Get a dashboard
- Base URL
-
https://{kibana_url}
- GET /api/dashboards/{id}
- GET /s/{space_id}/api/dashboards/{id}
Returns the complete state of a dashboard by ID.
Path parameters
-
space_idstringoptional -
An identifier for the space. If
space_idis not provided in the URL, the default space is used. Refer to Spaces for more information.
Responses
success
-
dataobjectrequired -
esql_approximationboolean -
When
true, ES|QL visualizations that useSTATSrun with approximate execution for faster, estimated results. -
filtersunion oneOf[] · max items: 500 -
Filters applied across all panels, including pinned panels.
- One of:
-
conditionunion oneOfrequired -
A filter condition with strict operator/value type matching.
-
One of:
(determined by
operator) -
negateboolean -
When
true, the filter is negated and matches documents that do NOT satisfy the condition. Defaults tofalse. -
valueobjectrequired -
Boundary values for a range comparison.
-
formatstring -
Elasticsearch date format string applied when parsing date boundary values. For example,
strict_date_optional_timeorepoch_millis. -
controlled_bystring -
Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.
-
disabledboolean -
When
true, the filter is inactive and does not affect query results. Defaults tofalse. -
controlled_bystring -
Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.
-
disabledboolean -
When
true, the filter is inactive and does not affect query results. Defaults tofalse. -
fieldstring -
Field name for scripted filters where the field cannot be extracted from the DSL query.
-
is_multi_indexboolean -
When
true, the filter can be applied across multiple indices. Defaults tofalse. -
optionsobject -
Display and behavior settings for the dashboard.
-
Default:
{"auto_apply_filters":true,"hide_panel_borders":false,"hide_panel_titles":false,"sync_colors":false,"sync_cursor":true,"sync_tooltips":false,"use_margins":true} -
auto_apply_filtersboolean · default: true -
When
true, control filter changes are applied automatically. Whenfalse, control filter changes are applied manually through the dashboard's search update button. Defaults totrue. -
sync_colorsboolean · default: false -
When
true, colors are synchronized across panels that share a data source. Defaults tofalse. -
sync_cursorboolean · default: true -
When
true, the cursor position is synchronized across panels. Defaults totrue. -
panelsunion anyOf[] · max items: 1000 -
Panels and sections in the dashboard. Each entry is either a panel (with a
typeandconfig) or a collapsible section (with atitle,collapsedstate, and nestedpanels). - Any of:
-
configobjectrequired -
Anomaly Charts embeddable
-
job_idsstring[] · min items: 1 · max items: 10000required -
Anomaly detection job or group IDs whose results are shown in the charts.
-
severity_thresholdunion anyOf[] · max items: 5 -
Severity threshold ranges used to filter anomaly results.
- Any of:
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion anyOfrequired -
Anomaly Swim Lane embeddable
- Any of:
-
job_idsstring[] · min items: 1 · max items: 10000required -
IDs of the anomaly detection jobs or groups whose results are shown in the swim lane.
-
per_pagenumber · min: 1 -
Number of rows to display per page in a view-by swim lane. Ignored for overall swim lanes.
-
severity_thresholdnumber · min: 0 · max: 100 -
Minimum anomaly score (0–100) to show in the swim lane. Anomalies with scores at or above this value are displayed.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
job_idsstring[] · min items: 1 · max items: 10000required -
IDs of the anomaly detection jobs or groups whose results are shown in the swim lane.
-
per_pagenumber · min: 1 -
Number of rows to display per page in a view-by swim lane. Ignored for overall swim lanes.
-
severity_thresholdnumber · min: 0 · max: 100 -
Minimum anomaly score (0–100) to show in the swim lane. Anomalies with scores at or above this value are displayed.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configobjectrequired -
APM service map embeddable schema
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configobjectrequired -
Change point detection chart embeddable schema
-
aggregation_functionenum · default: avg -
The aggregation function used to calculate the metric values.
-
Values:
avgsumminmax -
data_view_idstring · min length: 1 · max length: 10000required -
The data view ID used to run change point detection.
-
max_series_to_plotinteger · min: 1 · max: 50 · default: 6 -
The maximum number of change points to visualize. Defaults to 6.
-
metric_fieldstring · min length: 1 · max length: 10000required -
The metric field used by the aggregation function.
-
split_fieldstring · min length: 1 · max length: 10000 -
The optional field used to split change point results.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configobjectrequired -
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion anyOfrequired - Any of:
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
tabsunion anyOf[] · min items: 1 · max items: 1required -
Inline tab configuration. Used when no
ref_idis set. Currently supports one tab. - Any of:
-
column_orderstring[] · max items: 100 -
Ordered list of field names to display in the data table. If omitted, defaults to the
defaultColumnsadvanced setting. -
column_settingsmap string to object -
Per-column settings keyed by field name, such as width. Keys should correspond to entries in
column_orderwhen both are set. -
data_sourceunion oneOfrequired -
The data view used by the tab, specified by reference or defined inline.
-
One of:
(determined by
type) -
field_filtersstring[] · max items: 10000 -
Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as
user*which filters fields starting with 'user'. -
field_settingsmap string to anyOf -
Settings for individual fields, keyed by field name. To change how Kibana displays a field from the backing indices, set its label, description, or format. To define a runtime field, use the runtime field name and set
type. -
<string>union anyOf -
fieldsmap string to objectrequired -
<string>object -
custom_descriptionstring · min length: 1 -
Add a description to the field. It's displayed next to the field on the Discover, Lens, and Data View Management pages.
-
custom_labelstring · min length: 1 -
Create a label to display in place of the field name in Discover, Maps, Lens, Visualize, and TSVB. Useful for shortening a long field name. Queries and filters use the original field name.
