Create a data viewedit

Kibana requires a data view to access the Elasticsearch data that you want to explore. A data view selects the data to use and allows you to define properties of the fields.

A data view can point to one or more indices, data streams, or index aliases. For example, a data view can point to your log data from yesterday, or all indices that contain your data.

Required permissionsedit

  • Access to Data Views requires the Kibana privilege Data View Management.
  • To create a data view, you must have the Elasticsearch privilege view_index_metadata.
  • If a read-only indicator appears in Kibana, you have insufficient privileges to create or save data views. The buttons to create data views or save existing data views are not visible. For more information, refer to Granting access to Kibana.

Create a data viewedit

If you collected data using one of the Kibana ingest options, uploaded a file, or added sample data, you get a data view for free, and can start exploring your data. If you loaded your own data, follow these steps to create a data view.

  1. Open the main menu, then click Stack Management > Data Views.
  2. Click Create data view.
  3. Start typing in the name field, and Kibana looks for the names of indices, data streams, and aliases that match your input.

    Create data view

    • To match multiple sources, use a wildcard (*). For example, filebeat-* matches filebeat-apache-a, filebeat-apache-b, and so on.
    • To match multiple single sources, enter their names, separated by a comma. Do not include a space after the comma. filebeat-a,filebeat-b matches two indices, but does not match filebeat-c.
    • To exclude a source, use a minus sign (-), for example, -test3.
  4. If Kibana detects an index with a timestamp, expand the Timestamp field menu, and then select the default field for filtering your data by time.

    • If your index doesn’t have time-based data, choose I don’t want to use the time filter.
    • If you don’t set a default time field, you can’t use global time filters on your dashboards. This is useful if you have multiple time fields and want to create dashboards that combine visualizations based on different timestamps.
  5. To display all indices, click Show advanced settings, then select Allow hidden and system indices.
  6. To specify your own data view name, click Show advanced settings, then enter the name in the Custom data view ID field. For example, enter your Elasticsearch index alias name.
  7. To use this data in searches and visualizations that you intend to save, click Save data view to Kibana.
  8. To explore your data without creating a data view, click Use without saving.

    This allows you to explore your data in Discover, Lens, and Maps without making it visible to others in your space. You can save the data view later if you create a search or visualization that you want to share.

Create a data view for rolled up dataedit

A data view can match one rollup index. For a combination rollup data view with both raw and rolled up data, use the standard notation:

rollup_logstash,kibana_sample_data_logs

For an example, refer to Create and visualize rolled up data.

Create a data view that searches across clustersedit

If your Elasticsearch clusters are configured for cross-cluster search, you can create a data view to search across the clusters of your choosing. You specify data streams, indices, and aliases in a remote cluster using the following syntax:

<remote_cluster_name>:<target>

To query Logstash indices across two Elasticsearch clusters that you set up for cross-cluster search, named cluster_one and cluster_two:

 cluster_one:logstash-*,cluster_two:logstash-*

Use wildcards in your cluster names to match any number of clusters. To search Logstash indices across clusters named cluster_foo, cluster_bar, and so on:

cluster_*:logstash-*

To query across all Elasticsearch clusters that have been configured for cross-cluster search, use a standalone wildcard for your cluster name:

*:logstash-*

To match indices starting with logstash-, but exclude those starting with logstash-old, from all clusters having a name starting with cluster_:

`cluster_*:logstash-*,cluster_*:-logstash-old*`

To exclude a cluster having a name starting with cluster_:

`cluster_*:logstash-*,cluster_one:-*`

Once you configure a data view to use the cross-cluster search syntax, all searches and aggregations using that data view in Kibana take advantage of cross-cluster search.

Delete data viewsedit

When you delete a data view, you cannot recover the associated field formatters, runtime fields, source filters, and field popularity data. Deleting a data view does not remove any indices or data documents from Elasticsearch.

Deleting a data view breaks all visualizations, saved searches, and other saved objects that reference the data view.

  1. Open the main menu, then click Stack Management > Data Views.
  2. Find the data view that you want to delete, and then click Delete icon in the Actions column.