Data views
A data view tells Kibana which Elasticsearch indices, data streams, or index aliases to query. Analytics features such as Discover and Lens use a data view to access your data. For example, a data view can point to your log data from yesterday, or to all indices that contain your data.
In some apps, you can query Elasticsearch with ES|QL instead. ES|QL doesn't require a data view.
A data view in your space is created automatically or by you.
- Created automatically
-
Some ingest and onboarding workflows create a data view for you. Adding sample data installs one. Uploading a file creates one when Create data view is turned on. These are ordinary data views that you can edit.
Installing an Elastic integration through Fleet also creates data views. Those data views are managed by Elastic.
- Created by you
- For your own data, you often need to create the data view yourself. Refer to Create a data view.
To see which data views already exist in your space, open the data view menu in Discover or Lens, or go to the Data Views management page.
Some data views are configured and managed by Elastic, including those created by Fleet integrations, Elastic Security, and Cases. Managed data views carry a Managed tag.
You can view and use a managed data view, but you can't edit it.
To customize a managed data view, duplicate it and edit the copy.
To match data in another cluster, another project, or a rollup index, refer to What the index pattern matches.