Create a data view

Server: https://{kibana_url}

POST /api/data_views/data_view
POST /s/{space_id}/api/data_views/data_view

Refer to Spaces for more information.

Create a data view. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. To learn more, refer to the data views documentation.

Request

Responses

Indicates a successful call.

application/json

Bad request

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn://api/data_views/data_view
{"data_view":{"title":"logstash-*","name":"My Logstash data view"}}

curl Shell

curl \
  -X POST "${KIBANA_URL}/api/data_views/data_view" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{"data_view":{"title":"logstash-*","name":"My Logstash data view"}}'

Response

{
  "error": "Bad Request",
  "message": "[request body.data_view.title]: expected value of type [string] but got [undefined]",
  "statusCode": 400
}

Create a data view for logstash indices that includes a runtime field which extracts the shape name from a source field.

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/data_views/data_view
{
  "data_view": {
    "name": "My Logstash data view",
    "runtimeFieldMap": {
      "runtime_shape_name": {
        "script": {
          "source": "emit(doc[\u0027shape_name\u0027].value)"
        },
        "type": "keyword"
      }
    },
    "title": "logstash-*"
  }
}

curl Shell

curl \
  -X POST "${KIBANA_URL}/api/data_views/data_view" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "data_view": {
    "name": "My Logstash data view",
    "runtimeFieldMap": {
      "runtime_shape_name": {
        "script": {
          "source": "emit(doc[\u0027shape_name\u0027].value)"
        },
        "type": "keyword"
      }
    },
    "title": "logstash-*"
  }
}'

Response

{
  "data_view": {
    "allowNoIndex": false,
    "fieldAttrs": {},
    "fieldFormats": {},
    "fields": {
      "runtime_shape_name": {
        "aggregatable": true,
        "count": 0,
        "esTypes": [
          "keyword"
        ],
        "format": {
          "id": "string"
        },
        "name": "runtime_shape_name",
        "readFromDocValues": false,
        "runtimeField": {
          "script": {
            "source": "emit(doc[\u0027shape_name\u0027].value)"
          },
          "type": "keyword"
        },
        "scripted": false,
        "searchable": true,
        "shortDotsEnable": false,
        "type": "string"
      }
    },
    "id": "b561acfb-0181-455e-84a3-ce8980b2272f",
    "name": "My Logstash data view",
    "namespaces": [
      "default"
    ],
    "runtimeFieldMap": {
      "runtime_shape_name": {
        "script": {
          "source": "emit(doc[\u0027shape_name\u0027].value)"
        },
        "type": "keyword"
      }
    },
    "sourceFilters": [],
    "title": "logstash-*",
    "typeMeta": {},
    "version": "WzQ5LDJd"
  }
}

{
  "error": "Bad Request",
  "message": "[request body.data_view.title]: expected value of type [string] but got [undefined]",
  "statusCode": 400
}