Create visualization
https://{kibana_url}
- POST /api/visualizations
Creates a Lens visualization and saves it to the library.
ES|QL visualizations cannot be created through this endpoint.
Request
-
breakdown_byanyOf -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
columnsnumber · default: 3 -
Number of columns.
-
drop_partial_intervalsboolean · default: false -
When
true, drops partial intervals from the results. -
fieldstringrequired -
Field to be used for the date histogram.
-
include_empty_rowsboolean · default: true -
When
true, includes empty rows in the results. -
labelstring -
Label for the operation
-
operation -
Values:
date_histogram -
suggested_intervalstring · default: auto -
Suggested time interval.
-
use_original_time_rangeboolean · default: false -
When
true, uses the original time range instead of the current query time range. -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
columnsnumber · default: 3 -
Number of columns.
-
excludesobject -
fieldsstring · min: 1 · max: 4required -
format -
Number display format for the dimension value.
-
compactboolean · default: false -
When
true, uses compact notation (for example, 1.2k instead of 1,200). Defaults tofalse. -
decimalsnumber · default: 2 -
Number of decimal places to display.
-
suffixstring -
Suffix appended to the formatted value.
-
type -
Value format type:
numberfor plain numbers,percentfor percentages. -
Values:
numberpercent -
compactboolean -
When
true, uses short unit suffixes (for example,msinstead ofMilliseconds). Defaults totrue. Ignored forauto-approximate. -
decimalsnumber -
Number of decimal places to display. Defaults to
0. Ignored forauto-approximate. -
from -
Source time unit of the raw field value, including fine-grained units (
ps,ns,us) in addition to standard units. This describes how the stored data is encoded, not a query duration literal. -
Values:
psnsusmssminhdwmoy -
suffixstring -
Suffix appended to the formatted value.
-
to -
Display time unit:
auto(precise),auto-approximate, or a fixed conversion unit. -
Values:
autoauto-approximatemssminhdwmoy -
type -
Values:
duration -
includesobject -
increase_accuracyboolean -
When
true, increases accuracy at the cost of performance. -
labelstring -
Label for the operation
-
limitnumber · default: 5 -
Number of terms to return.
-
operation -
Values:
terms -
other_bucketobject -
include_documents_without_fieldbooleanrequired -
When
true, includes documents that do not have the specified field. -
rank_byanyOf -
type -
Values:
significant -
metric_indexnumber · min: 0 · default: 0 -
Zero-based index into the metrics array identifying which metric to rank by.
-
type -
Values:
metric -
fieldstringrequired -
Numeric field to be used for the custom operation.
-
operation -
Values:
percentile -
percentilenumber · default: 95 -
The percentile threshold (0–100) at which to compute the field value used for ranking terms.
-
type -
Values:
custom -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
columnsnumber · default: 3 -
Number of columns.
-
fieldstringrequired -
Field to be used for the histogram.
-
format -
Number display format for the dimension value.
-
granularitynumber | enum · default: auto -
Values:
auto -
include_empty_rowsboolean · default: true -
When
true, includes empty rows in the results. -
labelstring -
Label for the operation
-
operation -
Values:
histogram -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
columnsnumber · default: 3 -
Number of columns.
-
fieldstringrequired -
Field to be used for the range.
-
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
range -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
columnsnumber · default: 3 -
Number of columns.
-
filtersobject · max: 100required -
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
labelstring -
Label for the filter
-
labelstring -
Label for the operation
-
operation -
Values:
filters -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsanyOf · min: 1 · max: 2required -
Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric.
-
apply_color_to -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
background_chart -
Secondary visualization displayed behind the primary metric value, either a bar chart (with optional max value) or a trend line.
-
max_valueanyOfrequired -
Metric dimension configuration, supporting field-based aggregations (count, sum, average, median, standard deviation, unique count, last value), percentile operations, time-series operations (differences, moving average, cumulative sum, counter rate), and mathematical formulas.
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
formulastringrequired -
Formula
-
labelstring -
Label for the operation
-
operation -
Values:
formula -
reduced_time_rangestring -
Reduced time range
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
of -
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstring -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
unique_count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
minmaxaveragemedianstandard_deviation -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
sum -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
multi_valueboolean · default: false -
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
-
operation -
Values:
last_value -
reduced_time_rangestring -
Reduced time range
-
time_fieldstringrequired -
Time field used to determine document recency
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile -
percentilenumber · default: 95 -
Percentile
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile_rank -
ranknumber · default: 0 -
Percentile Rank
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
operation -
Values:
differences -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
of -
operation -
Values:
moving_average -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
windownumber · default: 5 -
Window
-
fieldstring -
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
cumulative_sum -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
counter_rate -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstring -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
unique_count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
multi_valueboolean · default: false -
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
-
operation -
Values:
last_value -
reduced_time_rangestring -
Reduced time range
-
time_fieldstringrequired -
Time field used to determine document recency
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile -
percentilenumber · default: 95 -
Percentile
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile_rank -
ranknumber · default: 0 -
Percentile Rank
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
type -
Values:
bar -
type -
Values:
trend -
coloranyOf · default: { "type": "auto" } -
Color configuration for the primary metric value or background.
-
type -
Values:
auto -
subtitlestring -
Subtitle below the primary metric value.
-
type -
Values:
primary -
coloranyOf · default: { "type": "none" } -
compareanyOf -
Compare the secondary metric to a baseline value or to the primary metric.