-
formatunion anyOf -
Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover.
- Any of:
-
paramsobject -
patternstring -
Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more.
-
paramsunion oneOfrequired -
One of:
(determined by
field_type) -
patternstring -
Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more.
-
paramsobject -
patternstring · default: MMM D, YYYY @ HH:mm:ss.SSSSSSSSS -
Moment.js format pattern. See https://momentjs.com/ to learn more.
-
paramsobject -
patternstring · default: MMM D, YYYY @ HH:mm:ss.SSS -
Moment.js format pattern. See https://momentjs.com/ to learn more.
-
paramsobjectrequired -
include_space_with_suffixboolean · default: true -
When true or not provided, the formatted duration includes a space between the value and suffix. When false, no space is included.
-
input_formatenumrequired -
The unit of the field value before formatting.
-
Values:
picosecondsnanosecondsmicrosecondsmillisecondssecondsminuteshoursdaysweeksmonthsyears -
output_formatenumrequired -
The unit to convert the field value into for display.
-
Values:
humanizehumanize_preciseas_millisecondsas_secondsas_minutesas_hoursas_daysas_weeksas_monthsas_years -
paramsobjectrequired -
patternstring -
Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more.
-
paramsobject -
patternstring -
Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more.
-
paramsobject -
patternstring -
Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more.
-
paramsunion oneOfrequired -
One of:
(determined by
type) -
label_templatestring -
The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are:
{{value}},{{rawValue}}and{{url}}. For example: "{{value}}". -
open_link_in_current_tabboolean -
When true, the URL opens in the current tab. When false or not provided, the URL opens in a new tab.
-
url_templatestring -
The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are:
{{value}},{{rawValue}}and{{risonValue}}. Use{{risonValue}}when embedding the field value inside Kibana app URL rison state (for example: query:'{{risonValue}}'). For example: "https://example.com/{{value}}". -
heightnumber -
The height of the image. If not provided, the image will be displayed at the original height.
-
label_templatestring -
The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are:
{{value}},{{rawValue}}and{{url}}. For example: "{{value}}". -
url_templatestring -
The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are:
{{value}},{{rawValue}}and{{risonValue}}. Use{{risonValue}}when embedding the field value inside Kibana app URL rison state (for example: query:'{{risonValue}}'). For example: "https://example.com/{{value}}". -
label_templatestring -
The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are:
{{value}},{{rawValue}}and{{url}}. For example: "{{value}}". -
url_templatestring -
The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are:
{{value}},{{rawValue}}and{{risonValue}}. Use{{risonValue}}when embedding the field value inside Kibana app URL rison state (for example: query:'{{risonValue}}'). For example: "https://example.com/{{value}}". -
custom_descriptionstring · min length: 1 -
Add a description to the field. It's displayed next to the field on the Discover, Lens, and Data View Management pages.
-
custom_labelstring · min length: 1 -
Create a label to display in place of the field name in Discover, Maps, Lens, Visualize, and TSVB. Useful for shortening a long field name. Queries and filters use the original field name.
-
formatunion anyOf -
Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover.
-
Same options as
formatinfields -
custom_descriptionstring · min length: 1 -
Add a description to the field. It's displayed next to the field on the Discover, Lens, and Data View Management pages.
-
custom_labelstring · min length: 1 -
Create a label to display in place of the field name in Discover, Maps, Lens, Visualize, and TSVB. Useful for shortening a long field name. Queries and filters use the original field name.
-
formatunion anyOf -
Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover.
-
Same options as
formatinfields -
index_patternstring · min length: 1required -
The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".
-
default_rendered_nodesnumber · min: 10 · max: 200 -
The number of nodes each JSON cell renders by default in the JSON document view.
-
densityenum -
The table row spacing. If omitted, Kibana determines the density from its current settings, such as the user preference.
-
Values:
compactexpandednormal -
documents_display_modeenum -
How documents are shown:
tablefor a formatted table orjsonfor a raw JSON tree. -
Values:
tablejson -
filtersunion oneOf[] · max items: 100 · default: [] -
List of filters to apply to the data in the tab.
-
Same options as
filtersindata -
header_row_heightunion number | enum -
The table header row height, as a number of lines, or
autoto size it based on content. If omitted, Kibana determines the height from its current settings, such as the user preference. -
Values:
auto -
queryobject -
A search query consisting of an expression and its language. Supports KQL and Lucene syntax.
-
row_heightunion number | enum -
The table data row height, as a number of lines, or
autoto size it based on content. If omitted, defaults to thediscover:rowHeightOptionadvanced setting. -
Values:
auto -
rows_per_pagenumber · min: 1 · max: 10000 -
The number of rows to display per page in the data table. If omitted, defaults to the
discover:sampleRowsPerPageadvanced setting. Has no effect on ES|QL tabs. -
sample_sizenumber · min: 10 · max: 10000 -
The number of documents to sample for the data table. If omitted, defaults to the
discover:sampleSizeadvanced setting. -
sortobject[] · max items: 100 · default: [] -
Sort configuration for the data table (field and direction).
-
typeenum · default: default -
The tab type.
defaulttabs have no type-specific settings. -
Values:
default -
column_orderstring[] · max items: 100 -
Ordered list of field names to display in the data table. If omitted, defaults to the
defaultColumnsadvanced setting. -
column_settingsmap string to object -
Per-column settings keyed by field name, such as width. Keys should correspond to entries in
column_orderwhen both are set. -
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
default_rendered_nodesnumber · min: 10 · max: 200 -
The number of nodes each JSON cell renders by default in the JSON document view.
-
densityenum -
The table row spacing. If omitted, Kibana determines the density from its current settings, such as the user preference.
