Create a data view

POST /api/data_views/data_view

Spaces method and path for this operation:

post /s/{space_id}/api/data_views/data_view

Refer to Spaces for more information.

Create a data view. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. To learn more, refer to the data views documentation.

Headers

kbn-xsrf string Required

Cross-site request forgery protection

application/json

Body Required

data_view object Required

The data view object.
Hide data_view attributes Show data_view attributes object
- allowNoIndex boolean
  
  Allows the data view saved object to exist before the data is available. Defaults to false.
- fieldAttrs object
  Hide fieldAttrs attribute Show fieldAttrs attribute object
  
  * object Additional properties
  
  A map of field attributes by field name.
  
  Hide * attributes Show * attributes object
  
  count integer
  
  Popularity count for the field.
  
  customDescription string
  
  Custom description for the field.
  
  Maximum length is 300.
  
  customLabel string
  
  Custom label for the field.
- fieldFormats object
  
  A map of field formats by field name.
- fields object
- id string
- name string
  
  The data view name.
- namespaces array[string]
  
  An array of space identifiers for sharing the data view between multiple spaces.
  
  Default value is default.
- runtimeFieldMap object
  Hide runtimeFieldMap attribute Show runtimeFieldMap attribute object
  
  * object Additional properties
  
  A map of runtime field definitions by field name.
  
  Hide * attributes Show * attributes object
  
  script object Required
  
  Hide script attribute Show script attribute object
  
  source string
  
  Script for the runtime field.
  
  type string Required
  
  Mapping type of the runtime field.
- sourceFilters array[object]
  
  The array of field names you want to filter out in Discover.
  Hide sourceFilters attribute Show sourceFilters attribute object
  
  value string Required
- timeFieldName string
  
  The timestamp field name, which you use for time-based data views.
- title string Required
  
  Comma-separated list of data streams, indices, and aliases that you want to search. Supports wildcards (*).
- type string
  
  When set to rollup, identifies the rollup data views.
- typeMeta object
  
  When you use rollup indices, contains the field list for the rollup data view API endpoints.
  Hide typeMeta attributes Show typeMeta attributes object
  
  aggs object Required
  
  A map of rollup restrictions by aggregation type and field name.
  
  params object Required
  
  Properties for retrieving rollup fields.
- version string
override boolean

Override an existing data view if a data view with the provided title already exists.

Default value is false.

Responses

200 application/json

Indicates a successful call.
Hide response attribute Show response attribute object
- data_view object
  
  Hide data_view attributes Show data_view attributes object
  
  allowNoIndex boolean
  
  Allows the data view saved object to exist before the data is available. Defaults to false.
  
  fieldAttrs object
  
  Hide fieldAttrs attribute Show fieldAttrs attribute object
  
  * object Additional properties
  
  A map of field attributes by field name.
  
  Hide * attributes Show * attributes object
  
  count integer
  
  Popularity count for the field.
  
  customDescription string
  
  Custom description for the field.
  
  Maximum length is 300.
  
  customLabel string
  
  Custom label for the field.
  
  fieldFormats object
  
  A map of field formats by field name.
  
  fields object
  
  id string
  
  name string
  
  The data view name.
  
  namespaces array[string]
  
  An array of space identifiers for sharing the data view between multiple spaces.
  
  Default value is default.
  
  runtimeFieldMap object
  
  Hide runtimeFieldMap attribute Show runtimeFieldMap attribute object
  
  * object Additional properties
  
  A map of runtime field definitions by field name.
  
  Hide * attributes Show * attributes object
  
  script object Required
  
  Hide script attribute Show script attribute object
  
  source string
  
  Script for the runtime field.
  
  type string Required
  
  Mapping type of the runtime field.
  
  sourceFilters array[object]
  
  The array of field names you want to filter out in Discover.
  
  Hide sourceFilters attribute Show sourceFilters attribute object
  
  value string Required
  
  timeFieldName string
  
  The timestamp field name, which you use for time-based data views.
  
  title string
  
  Comma-separated list of data streams, indices, and aliases that you want to search. Supports wildcards (*).
  
  typeMeta object | null
  
  When you use rollup indices, contains the field list for the rollup data view API endpoints.
  
  Hide typeMeta attributes Show typeMeta attributes object | null
  
  aggs object
  
  A map of rollup restrictions by aggregation type and field name.
  
  params object
  
  Properties for retrieving rollup fields.
  
  version string
400 application/json

Bad request
Hide response attributes Show response attributes object
- error string Required
- message string Required
- statusCode number Required

POST /api/data_views/data_view

curl \
  -X POST "${KIBANA_URL}/api/data_views/data_view" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{"data_view":{"title":"logstash-*","name":"My Logstash data view"}}'

POST kbn://api/data_views/data_view
{"data_view":{"title":"logstash-*","name":"My Logstash data view"}}

Request example

Create a data view for logstash indices that includes a runtime field which extracts the shape name from a source field.

{
  "data_view": {
    "name": "My Logstash data view",
    "runtimeFieldMap": {
      "runtime_shape_name": {
        "script": {
          "source": "emit(doc['shape_name'].value)"
        },
        "type": "keyword"
      }
    },
    "title": "logstash-*"
  }
}

Response examples (200)

The response includes the full data view specification, including auto-generated fields such as the unique identifier and version.

{
  "data_view": {
    "allowNoIndex": false,
    "fieldAttrs": {},
    "fieldFormats": {},
    "fields": {
      "runtime_shape_name": {
        "aggregatable": true,
        "count": 0,
        "esTypes": [
          "keyword"
        ],
        "format": {
          "id": "string"
        },
        "name": "runtime_shape_name",
        "readFromDocValues": false,
        "runtimeField": {
          "script": {
            "source": "emit(doc['shape_name'].value)"
          },
          "type": "keyword"
        },
        "scripted": false,
        "searchable": true,
        "shortDotsEnable": false,
        "type": "string"
      }
    },
    "id": "b561acfb-0181-455e-84a3-ce8980b2272f",
    "name": "My Logstash data view",
    "namespaces": [
      "default"
    ],
    "runtimeFieldMap": {
      "runtime_shape_name": {
        "script": {
          "source": "emit(doc['shape_name'].value)"
        },
        "type": "keyword"
      }
    },
    "sourceFilters": [],
    "title": "logstash-*",
    "typeMeta": {},
    "version": "WzQ5LDJd"
  }
}

Response examples (400)

The request was rejected because the payload or query parameters are missing required fields or contain invalid values.

{
  "error": "Bad Request",
  "message": "[request body.data_view.title]: expected value of type [string] but got [undefined]",
  "statusCode": 400
}