-
baselinenumber · default: 0 -
Baseline value.
-
iconboolean · default: true -
When
true, displays the icon for the secondary value. -
palettestring · default: compare_to -
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to
default. -
to -
Values:
baseline -
valueboolean · default: true -
When
true, displays the secondary value. -
iconboolean · default: true -
When
true, displays the icon for the secondary value. -
palettestring · default: compare_to -
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to
default. -
to -
Values:
primary -
valueboolean · default: true -
When
true, displays the secondary value. -
type -
Values:
secondary -
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
density· default: default -
Density preset for the metric chart layout. Use
compactfor a compact layout, ordefaultfor increased padding, element spacing, and font size. -
Values:
compactdefault -
icon -
Icon configuration for the metric chart
-
primaryobject -
labelsobject -
Labels (title and subtitle) configuration
-
alignment· default: left -
Horizontal alignment for the title and subtitle text. Accepted values:
left,center,right. Defaults toleft. -
Values:
leftcenterright -
position· default: bottom -
Position of the primary metric value (top, middle, or bottom).
-
Values:
topmiddlebottom -
valueobject -
Primary metric value configuration
-
alignment· default: right -
Alignment for the primary metric value. Accepted values:
left,center,right. Defaults toright. -
Values:
leftcenterright -
sizing· default: auto -
Controls how the primary value text is sized within the panel. 'auto' selects a font size from predefined breakpoints based on panel height, then shrinks if the text overflows horizontally. 'fill' scales the text to be as large as possible, filling all available space.
-
Values:
autofill -
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
metric
Number or percentage format with optional decimal places, suffix, and compact notation.
Data size format in bits or bytes, with optional decimal places and suffix.
Duration format between time units.
Terms ranked alphabetically.
Terms ranked by rarity.
Terms ranked by significance.
Terms ranked by a linked metric.
Terms ranked by custom operation.
Terms ranked by count, either of all documents or of a specific field.
Terms ranked by a percentile of a numeric field, for example the 95th percentile of response time.
Terms ranked by the percentile rank of a single value: the proportion of field values at or below that value.
type: data_view_reference
type: data_view_spec
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Fixed color for all values in the dimension.
Coloring determined at runtime based on chart defaults
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricanyOfrequired -
apply_color_to -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
coloranyOf · default: { "type": "auto" } -
Color configuration based on the metric value.
-
range -
Values:
absolute -
stepsobject · min: 1 · max: 100required -
Array of ordered color steps defining the range each color is applied.
-
colorstringrequired -
The color to use for this step.
-
gtenumbernullable -
The lower bound of range from which this color applies (inclusive).
-
ltnumbernullable -
The upper bound of range to which this color applies (exclusive).
-
ltenumbernullable -
The upper bound of range to which this color applies (inclusive).
-
type -
Values:
dynamic -
palettestringrequired -
The legacy palette name.
-
range -
Values:
absolute -
shiftbooleanrequired -
When
true, shifts the palette colors so they start from a different offset. Defaults tofalse. -
stepsobject · min: 1 · max: 100required -
Array of ordered color steps defining the range each color is applied.
-
colorstringrequired -
The color to use for this step.
-
gtenumbernullable -
The lower bound of range from which this color applies (inclusive).
-
ltnumbernullable -
The upper bound of range to which this color applies (exclusive).
-
ltenumbernullable -
The upper bound of range to which this color applies (inclusive).
-
type -
Values:
legacy_dynamic -
type -
Values:
auto -
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstring -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
apply_color_to -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
coloranyOf · default: { "type": "auto" } -
Color configuration based on the metric value.
-
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
unique_count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
apply_color_to -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
coloranyOf · default: { "type": "auto" } -
Color configuration based on the metric value.
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
minmaxaveragemedianstandard_deviation -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
apply_color_to -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
coloranyOf · default: { "type": "auto" } -
Color configuration based on the metric value.
-
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
sum -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
apply_color_to -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
coloranyOf · default: { "type": "auto" } -
Color configuration based on the metric value.
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
multi_valueboolean · default: false -
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
-
operation -
Values:
last_value -
reduced_time_rangestring -
Reduced time range
-
time_fieldstringrequired -
Time field used to determine document recency
-
time_shiftstring -
Time shift
-
apply_color_to -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
coloranyOf · default: { "type": "auto" } -
Color configuration based on the metric value.
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile -
percentilenumber · default: 95 -
Percentile
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
apply_color_to -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
coloranyOf · default: { "type": "auto" } -
Color configuration based on the metric value.
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile_rank -
ranknumber · default: 0 -
Percentile Rank
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
apply_color_to -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
coloranyOf · default: { "type": "auto" } -
Color configuration based on the metric value.
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
formulastringrequired -
Formula
-
labelstring -
Label for the operation
-
operation -
Values:
formula -
reduced_time_rangestring -
Reduced time range
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
legacy_metric
type: data_view_reference
type: data_view_spec
Color by absolute value configuration
Color by value using a palette, with colors distributed across the range of values.
Legacy color by absolute value configuration
Coloring determined at runtime based on chart defaults
-
axis -
Axis configuration for X, Y, and Y2 axes. The Y axis is on the start (leading) side, the Y2 axis is on the end (trailing) side.
-
xobject -
X-axis configuration
-
domainanyOf -
X-axis domain configuration
-
scale -
X-axis scale type. Use 'temporal' for timestamp/date fields (for example, @timestamp or DATE_TRUNC results). Use 'ordinal' for categorical/text fields. Use 'linear' for numeric fields.
