Kibana Data Views API Skill#

Manage Kibana Data Views (formerly "index patterns") via the Kibana REST API.

Base URL#

text

http://<kibana-host>/api/data_views

For Omni-Monitor: http://192.168.99.43/api/data_views

Authentication#

Kibana API requires kbn-xsrf: true header. For authenticated requests, use Kibana's session cookie or Basic auth.

---

API Endpoints#

1. List All Data Views#

text

GET /api/data_views

Response:

json

{
  "data_views": [
    {
      "id": "...",
      "title": "zbx-metrics-*",
      "name": "Zabbix Metrics",
      "timeFieldName": "@timestamp"
    }
  ]
}

2. Get a Data View#

text

GET /api/data_views/{viewId}

Path Parameters:

• viewId (string, required): Data view identifier

Response 200:

json

{
  "data_view": {
    "id": "...",
    "title": "zbx-metrics-*",
    "name": "Zabbix Metrics",
    "timeFieldName": "@timestamp",
    "fields": {...}
  }
}

3. Create a Data View#

text

POST /api/data_views/data_view

Headers:

• kbn-xsrf: true (required)
• Content-Type: application/json

Request Body:

json

{
  "data_view": {
    "title": "zbx-metrics-*",
    "name": "Zabbix Metrics",
    "timeFieldName": "@timestamp",
    "allowNoIndex": true
  }
}

Response 200: Returns created data_view object

Response 400: Bad request (e.g., duplicate title)

4. Update a Data View#

text

PUT /api/data_views/{viewId}

Path Parameters:

• viewId (string, required): Data view identifier

Request Body:

json

{
  "data_view": {
    "title": "zbx-metrics-*",
    "name": "Zabbix Metrics Updated",
    "timeFieldName": "@timestamp"
  }
}

5. Delete a Data View#

text

DELETE /api/data_views/{viewId}

Headers:

• kbn-xsrf: true (required)

Response 204: Successfully deleted

Response 404: Data view not found

6. Check if Data View Exists (by title)#

text

GET /api/data_views

Then search results for matching title.

7. Validate Index Pattern#

text

POST /api/data_views/validate

Check if indices exist without creating a data view.

---

Common Data View Titles for Omni-Monitor#

TitleDescriptionzbx-metrics-*Zabbix CPU/Memory/Disk metricszbx-hosts-*Zabbix hostszbx-problems-*Zabbix problemszbx-triggers-*Zabbix triggersk8s-pod-logs-*K8s pod logsk8s-audit-logs-*K8s audit logsvm-system-logs-*VM system logsingress-nginx-logs-*Ingress nginx logs*-logs-*All logs

---

Usage with Kibana Proxy#

When accessing Kibana API from external tool, you may need to proxy through Kibana:

text

http://192.168.99.43/api/console/proxy?path=<encoded-path>&method=<GET|POST|PUT|DELETE>

Example - List data views via proxy:

text

GET http://192.168.99.43/api/console/proxy?path=%2Fapi%2Fdata_views&method=GET

---

Troubleshooting Lens "indexpattern" Errors#

If Lens fails with error Cannot read properties of undefined (reading 'indexpattern'):

1. Check if data view exists:

bash

curl -s "http://192.168.99.43/api/data_views" \
  -H "kbn-xsrf: true"

1. Check data view ID matches what dashboard references:
   • Dashboard references contain indexpattern-datasource-layer-<uuid> references
   • The uuid must match a real data view ID
2. Recreate missing data view:

bash

curl -X POST "http://192.168.99.43/api/data_views/data_view" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
    "data_view": {
      "title": "zbx-metrics-*",
      "name": "Zabbix Metrics",
      "timeFieldName": "@timestamp",
      "allowNoIndex": true
    }
  }'

1. Check .kibana index health:

bash

# Query from within k8s cluster
kubectl exec -n elastic elasticsearch-0 -- curl -s -u 'elastic:Changeme123' \
  'http://localhost:9200/.kibana/_search?size=100' \
  -H 'Content-Type: application/json' \
  -d '{"query": {"prefix": {"type": "index-pattern"}}}'

---

Scripts#

ScriptPurposelist_data_views.pyList all data views from Kibanacreate_data_view.pyCreate a new data viewdelete_data_view.pyDelete a data viewcheck_and_fix_data_views.pyDiagnose and fix missing data views

---

See Also#

• kibana-lens-builder - Create Lens visualizations and dashboards