
Configure the visibility and the format of the values rendered on each chart partition section
+
Show 3 properties
mode
enum
How to format values when visible.
Values:
absolute
percentage
percent_decimals
number · min: 0 · max: 10 · default: 2
Decimal places for percentage display (0-10)
visible
boolean
Show metric values on the chart
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
−
Hide 13 properties
type
enum required
Values:
treemap
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
Same options as
filtersin
Metric Chart (library)
group_by
union anyOf [] · min items: 1 · max items: 100
Array of breakdown dimensions (minimum 1)
Any of:
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
legend
object
Configuration for the treemap chart legend appearance and behavior
+
Show 5 properties
nested
boolean · default: false
Show nested legend with hierarchical breakdown levels
position
enum · default: right
Legend Position.
Values:
top
bottom
left
right
size
union anyOf
Legend size.
Values:
auto
s
m
l
xl
truncate_after_lines
number · min: 1 · max: 10 · default: 1
Number of lines before legend items are truncated.
visibility
enum
Legend visibility.
Values:
auto
visible
hidden
metrics
union anyOf [] · min items: 1 · max items: 100 required
Array of metric configurations (minimum 1)
Any of:
color
union anyOf · default: {"type":"auto"}
Any of:
Fixed color for all values in the dimension.
−
Hide 2 properties
type
enum required
Values:
static
color
string required
The static color to be used for all values.
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
styling
object
Visual chart styling options
+
Show 2 properties
labels
object
Labels configuration
+
Show 1 property
visible
boolean
Show category labels
values
object
Configure the visibility and the format of the values rendered on each chart partition section
+
Show 3 properties
mode
enum
How to format values when visible.
Values:
absolute
percentage
percent_decimals
number · min: 0 · max: 10 · default: 2
Decimal places for percentage display (0-10)
visible
boolean
Show metric values on the chart
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
−
Hide 13 properties
type
enum required
Values:
waffle
data_source
union oneOf required
Same options as
data_sourcein
Metric Chart (library)
description
string
The description of the chart. Optional. Any string value or undefined.
filters
union oneOf [] · max items: 100
Filters applied to the panel
Same options as
filtersin
Metric Chart (library)
group_by
union anyOf [] · min items: 1 · max items: 100
Array of breakdown dimensions (minimum 1)
Any of:
collapse_by
union anyOf
Aggregation function used to collapse a breakdown dimension into a single value.
Values:
avg
sum
max
min
color
union anyOf
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Default:
{"mapping":[],"mode":"categorical","palette":"default"}
Same options as
colorin
Date Histogram Operation
ignore_global_filters
boolean · default: false
When true, ignores global filters when fetching data for this layer. Defaults to false.
legend
object
Legend configuration for waffle chart
+
Show 5 properties
position
enum · default: right
Legend Position.
Values:
top
bottom
left
right
size
union anyOf
Legend size.
Values:
auto
s
m
l
xl
truncate_after_lines
number · min: 1 · max: 10 · default: 1
Number of lines before legend items are truncated.
values
enum [] · min items: 1 · max items: 1
Values:
absolute
visibility
enum
Legend visibility.
Values:
auto
visible
hidden
metrics
union anyOf [] · min items: 1 · max items: 100 required
Array of metric configurations (minimum 1)
Any of:
color
union anyOf · default: {"type":"auto"}
Any of:
Fixed color for all values in the dimension.
−
Hide 2 properties
type
enum required
Values:
static
color
string required
The static color to be used for all values.
Coloring determined at runtime based on chart defaults
−
Hide 1 property
type
enum required
Values:
auto
query
object
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
+
Show 2 properties
expression
string required
A query expression in KQL or Lucene syntax
language
enum · default: kql
Query language: kql (Kibana Query Language) or lucene. Defaults to kql.
Values:
kql
lucene
sampling
number · min: 0 · max: 1 · default: 1
Sampling factor between 0 (no sampling) and 1 (full sampling).
styling
object
Visual chart styling options
+
Show 1 property
values
object
Configure the visibility and the format of the values rendered on each chart partition section
+
Show 3 properties
mode
enum
How to format values when visible.
Values:
absolute
percentage
percent_decimals
number · min: 0 · max: 10 · default: 2
Decimal places for percentage display (0-10)
visible
boolean
Show metric values on the chart
tags
string [] · max items: 1000 · default: []
Tag IDs to associate with this visualization.
title
string
The title of the chart displayed in the panel. Optional. Any string value or undefined.
meta
object required
−
Hide 7 properties
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Request
Console
1 / 2 languages
‹
›
1
GET kbn:/api/visualizations/1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d
1
2
curl -X GET "${KIBANA_URL}/api/visualizations/1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d" \
-H "Authorization: ApiKey ${API_KEY}"
Response
The full visualization state including the chart configuration and metadata.
Show more
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
{
"data": {
"data_source": {
"index_pattern": "kibana_sample_data_logs",
"time_field": "timestamp",
"type": "data_view_spec"
},
"ignore_global_filters": false,
"metrics": [
{
"empty_as_null": false,
"operation": "count",
"type": "primary"
}
],
"sampling": 1,
"styling": {
"primary": {
"labels": {
"alignment": "left"
},
"position": "bottom",
"value": {
"alignment": "right",
"sizing": "auto"
}
}
},
"tags": [],
"title": "Total requests",
"type": "metric"
},
"id": "1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d",
"meta": {
"created_at": "2026-04-13T10:00:00.000Z",
"managed": false,
"updated_at": "2026-04-13T10:00:00.000Z",
"version": "WzU5LDFd"
}
}