-
Values:
compactexpandednormal -
documents_display_modeenum -
How documents are shown:
tablefor a formatted table orjsonfor a raw JSON tree. -
Values:
tablejson -
header_row_heightunion number | enum -
The table header row height, as a number of lines, or
autoto size it based on content. If omitted, Kibana determines the height from its current settings, such as the user preference. -
Values:
auto -
row_heightunion number | enum -
The table data row height, as a number of lines, or
autoto size it based on content. If omitted, defaults to thediscover:rowHeightOptionadvanced setting. -
Values:
auto -
rows_per_pagenumber · min: 1 · max: 10000 -
The number of rows to display per page in the data table. If omitted, defaults to the
discover:sampleRowsPerPageadvanced setting. Has no effect on ES|QL tabs. -
sample_sizenumber · min: 10 · max: 10000 -
The number of documents to sample for the data table. If omitted, defaults to the
discover:sampleSizeadvanced setting. -
sortobject[] · max items: 100 · default: [] -
Sort configuration for the data table (field and direction).
-
column_orderstring[] · max items: 100 -
Ordered list of field names to display in the data table. If omitted, defaults to the
defaultColumnsadvanced setting. -
column_settingsmap string to object -
Per-column settings keyed by field name, such as width. Keys should correspond to entries in
column_orderwhen both are set. -
counter_aggregationenumrequired -
Aggregation applied to counter metric fields.
-
Values:
avgsumminmax -
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
default_rendered_nodesnumber · min: 10 · max: 200 -
The number of nodes each JSON cell renders by default in the JSON document view.
-
densityenum -
The table row spacing. If omitted, Kibana determines the density from its current settings, such as the user preference.
-
Values:
compactexpandednormal -
documents_display_modeenum -
How documents are shown:
tablefor a formatted table orjsonfor a raw JSON tree. -
Values:
tablejson -
grid_sort_directionenum -
Direction of the metrics grid order. If omitted, defaults to ascending.
-
Values:
ascdesc -
grid_sort_fieldenum -
Criterion used to order metrics in the metrics grid.
recencyorders by the metrics the viewing user explored most recently in their own browser. If omitted, metrics are ordered alphabetically. -
Values:
alphabeticallyrecency -
header_row_heightunion number | enum -
The table header row height, as a number of lines, or
autoto size it based on content. If omitted, Kibana determines the height from its current settings, such as the user preference. -
Values:
auto -
histogram_percentileenumrequired -
Percentile displayed for histogram metric fields.
-
Values:
p50p75p90p95p99 -
row_heightunion number | enum -
The table data row height, as a number of lines, or
autoto size it based on content. If omitted, defaults to thediscover:rowHeightOptionadvanced setting. -
Values:
auto -
rows_per_pagenumber · min: 1 · max: 10000 -
The number of rows to display per page in the data table. If omitted, defaults to the
discover:sampleRowsPerPageadvanced setting. Has no effect on ES|QL tabs. -
sample_sizenumber · min: 10 · max: 10000 -
The number of documents to sample for the data table. If omitted, defaults to the
discover:sampleSizeadvanced setting. -
search_termstring · max length: 1000required -
Search term used to filter metrics in the metrics grid.
-
sortobject[] · max items: 100 · default: [] -
Sort configuration for the data table (field and direction).
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
overridesobject · default: {} -
column_orderstring[] · max items: 100 -
When set, overrides column order for the data table relative to the referenced saved object (
ref_id) or the inline tab intabs. If omitted, the source configuration is used. -
column_settingsmap string to object -
Per-column settings keyed by field name, such as width. When set, merges with the source configuration for the referenced session or inline tab.
-
default_rendered_nodesnumber · min: 10 · max: 200 -
The number of nodes each JSON cell renders by default in the JSON document view. When set, overrides the referenced saved object or the inline tab config in
tabs. If omitted, the source configuration is used. -
densityenum -
The table row spacing. When set, overrides the referenced saved object or the inline tab config in
tabs. If omitted, the source configuration is used. -
Values:
compactexpandednormal -
documents_display_modeenum -
How documents are shown:
tablefor a formatted table orjsonfor a raw JSON tree. When set, overrides the referenced saved object or the inline tab config intabs. -
Values:
tablejson -
header_row_heightunion number | enum -
The table header row height, as a number of lines, or
auto. When set, overrides the referenced saved object or the inline tab config intabs. If omitted, the source configuration is used. -
Values:
auto -
hide_nullsboolean -
When
true, fields with null values are hidden in the JSON document view. When set, overrides the referenced saved object or the inline tab config intabs. If omitted, the source configuration is used. -
row_heightunion number | enum -
The table data row height, as a number of lines, or
auto. When set, overrides the referenced saved object or the inline tab config intabs. If omitted, falls back to the source or to thediscover:rowHeightOptionadvanced setting. -
Values:
auto -
rows_per_pagenumber · min: 1 · max: 10000 -
The number of rows per page. When set, overrides the referenced saved object or the inline tab config in
tabs. If omitted, falls back to the source or to thediscover:sampleRowsPerPageadvanced setting. -
sample_sizenumber · min: 10 · max: 10000 -
The number of documents to sample. When set, overrides the referenced saved object or the inline tab config in
tabs. If omitted, falls back to the source or to thediscover:sampleSizeadvanced setting. -
selected_tab_idstring -
Tab to select from the referenced saved object. If omitted, defaults to the first tab.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion oneOfrequired -
One of:
(determined by
control_type) -
configunion oneOfrequired -
Field statistics table embeddable schema
-
One of:
(determined by
view_type) -
data_view_idstring · min length: 1 · max length: 1000required -
Data view ID (stored as a panel reference).
