Loading

Data views

By default, analytics features such as Discover require a data view to access the Elasticsearch data that you want to explore. A data view can point to one or more indices, data streams, or index aliases. For example, a data view can point to your log data from yesterday, or all indices that contain your data.

Note

In certain apps, you can also query your Elasticsearch data using ES|QL. With ES|QL, data views aren't required.

There are three ways a data view ends up in your space:

  • Created for you — Some workflows create a data view automatically. Adding sample data, uploading a file, and running some machine learning data frame analytics jobs each create one for you, ready to use in Discover and Lens. These are ordinary data views that you can edit like any other. Installing an Elastic integration through Fleet also creates data views for you, but those are managed by Elastic (see below).
  • Created by you — For your own data, you often need to create the data view yourself. Refer to Create a data view.
  • Managed by Elastic — Some data views are configured and managed by Elastic, for example by Fleet integrations, Elastic Security, and Cases. Managed data views carry a Managed tag. You can view and use them, but you can't edit them, and you can't delete them either. If you'd like to use a modified version of a managed data view, duplicate it and edit the copy instead.

Not sure whether you already have one? Open the data view menu in Discover or Lens, or go to the Data Views management page: both list every data view available in your space.

To point a data view at another cluster, another project, or a rollup index, refer to Data view search syntax.