Create a dashboard
- Base URL
-
https://{kibana_url}
- POST /api/dashboards
Creates a new dashboard and returns its ID, full state, and metadata.
Authentication
Authorization: <value>These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey
Authorization: Basic <credentials>Request body
-
esql_approximationboolean -
When
true, ES|QL visualizations that useSTATSrun with approximate execution for faster, estimated results. -
filtersunion oneOf[] · max items: 500 -
Filters applied across all panels, including pinned panels.
- One of:
-
conditionunion oneOfrequired -
A filter condition with strict operator/value type matching.
-
One of:
(determined by
operator) -
negateboolean -
When
true, the filter is negated and matches documents that do NOT satisfy the condition. Defaults tofalse. -
valueobjectrequired -
Boundary values for a range comparison.
-
formatstring -
Elasticsearch date format string applied when parsing date boundary values. For example,
strict_date_optional_timeorepoch_millis. -
controlled_bystring -
Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.
-
disabledboolean -
When
true, the filter is inactive and does not affect query results. Defaults tofalse. -
controlled_bystring -
Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.
-
disabledboolean -
When
true, the filter is inactive and does not affect query results. Defaults tofalse. -
fieldstring -
Field name for scripted filters where the field cannot be extracted from the DSL query.
-
is_multi_indexboolean -
When
true, the filter can be applied across multiple indices. Defaults tofalse. -
optionsobject · default: { "auto_apply_filters": true, "hide_panel_borders": false, "hide_panel_titles": false, "sync_colors": false, "sync_cursor": true, "sync_tooltips": false, "use_margins": true } -
Display and behavior settings for the dashboard.
-
auto_apply_filtersboolean · default: true -
When
true, control filter changes are applied automatically. Whenfalse, control filter changes are applied manually through the dashboard's search update button. Defaults totrue. -
sync_colorsboolean · default: false -
When
true, colors are synchronized across panels that share a data source. Defaults tofalse. -
sync_cursorboolean · default: true -
When
true, the cursor position is synchronized across panels. Defaults totrue. -
panelsunion anyOf[] · max items: 1000 -
Panels and sections in the dashboard. Each entry is either a panel (with a
typeandconfig) or a collapsible section (with atitle,collapsedstate, and nestedpanels). - Any of:
-
configobjectrequired -
Anomaly Charts embeddable
-
job_idsstring[] · min items: 1 · max items: 10000required -
Anomaly detection job or group IDs whose results are shown in the charts.
-
severity_thresholdunion anyOf[] · max items: 5 -
Severity threshold ranges used to filter anomaly results.
- Any of:
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion anyOfrequired -
Anomaly Swim Lane embeddable
- Any of:
-
job_idsstring[] · min items: 1 · max items: 10000required -
IDs of the anomaly detection jobs or groups whose results are shown in the swim lane.
-
per_pagenumber · min: 1 -
Number of rows to display per page in a view-by swim lane. Ignored for overall swim lanes.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
job_idsstring[] · min items: 1 · max items: 10000required -
IDs of the anomaly detection jobs or groups whose results are shown in the swim lane.
-
per_pagenumber · min: 1 -
Number of rows to display per page in a view-by swim lane. Ignored for overall swim lanes.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configobjectrequired -
APM service map embeddable schema
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configobjectrequired -
Change point detection chart embeddable schema
-
aggregation_functionenum · default: avg -
The aggregation function used to calculate the metric values.
-
Values:
avgsumminmax -
data_view_idstring · min length: 1 · max length: 10000required -
The data view ID used to run change point detection.
-
max_series_to_plotinteger · min: 1 · max: 50 · default: 6 -
The maximum number of change points to visualize. Defaults to 6.
-
metric_fieldstring · min length: 1 · max length: 10000required -
The metric field used by the aggregation function.
-
split_fieldstring · min length: 1 · max length: 10000 -
The optional field used to split change point results.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configobjectrequired -
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion anyOfrequired - Any of:
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
tabsunion anyOf[] · min items: 1 · max items: 1required -
Inline tab configuration. Used when no
ref_idis set. Currently supports one tab. - Any of:
-
column_orderstring[] · max items: 100 -
Ordered list of field names to display in the data table. If omitted, defaults to the advanced setting "defaultColumns" or the referenced saved object.