-
show_distributionsboolean · default: false -
Whether to show the distribution mini-charts in the table.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
show_distributionsboolean · default: false -
Whether to show the distribution mini-charts in the table.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configobjectrequired -
Image embeddable schema
-
drilldownsunion anyOf[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
configobjectrequired -
Log rate analysis embeddable schema
-
data_view_idstring · min length: 1 · max length: 1000required -
The data view ID used to run log rate analysis.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion anyOfrequired -
Markdown panel config
- Any of:
-
configunion oneOfrequired -
One of:
(determined by
values_source) -
esql_querystring · min length: 1required -
The ES|QL query that provides field options for this control
-
excludeboolean · default: false -
When
true, the control filters to documents that do NOT match the selected options. Defaults tofalse. -
exists_selectedboolean · default: false -
When
true, the control filters to documents where the field exists, regardless of the field's value. Defaults tofalse. -
ignore_validationsboolean · default: false -
When
true, the control skips selection validation and does not report which selections are responsible for returning zero results. -
run_past_timeoutboolean · default: false -
When
true, the options list query continues running even if it exceeds the configured timeout threshold. Defaults tofalse. -
search_techniqueenum · default: wildcard -
The matching technique used when searching available options.
prefixmatches values starting with the search term,wildcardmatches values containing the search term, andexactrequires a complete match. Only applies to string and IP fields. Defaults towildcard. -
Values:
prefixwildcardexact -
selected_options(number | string)[] · max items: 10000 · default: [] -
The list of currently selected option values.
-
single_selectboolean · default: false -
When
true, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults tofalse. -
values_sourceenum · default: field -
The source of the field options for this control. Defaults to
fieldfor legacy controls. -
Values:
field -
data_view_idstring · min length: 1required -
The ID of the data view that provides field options for this control.
-
excludeboolean · default: false -
When
true, the control filters to documents that do NOT match the selected options. Defaults tofalse. -
exists_selectedboolean · default: false -
When
true, the control filters to documents where the field exists, regardless of the field's value. Defaults tofalse. -
field_namestring · min length: 1required -
The name of the field in the data view that this control filters on.
-
ignore_validationsboolean · default: false -
When
true, the control skips selection validation and does not report which selections are responsible for returning zero results. -
run_past_timeoutboolean · default: false -
When
true, the options list query continues running even if it exceeds the configured timeout threshold. Defaults tofalse. -
search_techniqueenum · default: wildcard -
The matching technique used when searching available options.
prefixmatches values starting with the search term,wildcardmatches values containing the search term, andexactrequires a complete match. Only applies to string and IP fields. Defaults towildcard. -
Values:
prefixwildcardexact -
selected_options(number | string)[] · max items: 10000 · default: [] -
The list of currently selected option values.
-
single_selectboolean · default: false -
When
true, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults tofalse. -
configobjectrequired -
Log Pattern Analysis embeddable schema
-
data_view_idstring · min length: 1 · max length: 1000required -
The data view ID used for pattern analysis.
-
field_namestring · min length: 1 · max length: 1000required -
The text field on which to run pattern analysis.
-
minimum_time_rangeenum · default: no_minimum -
Minimum time range for pattern analysis.
-
Values:
no_minimum1_week1_month3_months6_months -
random_sampler_modeenum · default: on_automatic -
The random sampler mode.
-
Values:
on_automaticon_manualoff -
random_sampler_probabilitynumber · min: 1E-05 · max: 0.5 · default: nullnullable -
The probability to use for random sampling (between 0.00001 and 0.5).
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion oneOfrequired -
One of:
(determined by
values_source) -
values_sourceenum · default: field -
The source of the field options for this control. Defaults to
fieldfor legacy controls. -
Values:
field -
data_view_idstring · min length: 1required -
The ID of the data view that provides field options for this control.
-
field_namestring · min length: 1required -
The name of the field in the data view that this control filters on.
-
ignore_validationsboolean · default: false -
When
true, the control skips selection validation and does not report which selections are responsible for returning zero results. -
configobjectrequired -
Single Metric Viewer embeddable
-
function_descriptionstring · max length: 2048 -
For detectors that use the
metricfunction, selects which value to plot:min,max, ormean. Ignored for other detector functions. When omitted, the viewer derives a default from the highest-scoring anomaly record. -
job_idsstring[] · min items: 1 · max items: 1required -
Anomaly detection job ID whose results are shown in the single metric viewer.
-
selected_detector_indexnumber · min: 0 · default: 0 -
Zero-based index of the detector (the Elasticsearch detector_index) within the job whose results are shown.
-
selected_entitiesmap string to string | number -
Values of the partition, by, or over fields that identify the single time series to display.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configobjectrequired -
SLO Alerts embeddable schema
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
configobjectrequired -
SLO Burn Rate embeddable schema
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
durationstring · max length: 32required -
Duration for the burn rate chart in the format [value][unit], e.g. 5m, 3h, or 6d
-
configobjectrequired -
SLO Error Budget embeddable schema
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
configunion oneOfrequired -
SLO Overview embeddable schema
-
One of:
(determined by
overview_mode) -
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
group_filtersobject · default: {"group_by":"status"} -
filtersunion oneOf[] · max items: 500 -
Same options as
filtersindata -
configobjectrequired -
Synthetics stats overview embeddable schema
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
configunion anyOfrequired -
Lens embeddable schema
- Any of:
-
drilldownsunion anyOf[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
breakdown_byunion anyOf - Any of:
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
formatunion anyOf -
Number display format for the dimension value.
