DataViewsClient¶

Client for the Kibana Data Views API.

Data views (formerly index patterns) tell Kibana which Elasticsearch indices, data streams, and aliases to query. This client covers the full Kibana 9.4 data views surface: data view CRUD, field metadata updates, runtime field management, the default data view, and saved object reference swapping.

All operations are space-aware: pass space_id to target a specific Kibana space, or use client.space("my-space").data_views.

class kibana._sync.client.data_views.DataViewsClient(client, default_space_id=None, validate_spaces=True)[source]¶

Bases: NamespaceClient

Client for the Kibana Data Views API.

Data views (formerly index patterns) tell Kibana which Elasticsearch indices, data streams, and aliases to query. This client covers the full Kibana 9.4.3 data views surface: data view CRUD, field metadata updates, runtime field management, the default data view, and saved object reference swapping.

All operations are space-aware: pass space_id to target a specific Kibana space, or use client.space("my-space").data_views.

Example

>>> from kibana import Kibana
>>> client = Kibana("http://localhost:5601", api_key="...")
>>>
>>> # Create a data view over an index
>>> response = client.data_views.create(
...     data_view={
...         "title": "my-logs-*",
...         "name": "My Logs",
...         "timeFieldName": "@timestamp",
...     }
... )
>>> view_id = response["data_view"]["id"]
>>>
>>> # Add a runtime field
>>> client.data_views.create_runtime_field(
...     view_id=view_id,
...     name="hour_of_day",
...     runtime_field={
...         "type": "long",
...         "script": {
...             "source": "emit(doc['@timestamp'].value.getHour())"
...         },
...     },
... )

Creating Data Views

Create a data view with the create() method:

from kibana import Kibana

client = Kibana("http://localhost:5601", api_key="your_api_key")

# Create a data view over an index pattern
response = client.data_views.create(
    data_view={
        "title": "my-logs-*",
        "name": "My Logs",
        "timeFieldName": "@timestamp",
    }
)

view_id = response["data_view"]["id"]
print(f"Created data view: {view_id}")

Retrieving Data Views

# List all data views
views = client.data_views.get_all()
for view in views.body["data_view"]:
    print(view["id"], view.get("name") or view["title"])

# Get a single data view
view = client.data_views.get(view_id=view_id)
print(view.body["data_view"]["title"])

Runtime Fields

Manage runtime fields on a data view:

# Add a runtime field
client.data_views.create_runtime_field(
    view_id=view_id,
    name="hour_of_day",
    runtime_field={
        "type": "long",
        "script": {
            "source": "emit(doc['@timestamp'].value.getHour())"
        },
    },
)

# Read it back
field = client.data_views.get_runtime_field(
    view_id=view_id, name="hour_of_day"
)

# Update or delete it
client.data_views.update_runtime_field(
    view_id=view_id,
    name="hour_of_day",
    runtime_field={
        "script": {
            "source": "emit(doc['@timestamp'].value.getHour() + 1)"
        }
    },
)
client.data_views.delete_runtime_field(
    view_id=view_id, name="hour_of_day"
)

Default Data View

# Get the current default data view ID
default = client.data_views.get_default()
print(default.body["data_view_id"])

# Set the default data view
client.data_views.set_default(data_view_id=view_id)

Deleting Data Views

client.data_views.delete(view_id=view_id)

Warning

Deleting a data view is a permanent operation and cannot be undone.

get_all(*, space_id=None, validate_spaces=None)[source]¶

Get all data views.

Retrieves a list of all data views in the space, with their identifiers, titles, names, and namespaces.

Parameters:

space_id (str | None) – Optional space ID to scope the operation to.
validate_spaces (bool | None) – Override space-existence validation for this call.

Returns:

Response with a data_view array of data view summaries.

Raises:

AuthenticationException – If authentication fails.
AuthorizationException – If insufficient privileges.

Return type:

DataViewsClient¶

AsyncDataViewsClient¶