Create data frame transforms APIedit


This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

Instantiates a data frame transform.


PUT _data_frame/transforms/<data_frame_transform_id>



You must use Kibana or this API to create a data frame transform. Do not put a data frame transform directly into any .data-frame-internal* indices using the Elasticsearch index API. If Elasticsearch security features are enabled, do not give users any privileges on .data-frame-internal* indices.

Path Parametersedit

data_frame_transform_id (required)
(string) Identifier for the data frame transform. This identifier can contain lowercase alphanumeric characters (a-z and 0-9), hyphens, and underscores. It must start and end with alphanumeric characters.

Request Bodyedit

source (required)
(object) The source configuration, consisting of index and optionally a query.
dest (required)
(object) The destination configuration, consisting of index and optionally a pipeline id.
(object) Defines the pivot function group by fields and the aggregation to reduce the data. See data frame transform pivot objects.
Optional free text description of the data frame transform


If the Elasticsearch security features are enabled, you must have manage_data_frame_transforms cluster privileges to use this API. The built-in data_frame_transforms_admin role has these privileges. You must also have read and view_index_metadata privileges on the source index and read, create_index, and index privileges on the destination index. For more information, see Security privileges and Built-in roles.


The following example creates a data frame transform for the Kibana eCommerce sample data:

PUT _data_frame/transforms/ecommerce_transform
  "source": {
    "index": "kibana_sample_data_ecommerce",
    "query": {
      "term": {
        "geoip.continent_name": {
          "value": "Asia"
  "dest": {
    "index": "kibana_sample_data_ecommerce_transform",
    "pipeline": "add_timestamp_pipeline"
  "pivot": {
    "group_by": {
      "customer_id": {
        "terms": {
          "field": "customer_id"
    "aggregations": {
      "max_price": {
        "max": {
          "field": "taxful_total_price"
  "description": "Maximum priced ecommerce data by customer_id in Asia"

When the transform is created, you receive the following results:

  "acknowledged" : true