- Any of:
-
compactboolean -
When
true, uses short unit suffixes (for example,msinstead ofMilliseconds). Defaults totrue. Ignored forauto-approximate. -
fromenumrequired -
Source time unit of the raw field value, including fine-grained units (
ps,ns,us) in addition to standard units. This describes how the stored data is encoded, not a query duration literal. -
Values:
psnsusmssminhdwmoy -
rank_byunion anyOf - Any of:
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsunion anyOf[] · min items: 1 · max items: 2required -
Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric.
- Any of:
-
apply_color_toenum -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
background_chartunion anyOf -
Secondary visualization displayed behind the primary metric value, either a bar chart (with optional max value) or a trend line.
- Any of:
-
max_valueunion anyOfrequired -
Metric dimension configuration, supporting field-based aggregations (count, sum, average, median, standard deviation, unique count, last value), percentile operations, time-series operations (differences, moving average, cumulative sum, counter rate), and mathematical formulas.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
ofunion anyOfrequired - Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
fieldstring -
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for the primary metric value or background.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
fieldstring -
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
fieldstring -
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
stylingobject -
Visual chart styling options
-
densityenum · default: default -
Density preset for the metric chart layout. Use
compactfor a compact layout, ordefaultfor increased padding, element spacing, and font size. -
Values:
compactdefault -
primaryobject -
positionenum · default: bottom -
Position of the primary metric value (top, middle, or bottom).
-
Values:
topmiddlebottom -
valueobject -
Primary metric value configuration
-
alignmentenum · default: right -
Alignment for the primary metric value. Accepted values:
left,center,right. Defaults toright. -
Values:
leftcenterright -
sizingenum · default: auto -
Controls how the primary value text is sized within the panel. 'auto' selects a font size from predefined breakpoints based on panel height, then shrinks if the text overflows horizontally. 'fill' scales the text to be as large as possible, filling all available space.
-
Values:
autofill -
breakdown_byobject -
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsunion anyOf[] · min items: 1 · max items: 2required -
Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric.
- Any of:
-
apply_color_toenum -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for the primary metric value or background.
-
Same options as
colorintype: primary -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
compareunion anyOf -
Compare the secondary metric to a baseline value or to the primary metric.
- Any of:
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricunion anyOfrequired - Any of:
-
apply_color_toenum -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
colorunion anyOf · default: {"type":"auto"} -
Color configuration based on the metric value.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
apply_color_toenum -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
colorunion anyOf · default: {"type":"auto"} -
Color configuration based on the metric value.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
apply_color_toenum -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
colorunion anyOf · default: {"type":"auto"} -
Color configuration based on the metric value.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
apply_color_toenum -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
colorunion anyOf · default: {"type":"auto"} -
Color configuration based on the metric value.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
apply_color_toenum -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
colorunion anyOf · default: {"type":"auto"} -
Color configuration based on the metric value.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
apply_color_toenum -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
colorunion anyOf · default: {"type":"auto"} -
Color configuration based on the metric value.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
apply_color_toenum -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
colorunion anyOf · default: {"type":"auto"} -
Color configuration based on the metric value.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
apply_color_toenum -
Color target:
valuecolors the metric text,backgroundcolors the cell or panel background. -
Values:
valuebackground -
colorunion anyOf · default: {"type":"auto"} -
Color configuration based on the metric value.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
axisobject -
Axis configuration for X, Y, and Y2 axes. The Y axis is on the start (leading) side, the Y2 axis is on the end (trailing) side.
-
xobject -
X-axis configuration
-
yobject -
Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts).
-
domainunion oneOf · default: {"rounding":true,"type":"full"} -
Y-axis domain configuration
-
One of:
(determined by
type) -
y2object -
Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts).
-
domainunion oneOf · default: {"rounding":true,"type":"full"} -
Y-axis domain configuration
-
One of:
(determined by
type) -
layersunion anyOf[] · min items: 1 · max items: 100required -
Chart layers
- Any of:
-
breakdown_byunion anyOf - Any of:
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} - Any of:
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
rank_byunion anyOf -
Same options as
rank_byinTerms Operation -
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
typeenumrequired -
Chart type for the data layer
-
Values:
areaarea_percentagearea_stackedbarbar_horizontalbar_horizontal_stackedbar_horizontal_percentagebar_percentagebar_stackedline -
xunion anyOf - Any of:
-
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
thresholdsunion anyOf[] · min items: 1 · max items: 100required -
Array of reference line thresholds
- Any of:
-
data_sourceunion oneOf -
Same options as
data_sourceinheader_row_height: auto -
eventsunion anyOf[] · min items: 1 · max items: 100required -
Array of annotation configurations
- Any of:
-
legendunion anyOf -
Legend configuration for XY chart
- Any of:
-
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
stylingobject -
Visual styling options for the chart
-
axisobject -
Axis configuration for X, Y, and Y2 axes. The Y axis is on the start (leading) side, the Y2 axis is on the end (trailing) side.
-
Same fields as
axisinXY Chart (DSL) -
layersunion anyOf[] · min items: 1 · max items: 100required -
ES|QL chart layers
- Any of:
-
breakdown_byobject -
ES|QL column for breakdown
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
typeenumrequired -
Chart type for the data layer
-
Values:
areaarea_percentagearea_stackedbarbar_horizontalbar_horizontal_stackedbar_horizontal_percentagebar_percentagebar_stackedline -
xobject -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
yobject[] · max items: 100required -
Array of ES|QL columns for Y-axis metrics
-
axisenum · default: y -
The Y axis this metric is plotted on. Values match the root axis configuration keys (axis.y, axis.y2). If omitted, defaults to the Y axis start (leading) side.
-
Values:
yy2 -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
thresholdsobject[] · min items: 1 · max items: 100required -
Array of static value reference line thresholds
-
axisenum · default: y -
The axis this reference line is drawn on. Values match the root axis configuration keys. If omitted, defaults to the primary Y axis.
