Create a data view

Base URL: https://{kibana_url}

POST /api/data_views/data_view
POST /s/{space_id}/api/data_views/data_view

Auth

Create a data view. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. To learn more, refer to the data views documentation.

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required: Cross-site request forgery protection

Request body

data_view object required: The data view object.
override boolean · default: false: Override an existing data view if a data view with the provided title already exists.

Responses

Indicates a successful call.

application/json

data_view object

Bad request

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn://api/data_views/data_view
{"data_view":{"title":"logstash-*","name":"My Logstash data view"}}

curl Shell

curl \
  -X POST "${KIBANA_URL}/api/data_views/data_view" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{"data_view":{"title":"logstash-*","name":"My Logstash data view"}}'

Response

No example

{
  "error": "Bad Request",
  "message": "[request body.data_view.title]: expected value of type [string] but got [undefined]",
  "statusCode": 400
}

Request Console 1 / 2 languages

Create a data view for logstash indices that includes a runtime field which extracts the shape name from a source field.

Console Kibana Dev Tools

POST kbn:/api/data_views/data_view
{
  "data_view": {
    "name": "My Logstash data view",
    "runtimeFieldMap": {
      "runtime_shape_name": {
        "script": {
          "source": "emit(doc[\u0027shape_name\u0027].value)"
        },
        "type": "keyword"
      }
    },
    "title": "logstash-*"
  }
}

Generated from the API spec

curl Shell

curl \
  -X POST "${KIBANA_URL}/api/data_views/data_view" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
    "data_view": {
      "name": "My Logstash data view",
      "runtimeFieldMap": {
        "runtime_shape_name": {
          "script": {
            "source": "emit(doc[\u0027shape_name\u0027].value)"
          },
          "type": "keyword"
        }
      },
      "title": "logstash-*"
    }
  }'

Generated from the API spec

Response

The response includes the full data view specification, including auto-generated fields such as the unique identifier and version.

{
  "data_view": {
    "allowNoIndex": false,
    "fieldAttrs": {},
    "fieldFormats": {},
    "fields": {
      "runtime_shape_name": {
        "aggregatable": true,
        "count": 0,
        "esTypes": [
          "keyword"
        ],
        "format": {
          "id": "string"
        },
        "name": "runtime_shape_name",
        "readFromDocValues": false,
        "runtimeField": {
          "script": {
            "source": "emit(doc[\u0027shape_name\u0027].value)"
          },
          "type": "keyword"
        },
        "scripted": false,
        "searchable": true,
        "shortDotsEnable": false,
        "type": "string"
      }
    },
    "id": "b561acfb-0181-455e-84a3-ce8980b2272f",
    "name": "My Logstash data view",
    "namespaces": [
      "default"
    ],
    "runtimeFieldMap": {
      "runtime_shape_name": {
        "script": {
          "source": "emit(doc[\u0027shape_name\u0027].value)"
        },
        "type": "keyword"
      }
    },
    "sourceFilters": [],
    "title": "logstash-*",
    "typeMeta": {},
    "version": "WzQ5LDJd"
  }
}

{
  "error": "Bad Request",
  "message": "[request body.data_view.title]: expected value of type [string] but got [undefined]",
  "statusCode": 400
}