Creating data frame transformsedit


This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features.

You can create data frame transforms in the Kibana Machine Learning application.

Defining a data frame pivot

Select the index pattern or saved search you want to transform. To pivot your data, you must group the data by at least one field and apply at least one aggregation. The data frame pivot preview on the right side provides a visual verification.

Once you have created the pivot, add a job ID and define the index for the transformed data (target index). If the target index does not exist, it will be created automatically. You can optionally select to create a Kibana index pattern for the target index. At the end of the process, a data frame job is created as a result.

Job ID and target index

After you create data frame jobs, you can start, stop, and delete them and explore their progress and statistics from the jobs list.

For a more detailed example of using data frames with the Kibana sample data, see Transforming your data.


If Elastic Stack security features are enabled, you must have appropriate authority to work with data frames. For example, there are built-in data_frame_transforms_admin and data_frame_transforms_user roles that have manage_data_frame_transforms and monitor_data_frame_transforms cluster privileges respectively. See Built-in roles and Security privileges.

Depending on what tasks you perform, you might require additional privileges. For example, to create a data frame transform and generate a new target index, you need manage_data_frame_transforms cluster privileges, read and view_index_metadata privileges on the source index, and read, create_index, and index privileges on the target index. For more information, see the authorization details for each data frame API.