-
Values:
xyy2 -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
iconenum -
Icon to display on the reference line
-
Values:
asteriskalertbellboltbugcircleeditor_commentflagheartmap_markerpin_filledstar_emptystar_filledtagtriangle -
eventsunion anyOf[] · min items: 1 · max items: 100required -
Array of static annotation configurations
- Any of:
-
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricunion anyOfrequired - Any of:
-
colorunion anyOf · default: {"type":"auto"} -
Color configuration for the gauge fill.
- Any of:
-
goalunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
maxunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinCount Metric Operation -
minunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for the gauge fill.
-
Same options as
colorinCount Metric Operation -
goalunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
maxunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinUnique Count Metric Operation -
minunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinUnique Count Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for the gauge fill.
-
Same options as
colorinCount Metric Operation -
goalunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
maxunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinStats Metric Operation -
minunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinStats Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for the gauge fill.
-
Same options as
colorinCount Metric Operation -
goalunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
maxunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinSum Metric Operation -
minunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinSum Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for the gauge fill.
-
Same options as
colorinCount Metric Operation -
goalunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
maxunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinLast Value Operation -
minunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinLast Value Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for the gauge fill.
-
Same options as
colorinCount Metric Operation -
goalunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
maxunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinPercentile Operation -
minunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinPercentile Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for the gauge fill.
-
Same options as
colorinCount Metric Operation -
goalunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
maxunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinPercentile Ranks Operation -
minunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
-
Same options as
goalinPercentile Ranks Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for the gauge fill.
-
Same options as
colorinCount Metric Operation -
goalunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
- Any of:
-
maxunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
- Any of:
-
minunion anyOf -
Metric dimension using a field-based aggregation, a static value, or a mathematical formula.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricunion anyOfrequired - Any of:
-
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
ofunion anyOfrequired -
Same options as
ofinDifferences Operation -
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
ofunion anyOfrequired -
Same options as
ofinDifferences Operation -
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
-
Same options as
colorinCount Metric Operation -
fieldstring -
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf · default: {"type":"auto"} -
Color scale configuration for the heatmap cells.
-
Same options as
colorinCount Metric Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
xunion anyOfrequired -
Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.
-
Same options as
xinLayer (DSL) -
yunion anyOf -
Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.
-
Same options as
xinLayer (DSL) -
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
titlestring -
The title of the chart displayed in the panel. Optional. Any string value or undefined.
-
xobjectrequired -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
yobject -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricunion anyOfrequired - Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
fieldstring -
Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
tag_byunion anyOfrequired - Any of:
-
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
rank_byunion anyOf -
Same options as
rank_byinTerms Operation -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricobjectrequired -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
tag_byobjectrequired -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricunion anyOfrequired -
Metric dimension using a field-based aggregation or a mathematical formula.
- Any of:
-
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
filterobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
regionunion anyOfrequired - Any of:
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricobjectrequired -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsunion anyOf[] · min items: 1 · max items: 1000required -
Array of metrics to display as columns in the datatable
- Any of:
-
apply_color_toenum -
Column color target:
valuefor cell text,backgroundfor cell background, orbadgefor a badge overlay. -
Values:
valuebackgroundbadge -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.
- Any of:
-
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
rowsunion anyOf[] · min items: 1 · max items: 50 -
Array of operations to split the datatable rows by
- Any of:
-
apply_color_toenum -
Column color target:
valuefor cell text,backgroundfor cell background, orbadgefor a badge overlay. -
Values:
valuebackgroundbadge -
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf · default: {"type":"auto"} - Any of:
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
split_metrics_byunion anyOf[] · min items: 1 · max items: 20 -
Array of operations to split the metric columns by
-
Same options as
xinLayer (DSL) -
stylingobject -
Visual chart styling options
-
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsobject[] · min items: 1 · max items: 1000 -
Array of metrics to display as columns in the datatable
-
apply_color_toenum -
Column color target:
valuefor cell text,backgroundfor cell background, orbadgefor a badge overlay. -
Values:
valuebackgroundbadge -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.
-
Same options as
colorinmetrics -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
rowsobject[] · min items: 1 · max items: 50 -
Array of operations to split the datatable rows by
-
apply_color_toenum -
Column color target:
valuefor cell text,backgroundfor cell background, orbadgefor a badge overlay. -
Values:
valuebackgroundbadge -
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf · default: {"type":"auto"} -
Color configuration for ESQL datatable rows. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.
-
Same options as
colorinmetrics -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
split_metrics_byobject[] · min items: 1 · max items: 20 -
Array of operations to split the metric columns by
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
group_byunion anyOf[] · min items: 1 · max items: 100 -
Array of breakdown dimensions (minimum 1)
- Any of:
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsunion anyOf[] · min items: 1 · max items: 100required -
Array of metric configurations (minimum 1)
- Any of:
-
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
group_byobject[] · min items: 1 · max items: 100 -
Array of breakdown dimensions (minimum 1)
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsobject[] · min items: 1 · max items: 100required -
Array of metric configurations (minimum 1)
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
group_breakdown_byunion anyOf[] · min items: 1 · max items: 100 -
Array of group breakdown dimensions (minimum 1)
- Any of:
-
group_byunion anyOf[] · min items: 1 · max items: 100 -
Array of breakdown dimensions (minimum 1)
- Any of:
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricunion anyOfrequired -
Same options as
metricinTag Cloud Chart (DSL) -
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
group_breakdown_byobject[] · min items: 1 · max items: 100 -
Array of group breakdown dimensions (minimum 1)
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
group_byobject[] · min items: 1 · max items: 100 -
Array of breakdown dimensions (minimum 1)
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricobjectrequired -
Metric configuration for ES|QL mode, combining generic options, primary metric options, and column selection
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
group_byunion anyOf[] · min items: 1 · max items: 100 -
Array of breakdown dimensions (minimum 1)
- Any of:
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsunion anyOf[] · min items: 1 · max items: 100required -
Array of metric configurations (minimum 1)
- Any of:
-
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
group_byobject[] · min items: 1 · max items: 100 -
Array of breakdown dimensions (minimum 1)
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsobject[] · min items: 1 · max items: 100required -
Array of metric configurations (minimum 1)
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceunion oneOfrequired -
Same options as
data_sourceinheader_row_height: auto -
group_byunion anyOf[] · min items: 1 · max items: 100 -
Array of breakdown dimensions (minimum 1)
- Any of:
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsunion anyOf[] · min items: 1 · max items: 100required -
Array of metric configurations (minimum 1)
- Any of:
-
queryobject -
A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
-
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
data_sourceobjectrequired -
Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
-
group_byobject[] · min items: 1 · max items: 100 -
Array of ES|QL breakdown columns (minimum 1)
-
collapse_byunion anyOf -
Aggregation function used to collapse a breakdown dimension into a single value.
