ELK Stack — Data Views

5 minute read

Introduction

A Data View (formerly called an index pattern) is the foundation of every Kibana query. It tells Kibana which Elasticsearch indices to search, which field to use as the primary timestamp, and how to format or enrich fields before they reach a visualization. Every Discover session, dashboard panel, and alerting rule starts with a data view.

In this section you will learn how to create data views with wildcards, add runtime fields, format fields, manage data views through the API, and set up cross-cluster data views.

What Changed — Index Patterns to Data Views

Starting with Kibana 8.0, index patterns were renamed to data views. The underlying concept is identical, but the new term better reflects their purpose — they are a logical view over one or more Elasticsearch data streams or indices.

Legacy Term Current Term Notes
Index pattern Data view Same functionality, new name
Index pattern ID Data view ID Used in saved objects and API
Management → Index Patterns Management → Data Views UI location changed

Creating Data Views

Via the UI

  1. Open Stack Management → Data Views
  2. Click Create data view
  3. Enter a name — e.g., web-logs
  4. Enter the index pattern — e.g., web-logs-*
  5. Select the timestamp field — e.g., @timestamp
  6. Optionally enable Allow hidden and system indices
  7. Click Save data view to Kibana

Wildcard Patterns

Data views support standard index wildcards:

Pattern Matches
logs-* All indices starting with logs-
logs-2026.* logs-2026.01, logs-2026.02, etc.
logs-*,-logs-debug-* All logs- indices except debug
metrics-*,apm-* Multiple prefixes in one data view

Choosing a Timestamp Field

Every data view can optionally have a primary timestamp field. This field powers:

  • Time range filters in Discover and dashboards
  • Time-series visualizations (line charts, TSVB, Lens)
  • Alerting rule evaluation windows

If your index has no timestamp (e.g., a lookup table), select I don’t want to use the time filter.

Runtime Fields in Data Views

Runtime fields let you create computed fields at query time — no reindexing required. They are defined using Painless scripts and evaluated on the fly.

Adding a Runtime Field via the UI

  1. Open Stack Management → Data Views
  2. Select your data view
  3. Click Add field (top-right)
  4. Toggle Set value to enable the script editor
  5. Choose the field type (Keyword, Long, Double, Date, IP, Boolean, Geo Point)
  6. Write the Painless script

Example — Extract HTTP status class:

if (doc['http.response.status_code'].size() > 0) {
  int code = doc['http.response.status_code'].value;
  if (code >= 200 && code < 300) emit('2xx');
  else if (code >= 300 && code < 400) emit('3xx');
  else if (code >= 400 && code < 500) emit('4xx');
  else if (code >= 500) emit('5xx');
  else emit('other');
}

Set the type to Keyword and name the field http.status_class.

Adding a Runtime Field via the API

POST kbn:/api/data_views/data_view/web-logs/runtime_field
{
  "name": "http.status_class",
  "runtimeField": {
    "type": "keyword",
    "script": {
      "source": "if (doc['http.response.status_code'].size() > 0) { int code = doc['http.response.status_code'].value; if (code >= 200 && code < 300) emit('2xx'); else if (code >= 400 && code < 500) emit('4xx'); else if (code >= 500) emit('5xx'); else emit('other'); }"
    }
  }
}

Runtime fields are perfect for enrichment without changing your ingest pipeline — for example, tagging high-latency requests or classifying log levels.

Field Formatting

Kibana lets you override how field values are displayed without changing the underlying data.

Common Formatters

Field Type Formatter Example
Number Bytes 1073741824 → 1.00 GB
Number Duration 3600000 → 1 hour
Number Percent 0.85 → 85%
String URL Render value as clickable link
String Color Apply background color by regex
Date Date Custom date format string

Setting a Field Format

  1. Open your data view in Stack Management → Data Views
  2. Find the field and click the pencil icon
  3. Under Format, choose the desired formatter
  4. Configure formatter options (e.g., pattern, colors)
  5. Click Save field

Scripted Fields (Deprecated)

Scripted fields were the predecessor to runtime fields. They are now deprecated and should be migrated to runtime fields.

Key differences:

Feature Scripted Fields Runtime Fields
Status Deprecated Active
Defined in Kibana only Kibana or Elasticsearch
Performance Computed on display Computed at query time
Aggregation Limited Full aggregation support
Migration Manual Use “Add field” with script

To migrate a scripted field, recreate it as a runtime field with the same Painless script.

Managing Data Views via API

The Kibana Data Views API allows full CRUD operations — essential for automation and infrastructure-as-code workflows.

Create a Data View

curl -X POST "https://localhost:5601/api/data_views/data_view" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -u elastic:changeme \
  -d '{
    "data_view": {
      "title": "filebeat-*",
      "timeFieldName": "@timestamp",
      "name": "Filebeat Logs"
    }
  }'

List All Data Views

curl -X GET "https://localhost:5601/api/data_views" \
  -H "kbn-xsrf: true" \
  -u elastic:changeme

Get a Specific Data View

curl -X GET "https://localhost:5601/api/data_views/data_view/<DATA_VIEW_ID>" \
  -H "kbn-xsrf: true" \
  -u elastic:changeme

Delete a Data View

curl -X DELETE "https://localhost:5601/api/data_views/data_view/<DATA_VIEW_ID>" \
  -H "kbn-xsrf: true" \
  -u elastic:changeme

Data Views for Data Streams

When using data streams (ILM-managed time-series indices), data views work seamlessly:

  • Pattern logs-* matches the data stream logs-nginx-default and all its backing indices
  • The timestamp field is always @timestamp for data streams
  • Rollover is transparent — Kibana queries all backing indices automatically

Best practice: Name your data view after the data stream namespace — e.g., logs-nginx-* for all Nginx data streams.

Cross-Cluster Data Views

If you have configured Cross-Cluster Search (CCS), you can create data views that span multiple clusters:

Pattern Syntax

<remote_cluster_name>:<index_pattern>

Examples:

Pattern Description
us-east:logs-* Logs from the us-east remote cluster
*:logs-* Logs from all connected remote clusters
us-east:logs-*,logs-* Logs from remote us-east and the local cluster

Setup Steps

  1. Configure remote cluster connections in Stack Management → Remote Clusters
  2. Create a new data view with the cross-cluster pattern
  3. Select the timestamp field
  4. Use the data view in Discover, dashboards, or alerting as usual

Note: Cross-cluster data views require the remote clusters to be reachable and authenticated. Network latency will affect query performance.

Data View Settings

Each data view has additional settings accessible via the Settings tab:

Setting Description
Name Display name in the data view picker
Custom ID Override the auto-generated ID (useful for automation)
Allow hidden indices Include hidden indices like .kibana
Namespace Associate with a specific Kibana Space

Quick Reference

Task Method
Create data view Stack Management → Data Views → Create
Add runtime field Data View → Add field → Set value
Format a field Data View → field → pencil icon → Format
Create via API POST /api/data_views/data_view
Cross-cluster pattern remote_name:index-*
Exclude indices logs-*,-logs-debug-*
Migrate scripted field Recreate as runtime field
Data stream data view Use data stream name as pattern

Next: Canvas and Maps →

You may also enjoy