Create a data view

Create a data view to make your own Elasticsearch data available in Discover, Lens, and other analytics features.

• You need a role with the Data View Management Kibana privilege and the view_index_metadata Elasticsearch privilege. Refer to Defining roles.
• If a read-only indicator appears, you don't have sufficient privileges to create or save data views, and the buttons to do so aren't visible.
• You need data already indexed into Elasticsearch. Some workflows create a data view for you automatically instead — refer to Data views.

1. Open Lens or Discover, and then open the data view menu.

   
   ×

2. Select Create a data view.

3. Give your data view a name.

4. Start entering text in the Index pattern field, and Kibana looks for the names of indices, data streams, and aliases that match your input. You can view all available sources or only the sources that the data view targets.

   • To match multiple sources, use a wildcard (*). filebeat-* matches filebeat-apache-a, filebeat-apache-b, and so on.
   • To match multiple single sources, enter their names, separated by a comma. Do not include a space after the comma. filebeat-a,filebeat-b matches two indices.
   • To exclude a source, use a minus sign (-), for example, -test3.
   • To search across clusters or projects, or to point to a rollup index, refer to Data view search syntax.

5. Open the Timestamp field dropdown, and then select the default field for filtering your data by time.

   • If you don't set a default time field, you can't use global time filters on your dashboards. This is useful if you have multiple time fields and want to create dashboards that combine visualizations based on different timestamps.
   • If your index doesn't have time-based data, select I don't want to use the time filter.

6. Select Show advanced settings to:

   • Allow hidden and system indices.
   • Set a Custom data view ID. By default, Kibana assigns a randomly generated ID to the data view saved object. Setting a custom, human-readable ID (for example, logs-prod) makes the data view easier to recreate with the same ID across spaces, deployments, or environments, so that dashboards and visualizations that reference it keep working. Refer to Manage dashboards as code for how stable IDs keep dashboards portable.

7. Select Save data view to Kibana.

You can now select your new data view from the data view menu in Discover, Lens, and other analytics features. Manage it from the Data Views page under the Management menu.

Want to explore your data or create a visualization without saving it as a data view? Select Use without saving in the Create data view form in Discover or Lens. With a temporary data view, you can add fields and create an Elasticsearch query alert, the same way you would with a regular data view. Your work isn't visible to others in your space.

A temporary data view remains in your space until you change apps, or until you save it.

×

• Data view search syntax
• Data views
• Delete a data view
• Duplicate a data view