-
Values:
ordinaltemporallinear -
yobject -
Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts).
-
domainoneOf · default: { "rounding": true, "type": "full" } -
Y-axis domain configuration
-
y2object -
Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts).
-
domainoneOf · default: { "rounding": true, "type": "full" } -
Y-axis domain configuration
-
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
layers· min: 1 · max: 100required -
Chart layers
-
breakdown_byanyOf -
aggregate_firstboolean -
When
true, aggregates data before splitting into series. Defaults tofalse. -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
mappingobject · max: 1000required -
mode -
Values:
categorical -
palettestringrequired -
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to
default. -
unassigned -
The color to use for unassigned values.
-
gradientanyOf · max: 3 -
mode -
Values:
gradient -
palettestringrequired -
Color palette name. Accepted values: 'default', 'elastic_line_optimized', 'severity', 'eui_amsterdam', 'kibana_v7_legacy', 'elastic_brand_2023'. Defaults to
default. -
unassigned -
The color to use for unassigned values.
-
drop_partial_intervalsboolean · default: false -
When
true, drops partial intervals from the results. -
fieldstringrequired -
Field to be used for the date histogram.
-
include_empty_rowsboolean · default: true -
When
true, includes empty rows in the results. -
labelstring -
Label for the operation
-
operation -
Values:
date_histogram -
suggested_intervalstring · default: auto -
Suggested time interval.
-
use_original_time_rangeboolean · default: false -
When
true, uses the original time range instead of the current query time range. -
aggregate_firstboolean -
When
true, aggregates data before splitting into series. Defaults tofalse. -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
excludesobject -
fieldsstring · min: 1 · max: 4required -
format -
Number display format for the dimension value.
-
includesobject -
increase_accuracyboolean -
When
true, increases accuracy at the cost of performance. -
labelstring -
Label for the operation
-
limitnumber · default: 5 -
Number of terms to return.
-
operation -
Values:
terms -
other_bucketobject -
include_documents_without_fieldbooleanrequired -
When
true, includes documents that do not have the specified field. -
rank_byanyOf -
aggregate_firstboolean -
When
true, aggregates data before splitting into series. Defaults tofalse. -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
fieldstringrequired -
Field to be used for the histogram.
-
format -
Number display format for the dimension value.
-
granularitynumber | enum · default: auto -
Values:
auto -
include_empty_rowsboolean · default: true -
When
true, includes empty rows in the results. -
labelstring -
Label for the operation
-
operation -
Values:
histogram -
aggregate_firstboolean -
When
true, aggregates data before splitting into series. Defaults tofalse. -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
fieldstringrequired -
Field to be used for the range.
-
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
range -
aggregate_firstboolean -
When
true, aggregates data before splitting into series. Defaults tofalse. -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
filtersobject · max: 100required -
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
labelstring -
Label for the filter
-
labelstring -
Label for the operation
-
operation -
Values:
filters -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
type -
Chart type for the data layer
-
Values:
areaarea_percentagearea_stackedbarbar_horizontalbar_horizontal_stackedbar_horizontal_percentagebar_percentagebar_stackedline -
xanyOf -
drop_partial_intervalsboolean · default: false -
When
true, drops partial intervals from the results. -
fieldstringrequired -
Field to be used for the date histogram.
-
include_empty_rowsboolean · default: true -
When
true, includes empty rows in the results. -
labelstring -
Label for the operation
-
operation -
Values:
date_histogram -
suggested_intervalstring · default: auto -
Suggested time interval.
-
use_original_time_rangeboolean · default: false -
When
true, uses the original time range instead of the current query time range. -
excludesobject -
fieldsstring · min: 1 · max: 4required -
format -
Number display format for the dimension value.
-
includesobject -
increase_accuracyboolean -
When
true, increases accuracy at the cost of performance. -
labelstring -
Label for the operation
-
limitnumber · default: 5 -
Number of terms to return.
-
operation -
Values:
terms -
other_bucketobject -
include_documents_without_fieldbooleanrequired -
When
true, includes documents that do not have the specified field. -
rank_byanyOf -
fieldstringrequired -
Field to be used for the histogram.
-
format -
Number display format for the dimension value.
-
granularitynumber | enum · default: auto -
Values:
auto -
include_empty_rowsboolean · default: true -
When
true, includes empty rows in the results. -
labelstring -
Label for the operation
-
operation -
Values:
histogram -
filtersobject · max: 100required -
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
labelstring -
Label for the filter
-
labelstring -
Label for the operation
-
operation -
Values:
filters -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
thresholdsanyOf · min: 1 · max: 100required -
Array of reference line thresholds
-
axis· default: y -
The axis this reference line is drawn on. Values match the root axis configuration keys. If omitted, defaults to the primary Y axis.