-
Values:
avgsummaxmin -
colorunion anyOf -
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
-
Default:
{"mapping":[],"mode":"categorical","palette":"default"} -
Same options as
colorinDate Histogram Operation -
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
ignore_global_filtersboolean · default: false -
When
true, ignores global filters when fetching data for this layer. Defaults tofalse. -
metricsobject[] · min items: 1 · max items: 100required -
Array of metric configurations (minimum 1)
-
formatunion anyOf -
Number display format for the dimension value.
-
Same options as
formatinTerms Operation -
samplingnumber · min: 0 · max: 1 · default: 1 -
Sampling factor between 0 (no sampling) and 1 (full sampling).
-
drilldownsunion anyOf[] · max items: 100 -
Same options as
drilldownsinBy value -
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
collapsedboolean · default: false -
When
true, the section is collapsed and its panels are not rendered until expanded. Useful for improving initial load time on large dashboards. Defaults tofalse. -
panelsunion oneOf[] · max items: 1000 -
The panels that belong to the section.
- One of:
-
configunion anyOfrequired -
Anomaly Swim Lane embeddable
-
Same options as
configinAnomaly swim lane -
configobjectrequired -
Change point detection chart embeddable schema
-
Same fields as
configinChange point detection chart -
configobjectrequired -
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion anyOfrequired -
Same options as
configinDiscover session -
configunion oneOfrequired -
Same options as
configinES|QL variable control -
configunion oneOfrequired -
Field statistics table embeddable schema
-
Same options as
configinField statistics table -
configobjectrequired -
Image embeddable schema
-
drilldownsunion anyOf[] · max items: 100 -
Same options as
drilldownsinconfig -
configobjectrequired -
Log rate analysis embeddable schema
-
data_view_idstring · min length: 1 · max length: 1000required -
The data view ID used to run log rate analysis.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
configunion oneOfrequired -
Same options as
configinOptions list control -
configobjectrequired -
Log Pattern Analysis embeddable schema
-
Same fields as
configinPattern analysis -
configunion oneOfrequired -
Same options as
configinRange slider control -
configobjectrequired -
Single Metric Viewer embeddable
-
Same fields as
configinSingle metric viewer -
configobjectrequired -
Synthetics stats overview embeddable schema
-
drilldownsunion[] · max items: 100 - Any of:
-
urlstringrequired -
Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
-
pinned_panelsunion oneOf[] · max items: 100 -
An array of control panels and their state in the control group.
- One of:
-
configunion oneOfrequired -
Same options as
configinES|QL variable control -
configunion oneOfrequired -
Same options as
configinOptions list control -
configunion oneOfrequired -
Same options as
configinRange slider control -
project_routingstring -
Controls cross-project search behavior for this dashboard (Serverless only). Set to
_alias:_originto scope data to the current project, or_alias:*to search across all projects. When omitted, the space default applies. -
queryobject -
A search query consisting of an expression and its language. Supports KQL and Lucene syntax.
-
time_rangeobject -
Specifies the time range for a query.
-
fromstringrequired -
The start of the time range. Accepts Elasticsearch date math expressions (for example,
now-7d) or ISO 8601 timestamps. -
modeenum -
The time range mode. Use
absolutefor fixed start and end timestamps. Userelativefor date math expressions that are re-evaluated at query time (for example,now-7d). -
Values:
absoluterelative -
tostringrequired -
The end of the time range. Accepts Elasticsearch date math expressions (for example,
now) or ISO 8601 timestamps. -
warningsunion anyOf[] · max items: 100 -
A list of warnings returned by the Dashboards API. Present only when one or more dashboard properties failed validation.
- Any of:
A filter that evaluates a single field condition such as equality, range, or existence.
operator: is
Matches documents where field equals a single specified value.
operator: is_one_of
Matches documents where field equals any value in a provided list.
operator: range
Matches documents where field falls within a specified numeric or date range.
operator: exists
Matches documents where field exists and contains a non-null value.
A filter that combines multiple conditions or nested groups using a logical and or or operator.
A filter expressed as a raw Elasticsearch Query DSL object, used for queries that cannot be represented by condition or group filters.
A filter that applies an Elasticsearch geo query, used for geographic boundary and shape matching.
Panel configuration stored inline
url_drilldown
type: data_view_reference
type: data_view_spec
Formats a field into a bytes value following the numeral.js format pattern. The default pattern is defined by the format:bytes:defaultPattern advanced setting.
