Kibana data views
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
A data view (formerly Kibana index pattern) tells Kibana which Elasticsearch indices, data streams, or index aliases to query. Analytics features such as Discover and Lens use a data view to access your data. For example, a data view can point to your log data from yesterday, or to all indices that contain your data.
In some apps, you can query Elasticsearch with ES|QL instead. ES|QL doesn't require a data view.
A data view in your space is created automatically or by you.
- Created automatically
-
Some ingest and onboarding workflows create a data view for you. Adding sample data installs one. Uploading a file creates one when Create data view is turned on. These are ordinary data views that you can edit.
Installing an Elastic integration through Fleet also creates data views. Those data views are managed by Elastic.
- Created by you
- For your own data, you often need to create the data view yourself. In the Index pattern field of the creation form, enter the indices, data streams, or aliases to match. Refer to Create a data view.
To see which data views already exist in your space, open the data view menu in Discover (in classic mode) or Lens, or go to the Data Views management page.
Some data views are configured and managed by Elastic, including those created by Fleet integrations, Elastic Security, and Cases. Managed data views carry a Managed tag.
You can view and use a managed data view, but you can't edit it.
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Generally available since 9.4 This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes. You also can't delete a managed data view.
To customize a managed data view, duplicate it and edit the copy.
To match data in another cluster, another project, or a rollup index, refer to What the index pattern matches.
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability We plan to add this functionality in a future Elastic Stack update. Subject to changes. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Planned
Planned
To create, update, list, and delete data views from scripts or CI/CD pipelines, you can use the latest Data views v2 API. It describes each data view as JSON that you can store in version control and deploy to other environments.