-
Values:
xyy2 -
coloranyOf · default: { "type": "auto" } -
icon -
Icon to display on the reference line
-
Values:
asteriskalertbellboltbugcircleeditor_commentflagheartmap_markerpin_filledstar_emptystar_filledtagtriangle -
stroke_widthnumber · min: 1 · max: 10 -
Line width in pixels
-
type -
Values:
reference_lines -
data_sourceoneOf -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
eventsanyOf · min: 1 · max: 100required -
Array of annotation configurations
-
coloranyOf · default: { "type": "auto" } -
extra_fieldsstring · max: 100 -
Additional fields for annotation tooltip
-
icon -
Icon to display at the annotation point
-
Values:
asteriskalertbellboltbugcircleeditor_commentflagheartmap_markerpin_filledstar_emptystar_filledtagtriangle -
labelstring -
Label text for the annotation
-
lineobject -
Vertical line configuration for point annotation
-
stroke_widthnumber · min: 1 · max: 10required -
Vertical line width in pixels
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
textobject -
Annotation text label configuration
-
time_fieldstringrequired -
Field containing the timestamp
-
type -
Values:
query -
visibleboolean -
Show the annotation
-
coloranyOf · default: { "type": "auto" } -
icon -
Icon to display at the annotation point
-
Values:
asteriskalertbellboltbugcircleeditor_commentflagheartmap_markerpin_filledstar_emptystar_filledtagtriangle -
labelstring -
Label text for the annotation
-
lineobject -
Vertical line configuration for point annotation
-
stroke_widthnumber · min: 1 · max: 10required -
Vertical line width in pixels
-
textobject -
Annotation text label visibility
-
visiblebooleanrequired -
Show text label on the annotation
-
timestampnumber | stringrequired -
type -
Values:
point -
visibleboolean -
Show the annotation
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
type -
Values:
annotations -
legend -
Legend configuration for XY chart
-
layoutanyOf -
placement -
Values:
outside -
position -
Values:
topbottom -
series_header -
Legend table series header configuration.
-
statistics· max: 17 -
Statistics to display in legend
-
Values:
minmaxavgmedianrangelast_valuelast_non_null_valuefirst_valuefirst_non_null_valuedifferencedifference_percentagecounttotalstandard_deviationvariancedistinct_countcurrent_and_last_value -
layoutobject -
placement -
Values:
outside -
position -
Values:
leftright -
series_header -
Legend table series header configuration.
-
statistics· max: 17 -
Statistics to display in legend
-
Values:
minmaxavgmedianrangelast_valuelast_non_null_valuefirst_valuefirst_non_null_valuedifferencedifference_percentagecounttotalstandard_deviationvariancedistinct_countcurrent_and_last_value -
columnsnumber · min: 1 · max: 5 -
Number of legend columns
-
layoutobject -
placement -
Values:
inside -
series_header -
Legend table series header configuration.
-
statistics· max: 17 -
Statistics to display in legend
-
Values:
minmaxavgmedianrangelast_valuelast_non_null_valuefirst_valuefirst_non_null_valuedifferencedifference_percentagecounttotalstandard_deviationvariancedistinct_countcurrent_and_last_value -
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
styling -
Visual styling options for the chart
-
areas -
Area-specific rendering settings
-
fill_opacitynumber · min: 0 · max: 2 · default: 0.3 -
Area fill opacity (0-1 typical, max 2 for legacy)
-
bars -
Bar-specific rendering settings
-
data_labelsobject -
Data label configuration for bar series
-
visibleboolean · default: false -
Display value labels on bar data points
-
minimum_heightnumber · min: 0 · default: 1 -
Minimum bar height in pixels
-
fitting -
Missing data interpolation configuration for line and area series
-
emphasizeboolean -
Visually distinguish fitted segments with a dashed line style and reduced area opacity
-
extend -
How to render line and area edges when data does not cover the full X domain
-
Values:
nonezeronearest -
type -
Fitting function type for missing data
-
Values:
nonezerolinearcarrylookaheadaveragenearest -
interpolation· default: linear -
Curve interpolation method for line and area series
-
Values:
linearsmoothstepped -
overlays -
Visual overlays drawn on top of the chart canvas
-
current_time_markerobject -
Current time marker configuration
-
visibleboolean · default: false -
Show current time marker line
-
partial_bucketsobject -
Partial (incomplete) bucket indicator configuration
-
visibleboolean · default: false -
Show partial bucket indicators at time range edges
-
points -
Data point marker settings for line and area series
-
visibility· default: auto -
Data point marker visibility on line and area series
-
Values:
autovisiblehidden -
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
xy
Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion.
Uses explicitly provided domain bounds (min and max).
type: full
Uses the full chart domain, including baseline expansion when applicable (for example, includes zero for bar-like series).
type: fit
Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion.
type: custom
Uses explicitly provided domain bounds (min and max).
type: full
Uses the full chart domain, including baseline expansion when applicable (for example, includes zero for bar-like series).
type: fit
Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion.
type: custom
Uses explicitly provided domain bounds (min and max).
Data layer for standard queries with metrics and buckets
Palette color assignment for specific categorical values. Unmapped values receive the unassigned color.
Color at a fixed index position in a named palette.
Gradient color mapping across categorical values.
Color at a fixed index position in a named palette.
Color at a fixed index position in a named palette.
type: data_view_reference
type: data_view_spec
Reference line layer for standard queries
type: data_view_reference
type: data_view_spec
Layer containing annotations (query-based, points, and ranges)
type: data_view_reference
type: data_view_spec
Annotation from query results matching a filter
Manual point annotation at specific timestamp
Manual range annotation spanning time interval
Outside legend positioned horizontal (top/bottom) of the chart
Outside legend positioned vertical (left/right) of the chart
Inside legend
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricanyOfrequired -
coloranyOf · default: { "type": "auto" } -
Color configuration for the gauge fill.