-
column_settingsmap string to object -
Per-column presentation settings keyed by field name (e.g. widths). Keys should correspond to entries in
column_orderwhen both are set. -
data_sourceunion oneOfrequired -
One of:
(determined by
type) -
field_filtersstring[] · max items: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
index_patternstring · min length: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
default_rendered_nodesnumber · min: 10 · max: 200 -
Discover display option: controls how many nodes each JSON cell renders by default in JSON document view.
-
densityenum -
Discover display option: controls table row spacing. Choose "compact", "expanded", or "normal". If omitted, Discover or the embedding application determines the density from its current settings, such as the user preference.
-
Values:
compactexpandednormal -
documents_display_modeenum -
Discover display option: controls whether documents are shown as a formatted table ("table") or as a raw JSON tree ("json").
-
Values:
tablejson -
filtersunion oneOf[] · max items: 100 · default: [] -
List of filters to apply to the data in the tab.
-
Same options as
filters -
header_row_heightunion number | enum -
Discover display option: controls table header row height. Use a number (1–5) or "auto" to size based on content. If omitted, Discover or the embedding application determines the height from its current settings, such as the user preference.
-
Values:
auto -
hide_nullsboolean -
Discover display option: controls whether fields with null values are hidden in JSON document view.
-
queryobject -
A search query consisting of an expression and its language. Supports KQL and Lucene syntax.
-
row_heightunion number | enum -
Discover display option: controls table data row height. Use a number (1–20) or "auto" to size based on content. If omitted, defaults to the advanced setting "discover:rowHeightOption".
-
Values:
auto -
rows_per_pagenumber · min: 1 · max: 10000 -
The number of rows to display per page in the data table. If omitted, defaults to the advanced setting "discover:sampleRowsPerPage".
-
sample_sizenumber · min: 10 · max: 10000 -
Discover display option: controls how many documents to sample for the data table. If omitted, defaults to the advanced setting "discover:sampleSize".
-
sortobject[] · max items: 100 · default: [] -
Sort configuration for the data table (field and direction).
-
typeenum · default: default -
Identifies the type of profile settings saved with the tab. The
defaultvalue indicates that no profile settings are included. -
Values:
default -
column_orderstring[] · max items: 100 -
Ordered list of field names to display in the data table. If omitted, defaults to the advanced setting "defaultColumns" or the referenced saved object.
-
column_settingsmap string to object -
Per-column presentation settings keyed by field name (e.g. widths). Keys should correspond to entries in
column_orderwhen both are set. -
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
default_rendered_nodesnumber · min: 10 · max: 200 -
Discover display option: controls how many nodes each JSON cell renders by default in JSON document view.
-
densityenum -
Discover display option: controls table row spacing. Choose "compact", "expanded", or "normal". If omitted, Discover or the embedding application determines the density from its current settings, such as the user preference.
-
Values:
compactexpandednormal -
documents_display_modeenum -
Discover display option: controls whether documents are shown as a formatted table ("table") or as a raw JSON tree ("json").
-
Values:
tablejson -
header_row_heightunion number | enum -
Discover display option: controls table header row height. Use a number (1–5) or "auto" to size based on content. If omitted, Discover or the embedding application determines the height from its current settings, such as the user preference.
-
Values:
auto -
hide_nullsboolean -
Discover display option: controls whether fields with null values are hidden in JSON document view.
-
row_heightunion number | enum -
Discover display option: controls table data row height. Use a number (1–20) or "auto" to size based on content. If omitted, defaults to the advanced setting "discover:rowHeightOption".
-
Values:
auto -
rows_per_pagenumber · min: 1 · max: 10000 -
The number of rows to display per page in the data table. If omitted, defaults to the advanced setting "discover:sampleRowsPerPage".
-
sample_sizenumber · min: 10 · max: 10000 -
Discover display option: controls how many documents to sample for the data table. If omitted, defaults to the advanced setting "discover:sampleSize".
