Create a data view
Base URL
https://{kibana_url}
POST
/api/data_views/data_view
Auth
Create a data view. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. To learn more, refer to the data views documentation .
Expand all
Cross-site request forgery protection
{
}
data_view
object required
The data view object.
−
Hide 14 properties
allowNoIndex
boolean
Allows the data view saved object to exist before the data is available. Defaults to false.
fieldAttrs
map string to object
<string>
object
+
Show 3 properties
count
integer
Popularity count for the field.
customDescription
string · max length: 300
Custom description for the field.
customLabel
string
Custom label for the field.
fieldFormats
object
A map of field formats by field name.
name
string
The data view name.
namespaces
string []
An array of space identifiers for sharing the data view between multiple spaces.
runtimeFieldMap
map string to object
<string>
object
+
Show 2 properties
script
object required
+
Show 1 property
source
string
Script for the runtime field.
type
string required
Mapping type of the runtime field.
sourceFilters
object []
The array of field names you want to filter out in Discover.
+
Show 1 property
timeFieldName
string
The timestamp field name, which you use for time-based data views.
title
string required
Comma-separated list of data streams, indices, and aliases that you want to search. Supports wildcards (*).
type
string
When set to rollup, identifies the rollup data views.
typeMeta
object
When you use rollup indices, contains the field list for the rollup data view API endpoints.
+
Show 2 properties
override
boolean · default: false
Override an existing data view if a data view with the provided title already exists.
200
Indicates a successful call.
application/json
data_view
object
+
Show 13 properties
allowNoIndex
boolean
Allows the data view saved object to exist before the data is available. Defaults to false.
fieldAttrs
map string to object
<string>
object
+
Show 3 properties
count
integer
Popularity count for the field.
customDescription
string · max length: 300
Custom description for the field.
customLabel
string
Custom label for the field.
fieldFormats
object
A map of field formats by field name.
name
string
The data view name.
namespaces
string []
An array of space identifiers for sharing the data view between multiple spaces.
runtimeFieldMap
map string to object
<string>
object
+
Show 2 properties
script
object required
+
Show 1 property
source
string
Script for the runtime field.
type
string required
Mapping type of the runtime field.
sourceFilters
object []
The array of field names you want to filter out in Discover.
+
Show 1 property
timeFieldName
string
The timestamp field name, which you use for time-based data views.
title
string
Comma-separated list of data streams, indices, and aliases that you want to search. Supports wildcards (*).
typeMeta
object nullable
When you use rollup indices, contains the field list for the rollup data view API endpoints.
+
Show 2 properties
statusCode
number required
Thank you for your feedback.
Base URL
https://{kibana_url}
Examples
Example
languages
Create a data view with runtime fields.
languages
Request
Console
1 / 2 languages
‹
›
1
2
POST kbn://api/data_views/data_view
{"data_view":{"title":"logstash-*","name":"My Logstash data view"}}
1
2
3
4
5
6
curl \
-X POST "${KIBANA_URL}/api/data_views/data_view" \
-H "Authorization: ApiKey ${API_KEY}" \
-H "kbn-xsrf: true" \
-H "Content-Type: application/json" \
-d '{"data_view":{"title":"logstash-*","name":"My Logstash data view"}}'
Response
The request was rejected because the payload or query parameters are missing required fields or contain invalid values.
Show more
1
2
3
4
5
{
"error": "Bad Request",
"message": "[request body.data_view.title]: expected value of type [string] but got [undefined]",
"statusCode": 400
}
Request
Console
1 / 2 languages
‹
›
Create a data view for logstash indices that includes a runtime field which extracts the shape name from a source field.
Show more
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
POST kbn:/api/data_views/data_view
{
"data_view": {
"name": "My Logstash data view",
"runtimeFieldMap": {
"runtime_shape_name": {
"script": {
"source": "emit(doc[\u0027shape_name\u0027].value)"
},
"type": "keyword"
}
},
"title": "logstash-*"
}
}
Generated from the API spec
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
curl \
-X POST "${KIBANA_URL}/api/data_views/data_view" \
-H "Authorization: ApiKey ${API_KEY}" \
-H "kbn-xsrf: true" \
-H "Content-Type: application/json" \
-d '{
"data_view": {
"name": "My Logstash data view",
"runtimeFieldMap": {
"runtime_shape_name": {
"script": {
"source": "emit(doc[\u0027shape_name\u0027].value)"
},
"type": "keyword"
}
},
"title": "logstash-*"
}
}'
Generated from the API spec
Response
The response includes the full data view specification, including auto-generated fields such as the unique identifier and version.
Show more
The request was rejected because the payload or query parameters are missing required fields or contain invalid values.
Show more
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
{
"data_view": {
"allowNoIndex": false,
"fieldAttrs": {},
"fieldFormats": {},
"fields": {
"runtime_shape_name": {
"aggregatable": true,
"count": 0,
"esTypes": [
"keyword"
],
"format": {
"id": "string"
},
"name": "runtime_shape_name",
"readFromDocValues": false,
"runtimeField": {
"script": {
"source": "emit(doc[\u0027shape_name\u0027].value)"
},
"type": "keyword"
},
"scripted": false,
"searchable": true,
"shortDotsEnable": false,
"type": "string"
}
},
"id": "b561acfb-0181-455e-84a3-ce8980b2272f",
"name": "My Logstash data view",
"namespaces": [
"default"
],
"runtimeFieldMap": {
"runtime_shape_name": {
"script": {
"source": "emit(doc[\u0027shape_name\u0027].value)"
},
"type": "keyword"
}
},
"sourceFilters": [],
"title": "logstash-*",
"typeMeta": {},
"version": "WzQ5LDJd"
}
}
1
2
3
4
5
{
"error": "Bad Request",
"message": "[request body.data_view.title]: expected value of type [string] but got [undefined]",
"statusCode": 400
}