-
goalanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
formulastringrequired -
Formula
-
labelstring -
Label for the operation
-
operation -
Values:
formula -
reduced_time_rangestring -
Reduced time range
-
maxanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
minanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
subtitlestring -
Subtitle below the gauge value.
-
ticksobject -
Ticks configuration
-
titleobject -
Title configuration
-
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstring -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color configuration for the gauge fill.
-
goalanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
maxanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
minanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
subtitlestring -
Subtitle below the gauge value.
-
ticksobject -
Ticks configuration
-
titleobject -
Title configuration
-
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
unique_count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color configuration for the gauge fill.
-
goalanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
maxanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
minanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
subtitlestring -
Subtitle below the gauge value.
-
ticksobject -
Ticks configuration
-
titleobject -
Title configuration
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
minmaxaveragemedianstandard_deviation -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color configuration for the gauge fill.
-
goalanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
maxanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
minanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
subtitlestring -
Subtitle below the gauge value.
-
ticksobject -
Ticks configuration
-
titleobject -
Title configuration
-
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
sum -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color configuration for the gauge fill.
-
goalanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
maxanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
minanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
subtitlestring -
Subtitle below the gauge value.
-
ticksobject -
Ticks configuration
-
titleobject -
Title configuration
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
multi_valueboolean · default: false -
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
-
operation -
Values:
last_value -
reduced_time_rangestring -
Reduced time range
-
time_fieldstringrequired -
Time field used to determine document recency
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color configuration for the gauge fill.
-
goalanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
maxanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
minanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
subtitlestring -
Subtitle below the gauge value.
-
ticksobject -
Ticks configuration
-
titleobject -
Title configuration
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile -
percentilenumber · default: 95 -
Percentile
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color configuration for the gauge fill.
-
goalanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
maxanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
minanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
subtitlestring -
Subtitle below the gauge value.
-
ticksobject -
Ticks configuration
-
titleobject -
Title configuration
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile_rank -
ranknumber · default: 0 -
Percentile Rank
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color configuration for the gauge fill.
-
goalanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
maxanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
minanyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
subtitlestring -
Subtitle below the gauge value.
-
ticksobject -
Ticks configuration
-
titleobject -
Title configuration
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
formulastringrequired -
Formula
-
labelstring -
Label for the operation
-
operation -
Values:
formula -
reduced_time_rangestring -
Reduced time range
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
gauge
type: data_view_reference
type: data_view_spec
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
legend -
Legend configuration
-
position -
Values:
topbottomleftright -
truncate_after_linesnumber · min: 1 · max: 10 · default: 1 -
Number of lines before legend items are truncated.
-
metricanyOfrequired -
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstring -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
unique_count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
minmaxaveragemedianstandard_deviation -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
sum -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
multi_valueboolean · default: false -
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
-
operation -
Values:
last_value -
reduced_time_rangestring -
Reduced time range
-
time_fieldstringrequired -
Time field used to determine document recency
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile -
percentilenumber · default: 95 -
Percentile
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile_rank -
ranknumber · default: 0 -
Percentile Rank
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
of -
operation -
Values:
differences -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
of -
operation -
Values:
moving_average -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
windownumber · default: 5 -
Window
-
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
fieldstring -
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
cumulative_sum -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
counter_rate -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
coloranyOf · default: { "type": "auto" } -
Color scale configuration for the heatmap cells.
-
type -
Values:
auto -
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
formulastringrequired -
Formula
-
labelstring -
Label for the operation
-
operation -
Values:
formula -
reduced_time_rangestring -
Reduced time range
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
heatmap -
xanyOfrequired -
Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.
-
yanyOf -
Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.
type: data_view_reference
type: data_view_spec
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Coloring determined at runtime based on chart defaults
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricanyOfrequired -
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstring -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
unique_count -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
minmaxaveragemedianstandard_deviation -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
empty_as_nullboolean · default: false -
When
true, treats empty buckets as null instead of zero. -
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
sum -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
multi_valueboolean · default: false -
Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
-
operation -
Values:
last_value -
reduced_time_rangestring -
Reduced time range
-
time_fieldstringrequired -
Time field used to determine document recency
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile -
percentilenumber · default: 95 -
Percentile
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
percentile_rank -
ranknumber · default: 0 -
Percentile Rank
-
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
of -
operation -
Values:
differences -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
of -
operation -
Values:
moving_average -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
windownumber · default: 5 -
Window
-
fieldstring -
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
cumulative_sum -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
fieldstringrequired -
Field to be used for the metric
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
counter_rate -
reduced_time_rangestring -
Reduced time range
-
time_shiftstring -
Time shift
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
formulastringrequired -
Formula
-
labelstring -
Label for the operation
-
operation -
Values:
formula -
reduced_time_rangestring -
Reduced time range
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
tag_byanyOfrequired -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
drop_partial_intervalsboolean · default: false -
When
true, drops partial intervals from the results. -
fieldstringrequired -
Field to be used for the date histogram.
-
include_empty_rowsboolean · default: true -
When
true, includes empty rows in the results. -
labelstring -
Label for the operation
-
operation -
Values:
date_histogram -
suggested_intervalstring · default: auto -
Suggested time interval.
-
use_original_time_rangeboolean · default: false -
When
true, uses the original time range instead of the current query time range. -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
excludesobject -
fieldsstring · min: 1 · max: 4required -
format -
Number display format for the dimension value.
