Create a data view | Kibana API documentation

Create a data view Generally available; added in 9.6.0

POST /api/data_views/v2

Spaces method and path for this operation:

post /s/{space_id}/api/data_views/v2

Refer to Spaces for more information.

Creates a data view and returns it. Kibana generates the data view ID. If a data view with the same name already exists, the request fails with a conflict.

[Required authorization] Route required privileges: indexPatterns:manage.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

application/json

Body

allow_hidden_indices boolean

When true, allows the data view to match hidden indices.
field_filters array[string]

Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as user* which filters fields starting with 'user'.

Not more than 10000 elements. Minimum length of each is 1, maximum length of each is 1000.
field_settings object

Settings for individual fields, keyed by field name. To change how Kibana displays a field from the backing indices, set its label, description, format, or popularity. To define a runtime field, use the runtime field name and set type.
index_pattern string Required

The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".

Minimum length is 1.
name string

The name of the data view. Example: "Sample data view".

Minimum length is 1, maximum length is 256.
time_field string

The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".

Responses

201 application/json

The data view was created.
Hide response attributes Show response attributes object
- data object Required
  
  The data view definition.
  
  Additional properties are NOT allowed.
  
  Hide data attributes Show data attributes object
  
  allow_hidden_indices boolean
  
  When true, allows the data view to match hidden indices.
  
  field_filters array[string]
  
  Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as user* which filters fields starting with 'user'.
  
  Not more than 10000 elements. Minimum length of each is 1, maximum length of each is 1000.
  
  field_settings object
  
  Settings for individual fields, keyed by field name. To change how Kibana displays a field from the backing indices, set its label, description, format, or popularity. To define a runtime field, use the runtime field name and set type.
  
  id string
  
  Kibana provides a unique identifier for each data view, or you can create your own.
  
  Minimum length is 1, maximum length is 256.
  
  index_pattern string Required
  
  The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
  
  Minimum length is 1.
  
  name string
  
  The name of the data view. Example: "Sample data view".
  
  Minimum length is 1, maximum length is 256.
  
  time_field string
  
  The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
- id string Required
  
  The ID of the data view.
  
  Maximum length is 1000.
- meta object Required
  
  Metadata about the data view.
  
  Additional properties are NOT allowed.
  
  Hide meta attributes Show meta attributes object
  
  created_at string
  
  Timestamp when the object was created (ISO 8601).
  
  created_by string
  
  User profile ID of the user who created the object.
  
  managed boolean
  
  When true, the object is managed by Kibana and cannot be edited by users.
  
  owner string
  
  Identifier of the plugin or team that owns this object.
  
  spaces array[string]
  
  The IDs of the spaces where the data view is available.
  
  Not more than 100 elements. Maximum length of each is 1000.
  
  updated_at string
  
  Timestamp when the object was last updated (ISO 8601).
  
  updated_by string
  
  User profile ID of the user who last updated the object.
  
  version string
  
  Internal version identifier for optimistic concurrency control.
400

The request is invalid, for example when a field format type does not exist.
403

forbidden
409

A data view with the same name already exists.

POST /api/data_views/v2

curl \
 --request POST 'https://localhost:5601/api/data_views/v2' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{
  "index_pattern": "logs-*",
  "name": "Web logs",
  "time_field": "@timestamp"
}'

Request example

{
  "index_pattern": "logs-*",
  "name": "Web logs",
  "time_field": "@timestamp"
}

Response examples (201)

{
  "data": {
    "index_pattern": "logs-*",
    "name": "Web logs",
    "time_field": "@timestamp"
  },
  "id": "c0ffee00-d57a-11ef-9a52-4f3c2a8d0e1b",
  "meta": {
    "managed": false,
    "spaces": [
      "default"
    ],
    "version": "WzEsMV0="
  }
}