-
sortobject[] · max items: 100 · default: [] -
Sort configuration for the data table (field and direction).
-
column_orderstring[] · max items: 100 -
Ordered list of field names to display in the data table. If omitted, defaults to the advanced setting "defaultColumns" or the referenced saved object.
-
column_settingsmap string to object -
Per-column presentation settings keyed by field name (e.g. widths). Keys should correspond to entries in
column_orderwhen both are set. -
counter_aggregationenumrequired -
Aggregation applied to counter metric fields.
-
Values:
avgsumminmax -
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
default_rendered_nodesnumber · min: 10 · max: 200 -
Discover display option: controls how many nodes each JSON cell renders by default in JSON document view.
-
densityenum -
Discover display option: controls table row spacing. Choose "compact", "expanded", or "normal". If omitted, Discover or the embedding application determines the density from its current settings, such as the user preference.
-
Values:
compactexpandednormal -
documents_display_modeenum -
Discover display option: controls whether documents are shown as a formatted table ("table") or as a raw JSON tree ("json").
-
Values:
tablejson -
header_row_heightunion number | enum -
Discover display option: controls table header row height. Use a number (1–5) or "auto" to size based on content. If omitted, Discover or the embedding application determines the height from its current settings, such as the user preference.
-
Values:
auto -
hide_nullsboolean -
Discover display option: controls whether fields with null values are hidden in JSON document view.
-
histogram_percentileenumrequired -
Percentile displayed for histogram metric fields.
-
Values:
p50p75p90p95p99 -
row_heightunion number | enum -
Discover display option: controls table data row height. Use a number (1–20) or "auto" to size based on content. If omitted, defaults to the advanced setting "discover:rowHeightOption".
-
Values:
auto -
rows_per_pagenumber · min: 1 · max: 10000 -
The number of rows to display per page in the data table. If omitted, defaults to the advanced setting "discover:sampleRowsPerPage".
-
sample_sizenumber · min: 10 · max: 10000 -
Discover display option: controls how many documents to sample for the data table. If omitted, defaults to the advanced setting "discover:sampleSize".
-
search_termstring · max length: 1000required -
Search term used to filter metrics in the metrics grid.
-
sortobject[] · max items: 100 · default: [] -
Sort configuration for the data table (field and direction).
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
overridesobject · default: {} -
column_orderstring[] · max items: 100 -
When set, overrides column order for the data table relative to the referenced saved object (
ref_id) or the inline tab intabs. If omitted, the source configuration is used. -
column_settingsmap string to object -
Per-column presentation overrides (e.g. widths) keyed by field name. When set, merges with the source configuration for the referenced session or inline tab.
-
default_rendered_nodesnumber · min: 10 · max: 200 -
Discover display option: controls how many nodes each JSON cell renders by default in JSON document view. When set, overrides the referenced saved object or the inline tab config in
tabs. If omitted, the source configuration is used. -
densityenum -
Discover display option: controls table row spacing (
compact,expanded, ornormal). When set, overrides the referenced saved object or the inline tab config intabs. If omitted, the source configuration is used. -
Values:
compactexpandednormal -
documents_display_modeenum -
Discover display option: controls whether documents are shown as a formatted table ("table") or as a raw JSON tree ("json"). When set, overrides the referenced saved object or the inline tab config in
tabs. -
Values:
tablejson -
header_row_heightunion number | enum -
Discover display option: controls table header row height (number 1–5 or
auto). When set, overrides the referenced saved object or the inline tab config intabs. If omitted, the source configuration is used. -
Values:
auto -
hide_nullsboolean -
Discover display option: controls whether fields with null values are hidden in JSON document view. When set, overrides the referenced saved object or the inline tab config in
tabs. If omitted, the source configuration is used. -
row_heightunion number | enum -
Discover display option: controls table data row height (number 1–20 or
auto). When set, overrides the referenced saved object or the inline tab config intabs. If omitted, falls back to the source or to the advanced setting "discover:rowHeightOption". -
Values:
auto -
rows_per_pagenumber · min: 1 · max: 10000 -
Number of rows per page. When set, overrides the referenced saved object or the inline tab config in
tabs. If omitted, falls back to the source or to the advanced setting "discover:sampleRowsPerPage". -
sample_sizenumber · min: 10 · max: 10000 -
Discover display option: controls how many documents to sample. When set, overrides the referenced saved object or the inline tab config in
tabs. If omitted, falls back to the source or to the advanced setting "discover:sampleSize". -
selected_tab_idstring -
Tab to select from the referenced saved object. If omitted, defaults to the first tab.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion oneOfrequired -
One of:
(determined by
control_type) -
configunion oneOfrequired -
Field statistics table embeddable schema
-
One of:
(determined by
view_type) -
data_view_idstring · min length: 1 · max length: 1000required -
Data view ID (stored as a panel reference).