-
includesobject -
increase_accuracyboolean -
When
true, increases accuracy at the cost of performance. -
labelstring -
Label for the operation
-
limitnumber · default: 5 -
Number of terms to return.
-
operation -
Values:
terms -
other_bucketobject -
include_documents_without_fieldbooleanrequired -
When
true, includes documents that do not have the specified field. -
rank_byanyOf -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
fieldstringrequired -
Field to be used for the histogram.
-
format -
Number display format for the dimension value.
-
granularitynumber | enum · default: auto -
Values:
auto -
include_empty_rowsboolean · default: true -
When
true, includes empty rows in the results. -
labelstring -
Label for the operation
-
operation -
Values:
histogram -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
fieldstringrequired -
Field to be used for the range.
-
format -
Number display format for the dimension value.
-
labelstring -
Label for the operation
-
operation -
Values:
range -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
filtersobject · max: 100required -
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
labelstring -
Label for the filter
-
labelstring -
Label for the operation
-
operation -
Values:
filters -
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
tag_cloud
type: data_view_reference
type: data_view_spec
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricanyOfrequired -
Metric dimension using a field-based aggregation or a mathematical formula.
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
formulastringrequired -
Formula
-
labelstring -
Label for the operation
-
operation -
Values:
formula -
reduced_time_rangestring -
Reduced time range
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
regionanyOfrequired -
emsobject -
boundariesstringrequired -
EMS boundaries
-
joinstringrequired -
EMS join field
-
drop_partial_intervalsboolean · default: false -
When
true, drops partial intervals from the results. -
fieldstringrequired -
Field to be used for the date histogram.
-
include_empty_rowsboolean · default: true -
When
true, includes empty rows in the results. -
labelstring -
Label for the operation
-
operation -
Values:
date_histogram -
suggested_intervalstring · default: auto -
Suggested time interval.
-
use_original_time_rangeboolean · default: false -
When
true, uses the original time range instead of the current query time range. -
emsobject -
boundariesstringrequired -
EMS boundaries
-
joinstringrequired -
EMS join field
-
excludesobject -
fieldsstring · min: 1 · max: 4required -
format -
Number display format for the dimension value.
-
includesobject -
increase_accuracyboolean -
When
true, increases accuracy at the cost of performance. -
labelstring -
Label for the operation
-
limitnumber · default: 5 -
Number of terms to return.
-
operation -
Values:
terms -
other_bucketobject -
include_documents_without_fieldbooleanrequired -
When
true, includes documents that do not have the specified field. -
rank_byanyOf -
emsobject -
boundariesstringrequired -
EMS boundaries
-
joinstringrequired -
EMS join field
-
fieldstringrequired -
Field to be used for the histogram.
-
format -
Number display format for the dimension value.
-
granularitynumber | enum · default: auto -
Values:
auto -
include_empty_rowsboolean · default: true -
When
true, includes empty rows in the results. -
labelstring -
Label for the operation
-
operation -
Values:
histogram -
emsobject -
boundariesstringrequired -
EMS boundaries
-
joinstringrequired -
EMS join field
-
filtersobject · max: 100required -
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
labelstring -
Label for the filter
-
labelstring -
Label for the operation
-
operation -
Values:
filters -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
region_map
type: data_view_reference
type: data_view_spec
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsanyOf · min: 1 · max: 1000required -
Array of metrics to display as columns in the datatable
-
apply_color_to -
Column color target:
valuefor cell text,backgroundfor cell background, orbadgefor a badge overlay. -
Values:
valuebackgroundbadge -
coloranyOf · default: { "type": "auto" } -
Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.
-
type -
Values:
auto -
summaryobject -
Summary row configuration
-
visibleboolean · default: true -
When
false, hides the column from the datatable. -
widthnumber · min: 0 -
Column width in pixels.
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
rowsanyOf · min: 1 · max: 50 -
Array of operations to split the datatable rows by
-
apply_color_to -
Column color target:
valuefor cell text,backgroundfor cell background, orbadgefor a badge overlay. -
Values:
valuebackgroundbadge -
click_filterboolean · default: false -
When
true, enables one-click filtering on cell values. -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
coloranyOf · default: { "type": "auto" } -
type -
Values:
auto -
visibleboolean · default: true -
When
false, hides the column from the datatable. -
widthnumber · min: 0 -
Column width in pixels.
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
split_metrics_byanyOf · min: 1 · max: 20 -
Array of operations to split the metric columns by
-
styling -
Visual chart styling options
-
paging -
Rows per page. When set, pagination is enabled with the specified number of rows.
-
Values:
10203050100 -
row_numbersobject -
Configuration for row numbers
-
visiblebooleanrequired -
When
true, displays row numbers. -
sort_byanyOf -
Sorting configuration. Only one column can be sorted at a time. Use "column_type" to specify the column type.
-
indexnumber · min: 0required -
Index of the column or row to sort by (0-based).
-
column_type -
Values:
pivoted_metric -
indexnumber · min: 0required -
0-based index into the "metrics" array for the metric to sort; use "values" to identify the pivoted column
-
valuesstring · min: 1 · max: 20required -
Array of pivot values, one for each split_metrics_by column in order
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
data_table
type: data_view_reference
type: data_view_spec
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Coloring determined at runtime based on chart defaults
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Coloring determined at runtime based on chart defaults
Sort by a metric or row column
Sort by a pivoted metric column (created when metrics are pivoted by split_metrics_by)
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
group_byanyOf · min: 1 · max: 100 -
Array of breakdown dimensions (minimum 1)
-
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
legend -
Legend configuration for pie chart
-
nestedboolean · default: false -
Show nested legend with hierarchical breakdown levels
-
truncate_after_linesnumber · min: 1 · max: 10 · default: 1 -
Number of lines before legend items are truncated.
