This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.
You can create data frame transforms in the Kibana Machine Learning application.
Select the index pattern or saved search you want to transform. To pivot your data, you must group the data by at least one field and apply at least one aggregation. The data frame pivot preview on the right side provides a visual verification.
Once you have created the pivot, add a job ID and define the index for the transformed data (target index). If the target index does not exist, it will be created automatically. You can optionally select to create a Kibana index pattern for the target index. At the end of the process, a data frame job is created as a result.
After you create data frame jobs, you can start, stop, and delete them and explore their progress and statistics from the jobs list.
For a more detailed example of using data frames with the Kibana sample data, see Transforming your data.
If Elastic Stack security features are enabled, you must have appropriate authority
to work with data frames. For example, there are built-in
data_frame_transforms_user roles that have
privileges respectively. See
Built-in roles and
Depending on what tasks you perform, you might require additional privileges.
For example, to create a data frame transform and generate a new target index,
manage_data_frame_transforms cluster privileges,
view_index_metadata privileges on the source index, and
index privileges on the target index. For more information, see the
authorization details for each data frame API.