-
show_distributionsboolean · default: false -
Whether to show the distribution mini-charts in the table.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
show_distributionsboolean · default: false -
Whether to show the distribution mini-charts in the table.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configobjectrequired -
Image embeddable schema
-
drilldownsunion anyOf[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
configobjectrequired -
Log rate analysis embeddable schema
-
data_view_idstring · min length: 1 · max length: 1000required -
The data view ID used to run log rate analysis.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion anyOfrequired -
Markdown panel config
- Any of:
-
configunion oneOf -
One of:
(determined by
values_source) -
esql_querystring · min length: 1required -
The ES|QL query that provides field options for this control
-
excludeboolean · default: false -
When
true, the control filters to documents that do NOT match the selected options. Defaults tofalse. -
exists_selectedboolean · default: false -
When
true, the control filters to documents where the field exists, regardless of the field's value. Defaults tofalse. -
ignore_validationsboolean · default: false -
When
true, the control skips selection validation and does not report which selections are responsible for returning zero results. -
run_past_timeoutboolean · default: false -
When
true, the options list query continues running even if it exceeds the configured timeout threshold. Defaults tofalse. -
search_techniqueenum · default: wildcard -
The matching technique used when searching available options.
prefixmatches values starting with the search term,wildcardmatches values containing the search term, andexactrequires a complete match. Only applies to string and IP fields. Defaults towildcard. -
Values:
prefixwildcardexact -
selected_options(number | string)[] · max items: 10000 · default: [] -
The list of currently selected option values.
-
single_selectboolean · default: false -
When
true, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults tofalse. -
values_sourceenum · default: field -
The source of the field options for this control. Defaults to
fieldfor legacy controls. -
Values:
field -
data_view_idstring · min length: 1required -
The ID of the data view that provides field options for this control.
-
excludeboolean · default: false -
When
true, the control filters to documents that do NOT match the selected options. Defaults tofalse. -
exists_selectedboolean · default: false -
When
true, the control filters to documents where the field exists, regardless of the field's value. Defaults tofalse. -
field_namestring · min length: 1required -
The name of the field in the data view that this control filters on.
-
ignore_validationsboolean · default: false -
When
true, the control skips selection validation and does not report which selections are responsible for returning zero results. -
run_past_timeoutboolean · default: false -
When
true, the options list query continues running even if it exceeds the configured timeout threshold. Defaults tofalse. -
search_techniqueenum · default: wildcard -
The matching technique used when searching available options.
prefixmatches values starting with the search term,wildcardmatches values containing the search term, andexactrequires a complete match. Only applies to string and IP fields. Defaults towildcard. -
Values:
prefixwildcardexact -
selected_options(number | string)[] · max items: 10000 · default: [] -
The list of currently selected option values.
-
single_selectboolean · default: false -
When
true, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults tofalse. -
configobjectrequired -
Log Pattern Analysis embeddable schema
-
data_view_idstring · min length: 1 · max length: 1000required -
The data view ID used for pattern analysis.
-
field_namestring · min length: 1 · max length: 1000required -
The text field on which to run pattern analysis.
-
minimum_time_rangeenum · default: no_minimum -
Minimum time range for pattern analysis.
-
Values:
no_minimum1_week1_month3_months6_months -
random_sampler_modeenum · default: on_automatic -
The random sampler mode.
