POST /api/data_views/data_view

Spaces method and path for this operation:

post /s/{space_id}/api/data_views/data_view

Refer to Spaces for more information.

Create a data view. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. To learn more, refer to the data views documentation.

Headers

  • kbn-xsrf string Required

    Cross-site request forgery protection

application/json

Body Required

  • data_view object Required

    The data view object.

    Hide data_view attributes Show data_view attributes object
    • allowNoIndex boolean

      Allows the data view saved object to exist before the data is available. Defaults to false.

    • fieldAttrs object
      Hide fieldAttrs attribute Show fieldAttrs attribute object
      • * object Additional properties

        A map of field attributes by field name.

        Hide * attributes Show * attributes object
        • count integer

          Popularity count for the field.

        • customDescription string

          Custom description for the field.

          Maximum length is 300.

        • customLabel string

          Custom label for the field.

    • fieldFormats object

      A map of field formats by field name.

    • fields object
    • id string
    • name string

      The data view name.

    • namespaces array[string]

      An array of space identifiers for sharing the data view between multiple spaces.

      Default value is default.

    • runtimeFieldMap object
      Hide runtimeFieldMap attribute Show runtimeFieldMap attribute object
      • * object Additional properties

        A map of runtime field definitions by field name.

        Hide * attributes Show * attributes object
        • script object Required
          Hide script attribute Show script attribute object
          • source string

            Script for the runtime field.

        • type string Required

          Mapping type of the runtime field.

    • sourceFilters array[object]

      The array of field names you want to filter out in Discover.

      Hide sourceFilters attribute Show sourceFilters attribute object
      • value string Required
    • timeFieldName string

      The timestamp field name, which you use for time-based data views.

    • title string Required

      Comma-separated list of data streams, indices, and aliases that you want to search. Supports wildcards (*).

    • type string

      When set to rollup, identifies the rollup data views.

    • typeMeta object

      When you use rollup indices, contains the field list for the rollup data view API endpoints.

      Hide typeMeta attributes Show typeMeta attributes object
      • aggs object Required

        A map of rollup restrictions by aggregation type and field name.

      • params object Required

        Properties for retrieving rollup fields.

    • version string
  • override boolean

    Override an existing data view if a data view with the provided title already exists.

    Default value is false.

Responses

  • 200 application/json

    Indicates a successful call.

    Hide response attribute Show response attribute object
    • data_view object
      Hide data_view attributes Show data_view attributes object
      • allowNoIndex boolean

        Allows the data view saved object to exist before the data is available. Defaults to false.

      • fieldAttrs object
        Hide fieldAttrs attribute Show fieldAttrs attribute object
        • * object Additional properties

          A map of field attributes by field name.

          Hide * attributes Show * attributes object
          • count integer

            Popularity count for the field.

          • customDescription string

            Custom description for the field.

            Maximum length is 300.

          • customLabel string

            Custom label for the field.

      • fieldFormats object

        A map of field formats by field name.

      • fields object
      • id string
      • name string

        The data view name.

      • namespaces array[string]

        An array of space identifiers for sharing the data view between multiple spaces.

        Default value is default.

      • runtimeFieldMap object
        Hide runtimeFieldMap attribute Show runtimeFieldMap attribute object
        • * object Additional properties

          A map of runtime field definitions by field name.

          Hide * attributes Show * attributes object
          • script object Required
            Hide script attribute Show script attribute object
            • source string

              Script for the runtime field.

          • type string Required

            Mapping type of the runtime field.

      • sourceFilters array[object]

        The array of field names you want to filter out in Discover.

        Hide sourceFilters attribute Show sourceFilters attribute object
        • value string Required
      • timeFieldName string

        The timestamp field name, which you use for time-based data views.

      • title string

        Comma-separated list of data streams, indices, and aliases that you want to search. Supports wildcards (*).

      • typeMeta object | null

        When you use rollup indices, contains the field list for the rollup data view API endpoints.

        Hide typeMeta attributes Show typeMeta attributes object | null
        • aggs object

          A map of rollup restrictions by aggregation type and field name.

        • params object

          Properties for retrieving rollup fields.

      • version string
  • 400 application/json

    Bad request

    Hide response attributes Show response attributes object
    • error string Required
    • message string Required
    • statusCode number Required
POST /api/data_views/data_view
curl \
  -X POST "${KIBANA_URL}/api/data_views/data_view" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{"data_view":{"title":"logstash-*","name":"My Logstash data view"}}'
POST kbn://api/data_views/data_view
{"data_view":{"title":"logstash-*","name":"My Logstash data view"}}
Request example
Create a data view for logstash indices that includes a runtime field which extracts the shape name from a source field.
{
  "data_view": {
    "name": "My Logstash data view",
    "runtimeFieldMap": {
      "runtime_shape_name": {
        "script": {
          "source": "emit(doc['shape_name'].value)"
        },
        "type": "keyword"
      }
    },
    "title": "logstash-*"
  }
}