-
metricsanyOf · min: 1 · max: 100required -
Array of metric configurations (minimum 1)
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
labelsobject -
Label configuration for pie chart slice labels inside or outside the pie
-
values -
Configure the visibility and the format of the values rendered on each chart partition section
-
percent_decimalsnumber · min: 0 · max: 10 · default: 2 -
Decimal places for percentage display (0-10)
-
visibleboolean -
Show metric values on the chart
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
pie
type: data_view_reference
type: data_view_spec
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
group_breakdown_byanyOf · min: 1 · max: 100 -
Array of group breakdown dimensions (minimum 1)
-
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
group_byanyOf · min: 1 · max: 100 -
Array of breakdown dimensions (minimum 1)
-
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
legend -
Legend configuration for mosaic chart appearance and behavior
-
nestedboolean · default: false -
Show nested legend with hierarchical breakdown levels
-
truncate_after_linesnumber · min: 1 · max: 10 · default: 1 -
Number of lines before legend items are truncated.
-
metricanyOfrequired -
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
values -
Configure the visibility and the format of the values rendered on each chart partition section
-
percent_decimalsnumber · min: 0 · max: 10 · default: 2 -
Decimal places for percentage display (0-10)
-
visibleboolean -
Show metric values on the chart
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
mosaic
type: data_view_reference
type: data_view_spec
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
group_byanyOf · min: 1 · max: 100 -
Array of breakdown dimensions (minimum 1)
-
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
legend -
Configuration for the treemap chart legend appearance and behavior
-
nestedboolean · default: false -
Show nested legend with hierarchical breakdown levels
-
truncate_after_linesnumber · min: 1 · max: 10 · default: 1 -
Number of lines before legend items are truncated.
-
metricsanyOf · min: 1 · max: 100required -
Array of metric configurations (minimum 1)
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
values -
Configure the visibility and the format of the values rendered on each chart partition section
-
percent_decimalsnumber · min: 0 · max: 10 · default: 2 -
Decimal places for percentage display (0-10)
-
visibleboolean -
Show metric values on the chart
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
treemap
type: data_view_reference
type: data_view_spec
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
group_byanyOf · min: 1 · max: 100 -
Array of breakdown dimensions (minimum 1)
-
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
legend -
Legend configuration for waffle chart
-
truncate_after_linesnumber · min: 1 · max: 10 · default: 1 -
Number of lines before legend items are truncated.
-
values· min: 1 · max: 1 -
Values:
absolute -
metricsanyOf · min: 1 · max: 100required -
Array of metric configurations (minimum 1)
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
values -
Configure the visibility and the format of the values rendered on each chart partition section
-
percent_decimalsnumber · min: 0 · max: 10 · default: 2 -
Decimal places for percentage display (0-10)
-
visibleboolean -
Show metric values on the chart
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
waffle
type: data_view_reference
type: data_view_spec
Responses
Created
-
data -
breakdown_byanyOf -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsanyOf · min: 1 · max: 2required -
Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric.
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
metric -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricanyOfrequired -
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
legacy_metric -
axis -
Axis configuration for X, Y, and Y2 axes. The Y axis is on the start (leading) side, the Y2 axis is on the end (trailing) side.
-
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
layers· min: 1 · max: 100required -
Chart layers
-
legend -
Legend configuration for XY chart
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
styling -
Visual styling options for the chart
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
xy -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricanyOfrequired -
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
gauge -
axis -
Axis configuration for X and Y axes
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
legend -
Legend configuration
-
position -
Values:
topbottomleftright -
truncate_after_linesnumber · min: 1 · max: 10 · default: 1 -
Number of lines before legend items are truncated.
-
metricanyOfrequired -
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
heatmap -
xanyOfrequired -
Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.
-
yanyOf -
Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.
-
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricanyOfrequired -
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
tag_byanyOfrequired -
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
tag_cloud -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricanyOfrequired -
Metric dimension using a field-based aggregation or a mathematical formula.
-
filter -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
format -
Number display format for the dimension value.
-
formulastringrequired -
Formula
-
labelstring -
Label for the operation
-
operation -
Values:
formula -
reduced_time_rangestring -
Reduced time range
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
regionanyOfrequired -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
region_map -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsanyOf · min: 1 · max: 1000required -
Array of metrics to display as columns in the datatable
-
apply_color_to -
Column color target:
valuefor cell text,backgroundfor cell background, orbadgefor a badge overlay. -
Values:
valuebackgroundbadge -
coloranyOf · default: { "type": "auto" } -
Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.
-
type -
Values:
auto -
summaryobject -
Summary row configuration
-
visibleboolean · default: true -
When
false, hides the column from the datatable. -
widthnumber · min: 0 -
Column width in pixels.
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
rowsanyOf · min: 1 · max: 50 -
Array of operations to split the datatable rows by
-
apply_color_to -
Column color target:
valuefor cell text,backgroundfor cell background, orbadgefor a badge overlay. -
Values:
valuebackgroundbadge -
click_filterboolean · default: false -
When
true, enables one-click filtering on cell values. -
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
coloranyOf · default: { "type": "auto" } -
type -
Values:
auto -
visibleboolean · default: true -
When
false, hides the column from the datatable. -
widthnumber · min: 0 -
Column width in pixels.