-
Values:
on_automaticon_manualoff -
random_sampler_probabilitynumber · min: 1E-05 · max: 0.5 · default: nullnullable -
The probability to use for random sampling (between 0.00001 and 0.5).
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion oneOf -
One of:
(determined by
values_source) -
values_sourceenum · default: field -
The source of the field options for this control. Defaults to
fieldfor legacy controls. -
Values:
field -
data_view_idstring · min length: 1required -
The ID of the data view that provides field options for this control.
-
field_namestring · min length: 1required -
The name of the field in the data view that this control filters on.
-
ignore_validationsboolean · default: false -
When
true, the control skips selection validation and does not report which selections are responsible for returning zero results. -
configobjectrequired -
Single Metric Viewer embeddable
-
function_descriptionstring · max length: 1000 -
For detectors that use the
metricfunction, selects which value to plot:min,max, ormean. Ignored for other detector functions. When omitted, the viewer derives a default from the highest-scoring anomaly record. -
job_idsstring[] · min items: 1 · max items: 1required -
Anomaly detection job ID whose results are shown in the single metric viewer.
-
selected_detector_indexnumber · min: 0 · default: 0 -
Zero-based index of the detector (the Elasticsearch detector_index) within the job whose results are shown.
-
selected_entitiesmap string to string | number -
Values of the partition, by, or over fields that identify the single time series to display.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configobjectrequired -
SLO Alerts embeddable schema
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
configobjectrequired -
SLO Burn Rate embeddable schema
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
durationstring · max length: 32required -
Duration for the burn rate chart in the format [value][unit], e.g. 5m, 3h, or 6d
-
configobjectrequired -
SLO Error Budget embeddable schema
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
configunion oneOfrequired -
SLO Overview embeddable schema
-
One of:
(determined by
overview_mode) -
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
group_filtersobject · default: { "group_by": "status" } -
filtersunion oneOf[] · max items: 500 -
Same options as
filters -
configobjectrequired -
Synthetics stats overview embeddable schema
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
configunion anyOfrequired -
Lens embeddable schema
- Any of:
-
drilldownsunion anyOf[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
drilldownsunion anyOf[] · max items: 100 -
Same options as
drilldownsinBy value -
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
collapsedboolean · default: false -
When
true, the section is collapsed and its panels are not rendered until expanded. Useful for improving initial load time on large dashboards. Defaults tofalse. -
panelsunion oneOf[] · max items: 1000 -
The panels that belong to the section.
- One of:
-
configunion anyOfrequired -
Anomaly Swim Lane embeddable
-
Same options as
configinAnomaly swim lane -
configobjectrequired -
Change point detection chart embeddable schema
-
Same fields as
configinChange point detection chart -
configobjectrequired -
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion anyOfrequired -
Same options as
configinDiscover session -
configunion oneOfrequired -
Same options as
configinES|QL variable control -
configunion oneOfrequired -
Field statistics table embeddable schema
-
Same options as
configinField statistics table -
configobjectrequired -
Image embeddable schema
-
drilldownsunion anyOf[] · max items: 100 -
Same options as
drilldownsinconfig -
configobjectrequired -
Log rate analysis embeddable schema
-
data_view_idstring · min length: 1 · max length: 1000required -
The data view ID used to run log rate analysis.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion oneOf -
Same options as
configinOptions list control -
configobjectrequired -
Log Pattern Analysis embeddable schema
-
Same fields as
configinPattern analysis -
configunion oneOf -
Same options as
configinRange slider control -
configobjectrequired -
Single Metric Viewer embeddable
-
Same fields as
configinSingle metric viewer -
configobjectrequired -
Synthetics stats overview embeddable schema
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
pinned_panelsunion oneOf[] · max items: 100 -
An array of control panels and their state in the control group.
- One of:
-
configunion oneOfrequired -
Same options as
configinES|QL variable control -
configunion oneOf -
Same options as
configinOptions list control -
configunion oneOf -
Same options as
configinRange slider control -
project_routingstring -
Controls cross-project search behavior for this dashboard (Serverless only). Set to
_alias:_originto scope data to the current project, or_alias:*to search across all projects. When omitted, the space default applies. -
queryobject -
A search query consisting of an expression and its language. Supports KQL and Lucene syntax.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps.
