StreamsClient¶

Client for the Kibana Streams API.

Streams provide a single-pane experience to manage log (and other) data in Elasticsearch: routing (wired streams), processing pipelines, field mappings, lifecycle, significant-events queries and linked attachments (dashboards, rules, SLOs).

Note

All Streams APIs are marked as technical preview in Kibana 9.4 and may change in future releases.

Streams must be enabled first (see enable()); once enabled, Kibana manages wired root streams (in 9.4 these are logs.ecs and logs.otel) from which child streams can be forked.

Streams are space-scoped: every method accepts an optional space_id to target a specific space.

class kibana._sync.client.streams.StreamsClient(client, default_space_id=None, validate_spaces=True)[source]¶

Bases: NamespaceClient

Client for the Kibana Streams API.

All Streams APIs are marked as Technical Preview in Kibana 9.4 and may change in future releases. Streams must be enabled first (see enable()); once enabled, Kibana manages wired root streams (in 9.4 these are logs.ecs and logs.otel) from which child streams can be forked.

Streams are space-scoped: every method accepts an optional space_id to target a specific space (None targets the default space or the space the client is scoped to).

Example

>>> from kibana import Kibana
>>> client = Kibana("http://localhost:5601", api_key="...")
>>>
>>> # Enable streams, then fork a child stream from the ECS root
>>> client.streams.enable()
>>> client.streams.fork(
...     name="logs.ecs",
...     stream_name="logs.ecs.myapp",
...     where={"field": "service.name", "eq": "myapp"},
... )
>>> streams = client.streams.get_all()
>>> print([s["name"] for s in streams.body["streams"]])

Enabling Streams and Forking

from kibana import Kibana

client = Kibana("http://localhost:5601", api_key="your_api_key")

# Enable streams, then fork a child stream from the ECS root
client.streams.enable()
client.streams.fork(
    name="logs.ecs",
    stream_name="logs.ecs.myapp",
    where={"field": "service.name", "eq": "myapp"},
)

# List all streams
streams = client.streams.get_all()
print([s["name"] for s in streams.body["streams"]])

# Disable streams again (removes stream management)
client.streams.disable()

Reading and Updating Stream Definitions

# Get a stream definition (routing, processing, lifecycle, ...)
stream = client.streams.get(name="logs.ecs.myapp")

# Get only the ingest configuration
ingest = client.streams.get_ingest(name="logs.ecs.myapp")

# Delete a stream
client.streams.delete(name="logs.ecs.myapp")

Significant Events Queries

# Add a significant-events query (ES|QL) to a stream
client.streams.upsert_query(
    name="logs.ecs.myapp",
    query_id="failed-logins",
    title="Failed logins",
    esql='FROM logs.ecs.myapp | WHERE event.outcome == "failure"',
)

# List queries attached to a stream
queries = client.streams.get_queries(name="logs.ecs.myapp")

# Read significant events
events = client.streams.get_significant_events(
    name="logs.ecs.myapp",
    from_="2026-07-01T00:00:00.000Z",
    to="2026-07-03T00:00:00.000Z",
    bucket_size="1h",
)

Attachments

Link Kibana assets (dashboards, rules, SLOs) to a stream:

# Link a dashboard to a stream
client.streams.link_attachment(
    name="logs.ecs.myapp",
    attachment_id="my-dashboard-id",
    attachment_type="dashboard",
)

# List attachments
attachments = client.streams.get_attachments(name="logs.ecs.myapp")

# Unlink it again
client.streams.unlink_attachment(
    name="logs.ecs.myapp",
    attachment_id="my-dashboard-id",
    attachment_type="dashboard",
)

__init__(client, default_space_id=None, validate_spaces=True)[source]¶

Initialize the StreamsClient.

Parameters:

client (Kibana) – The parent Kibana client instance to delegate requests to.
default_space_id (str | None) – Optional default space ID for all operations.
validate_spaces (bool) – Whether to validate space existence before space-scoped operations (default: True).

Example

>>> streams_client = StreamsClient(kibana_client)

enable(*, space_id=None, validate_spaces=None)[source]¶

Enable streams.

Technical preview in 9.4. Enables the wired streams framework: Kibana creates the root streams (logs.ecs and logs.otel in 9.4) and the Elasticsearch resources backing them. The call is idempotent — enabling an already-enabled deployment is a no-op.

Parameters:

space_id (str | None) – Optional space ID to run the operation in.
validate_spaces (bool | None) – Override space validation setting for this operation.

Returns:

ObjectApiResponse with acknowledged and result ("created" when newly enabled, "noop" when already enabled).

Raises:

AuthenticationException – If authentication fails.
AuthorizationException – If insufficient privileges.

Return type:

StreamsClient¶

AsyncStreamsClient¶