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
split_metrics_byanyOf · min: 1 · max: 20 -
Array of operations to split the metric columns by
-
styling -
Visual chart styling options
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
data_table -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
group_byanyOf · min: 1 · max: 100 -
Array of breakdown dimensions (minimum 1)
-
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
legend -
Legend configuration for pie chart
-
nestedboolean · default: false -
Show nested legend with hierarchical breakdown levels
-
truncate_after_linesnumber · min: 1 · max: 10 · default: 1 -
Number of lines before legend items are truncated.
-
metricsanyOf · min: 1 · max: 100required -
Array of metric configurations (minimum 1)
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
labelsobject -
Label configuration for pie chart slice labels inside or outside the pie
-
values -
Configure the visibility and the format of the values rendered on each chart partition section
-
percent_decimalsnumber · min: 0 · max: 10 · default: 2 -
Decimal places for percentage display (0-10)
-
visibleboolean -
Show metric values on the chart
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
pie -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
group_breakdown_byanyOf · min: 1 · max: 100 -
Array of group breakdown dimensions (minimum 1)
-
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
group_byanyOf · min: 1 · max: 100 -
Array of breakdown dimensions (minimum 1)
-
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
legend -
Legend configuration for mosaic chart appearance and behavior
-
nestedboolean · default: false -
Show nested legend with hierarchical breakdown levels
-
truncate_after_linesnumber · min: 1 · max: 10 · default: 1 -
Number of lines before legend items are truncated.
-
metricanyOfrequired -
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
values -
Configure the visibility and the format of the values rendered on each chart partition section
-
percent_decimalsnumber · min: 0 · max: 10 · default: 2 -
Decimal places for percentage display (0-10)
-
visibleboolean -
Show metric values on the chart
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
mosaic -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
group_byanyOf · min: 1 · max: 100 -
Array of breakdown dimensions (minimum 1)
-
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
legend -
Configuration for the treemap chart legend appearance and behavior
-
nestedboolean · default: false -
Show nested legend with hierarchical breakdown levels
-
truncate_after_linesnumber · min: 1 · max: 10 · default: 1 -
Number of lines before legend items are truncated.
-
metricsanyOf · min: 1 · max: 100required -
Array of metric configurations (minimum 1)
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
values -
Configure the visibility and the format of the values rendered on each chart partition section
-
percent_decimalsnumber · min: 0 · max: 10 · default: 2 -
Decimal places for percentage display (0-10)
-
visibleboolean -
Show metric values on the chart
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
treemap -
data_sourceoneOfrequired -
When
true, allows the data view to match hidden indices. -
field_filtersobject · max: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to object -
index_patternstring · min: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
namestring · min: 1 · max: 256 -
The name of the data view. Example: "Sample data view".
-
time_fieldstring -
The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".
-
type -
Values:
data_view_spec -
descriptionstring -
The description of the chart. Optional. Any string value or undefined.
-
filtersobject · max: 100 -
Filters applied to the panel
-
group_byanyOf · min: 1 · max: 100 -
Array of breakdown dimensions (minimum 1)
-
collapse_by -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
color· default: { "mapping": [], "mode": "categorical", "palette": "default" } -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
legend -
Legend configuration for waffle chart
-
truncate_after_linesnumber · min: 1 · max: 10 · default: 1 -
Number of lines before legend items are truncated.
-
values· min: 1 · max: 1 -
Values:
absolute -
metricsanyOf · min: 1 · max: 100required -
Array of metric configurations (minimum 1)
-
query -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
expressionstringrequired -
A query expression in KQL or Lucene syntax
-
language· default: kql -
Query language:
kql(Kibana Query Language) orlucene. Defaults tokql. -
Values:
kqllucene -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
styling -
Visual chart styling options
-
values -
Configure the visibility and the format of the values rendered on each chart partition section
-
percent_decimalsnumber · min: 0 · max: 10 · default: 2 -
Decimal places for percentage display (0-10)
-
visibleboolean -
Show metric values on the chart
-
Tag IDs to associate with this visualization.
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
type -
Values:
waffle -
idstringrequired -
meta -
created_atstring -
Timestamp when the object was created (ISO 8601).
-
created_bystring -
User profile ID of the user who created the object.
-
managedboolean -
When
true, the object is managed by Kibana and cannot be edited by users. -
ownerstring -
Identifier of the plugin or team that owns this object.
-
updated_atstring -
Timestamp when the object was last updated (ISO 8601).
-
updated_bystring -
User profile ID of the user who last updated the object.
-
versionstring -
Internal version identifier for optimistic concurrency control.
type: data_view_reference
type: data_view_spec
type: data_view_reference
type: data_view_spec
type: data_view_reference
type: data_view_spec
type: data_view_reference
type: data_view_spec
type: data_view_reference
type: data_view_spec
type: data_view_reference
type: data_view_spec
type: data_view_reference
type: data_view_spec
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Coloring determined at runtime based on chart defaults
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Coloring determined at runtime based on chart defaults
type: data_view_reference
type: data_view_spec
type: data_view_reference
type: data_view_spec
type: data_view_reference
type: data_view_spec
type: data_view_reference
type: data_view_spec
Malformed request
Unauthorized
Forbidden
Internal Server Error