A filter that evaluates a single field condition such as equality, range, or existence.
operator: is
Matches documents where field equals a single specified value.
operator: is_one_of
Matches documents where field equals any value in a provided list.
operator: range
Matches documents where field falls within a specified numeric or date range.
operator: exists
Matches documents where field exists and contains a non-null value.
A filter that combines multiple conditions or nested groups using a logical and or or operator.
A filter expressed as a raw Elasticsearch Query DSL object, used for queries that cannot be represented by condition or group filters.
A filter that applies an Elasticsearch geo query, used for geographic boundary and shape matching.
Panel configuration stored inline
url_drilldown
type: data_view_reference
type: data_view_spec
ES|QL (Elasticsearch Query Language) data source.
An ES|QL tab with saved metrics grid settings. The dashboard panel stores these settings and restores them in Discover. The panel does not render the metrics grid.
Panel configuration stored in a linked library item
url_drilldown
control_type: STATIC_VALUES
An ES|QL variable control with a fixed list of selectable options defined directly in available_options.
control_type: VALUES_FROM_QUERY
An ES|QL variable control whose selectable options are dynamically retrieved by running an ES|QL query.
view_type: dataview
view_type: esql
Panel configuration stored inline
Panel configuration stored in a linked library item
values_source: esql
An options list control whose available options come from an ES|QL query's results.
values_source: field
An options list control whose available options come from a data view field.
values_source: esql
A range slider control whose values come from an ES|QL query's results.
values_source: field
A range slider control whose values come from a numeric data view field.
url_drilldown
url_drilldown
url_drilldown
overview_mode: single
SLO Single Overview embeddable schema
url_drilldown
overview_mode: groups
SLO Group Overview embeddable schema
url_drilldown
url_drilldown
Panel configuration stored inline
Panel configuration stored in a linked library item
A collapsible group of panels.
url_drilldown
An ES|QL variable control whose selected value is injected into ES|QL visualizations using the ?variable_name syntax. Options can come from a fixed list or an ES|QL query. Define the options source in config.
A dropdown control that filters data by selecting field values from a data view. Define the data view, field, and selection settings in config.
A slider control that filters data by selecting a numeric range for the configured field. Define the data view, field, and selection settings in config.
A control panel that filters a time field to a selected sub-range of the global time range. Define the start and end positions in config as fractions of the global range (0 to 1).
Responses
created
-
dataobjectrequired -
esql_approximationboolean -
When
true, ES|QL visualizations that useSTATSrun with approximate execution for faster, estimated results. -
filtersunion oneOf[] · max items: 500 -
Filters applied across all panels, including pinned panels.
-
Same options as
filters -
optionsobject · default: { "auto_apply_filters": true, "hide_panel_borders": false, "hide_panel_titles": false, "sync_colors": false, "sync_cursor": true, "sync_tooltips": false, "use_margins": true } -
Display and behavior settings for the dashboard.
-
auto_apply_filtersboolean · default: true -
When
true, control filter changes are applied automatically. Whenfalse, control filter changes are applied manually through the dashboard's search update button. Defaults totrue. -
sync_colorsboolean · default: false -
When
true, colors are synchronized across panels that share a data source. Defaults tofalse. -
sync_cursorboolean · default: true -
When
true, the cursor position is synchronized across panels. Defaults totrue. -
panelsunion anyOf[] · max items: 1000 -
Panels and sections in the dashboard. Each entry is either a panel (with a
typeandconfig) or a collapsible section (with atitle,collapsedstate, and nestedpanels). -
Same options as
panels -
pinned_panelsunion oneOf[] · max items: 100 -
An array of control panels and their state in the control group.
-
Same options as
pinned_panels -
project_routingstring -
Controls cross-project search behavior for this dashboard (Serverless only). Set to
_alias:_originto scope data to the current project, or_alias:*to search across all projects. When omitted, the space default applies. -
queryobject -
A search query consisting of an expression and its language. Supports KQL and Lucene syntax.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps.
invalid request
forbidden