Formats a field into a color value.
field_type: string
field_type: number
field_type: boolean
Formats a field into a currency value. The format is determined by the pattern of the format:currency:defaultPattern advanced setting.
Formats a field into a date nanos value following the defined pattern.
Formats a field into a date value following the defined pattern.
Formats a field into a duration value.
Formats a field into a geo point value.
Formats a histogram field into a numeric value following the defined pattern. The default pattern is defined by format:bytes:defaultPattern, format:percent:defaultPattern or format:number:defaultPattern advanced settings depending on the selected format.
Formats a field into a numeric value following the defined pattern. The default pattern is defined by format:number:defaultPattern advanced setting.
Formats a field into a percentage value following the defined pattern. The default pattern is defined by format:percent:defaultPattern advanced setting.
Formats a field into a relative date value. For example: "1 day ago".
Formats a field into a static value based on the lookup entries or the unknown key value.
Formats a field into a string value.
Truncates the field value to the specified length. If the field value is longer than the specified length, it will be truncated and the remaining text will be replaced with "...".
Formats a field into a link, image or audio.
type: a
type: img
type: audio
Display overrides for a field. These settings can define a custom label, description, and format.
ES|QL (Elasticsearch Query Language) data source.
An ES|QL tab with saved metrics grid settings. The dashboard panel stores these settings and restores them in Discover. The panel does not render the metrics grid.
Panel configuration stored in a linked library item
url_drilldown
control_type: STATIC_VALUES
An ES|QL variable control with a fixed list of selectable options defined directly in available_options.
control_type: VALUES_FROM_QUERY
An ES|QL variable control whose selectable options are dynamically retrieved by running an ES|QL query.
view_type: dataview
view_type: esql
Panel configuration stored inline
Panel configuration stored in a linked library item
values_source: esql
An options list control whose available options come from an ES|QL query's results.
values_source: field
An options list control whose available options come from a data view field.
values_source: esql
A range slider control whose values come from an ES|QL query's results.
values_source: field
A range slider control whose values come from a numeric data view field.
url_drilldown
url_drilldown
url_drilldown
overview_mode: single
SLO Single Overview embeddable schema
url_drilldown
overview_mode: groups
SLO Group Overview embeddable schema
url_drilldown
url_drilldown
Panel configuration stored inline
One or two metric values with optional color coding, trend line, and breakdown by dimension.
Metric chart configuration for standard queries
Number or percentage format with optional decimal places, suffix, and compact notation.
Data size format in bits or bytes, with optional decimal places and suffix.
Duration format between time units.
Terms ranked alphabetically.
Terms ranked by rarity.
Terms ranked by a linked metric.
Terms ranked by custom operation.
Terms ranked by the last value of a field.
Terms ranked by count, either of all documents or of a specific field.
Terms ranked by a percentile of a numeric field, for example the 95th percentile of response time.
Terms ranked by the percentile rank of a single value: the proportion of field values at or below that value.
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Color by absolute value configuration
Color by percentage value configuration
Color by value using a palette, with colors distributed across the range of values.
Legacy color by value configuration
Fixed color for all values in the dimension.
Metric chart configuration for ES|QL queries
Legacy Metric configuration using a data view. Superseded by the Metric chart type.
Color by absolute value configuration
Color by value using a palette, with colors distributed across the range of values.
Legacy color by absolute value configuration
XY chart configuration
XY chart configuration for DSL queries
type: full
Uses the full chart domain, including baseline expansion when applicable (for example, includes zero for bar-like series).
type: fit
Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion.
type: custom
Uses explicitly provided domain bounds (min and max).
type: full
Uses the full chart domain, including baseline expansion when applicable (for example, includes zero for bar-like series).
type: fit
Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion.
type: custom
Uses explicitly provided domain bounds (min and max).
Data layer for standard queries with metrics and buckets
Palette color assignment for specific categorical values. Unmapped values receive the unassigned color.
Gradient color mapping across categorical values.
Reference line layer for standard queries
Layer containing annotations (query-based, points, and ranges)
Annotation from query results matching a filter
Manual point annotation at specific timestamp
Manual range annotation spanning time interval
Outside legend positioned horizontal (top/bottom) of the chart
Outside legend positioned vertical (left/right) of the chart
Inside legend
XY chart configuration for ES|QL queries
Data layer for ES|QL queries with column references
Reference line layer with static value thresholds. Field-based threshold operations are not supported on ES|QL charts yet.
Layer containing annotations (points and ranges)
Manual point annotation at specific timestamp
Manual range annotation spanning time interval
A gauge chart with a metric value and optional minimum, maximum, and goal markers, in bullet or circular shape.
Gauge configuration using a data view.
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Color by absolute value configuration
Color by percentage value configuration
Color by value using a palette, with colors distributed across the range of values.
Legacy color by value configuration
Gauge configuration using an ES|QL query.
A grid of colored cells where color intensity represents the metric value at each X/Y intersection.
Heatmap configuration using a data view.
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Color by absolute value configuration
Color by percentage value configuration
Color by value using a palette, with colors distributed across the range of values.
Legacy color by value configuration
Heatmap configuration using an ES|QL query.
A word cloud with terms sized by metric value.
Tag Cloud configuration using a data view.
Tag Cloud configuration using an ES|QL query.
A choropleth map with geographic regions colored by the aggregated metric value.
Region Map configuration using a data view, mapping metric values to geographic regions by color.
Region Map configuration using an ES|QL query, mapping metric values to geographic regions by color.
Datatable chart configuration: DSL or ES|QL query based
Datatable state configuration for standard queries
Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.
Color by absolute value configuration
Color by percentage value configuration
Color by value using a palette, with colors distributed across the range of values.
Legacy color by value configuration
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Palette color assignment for specific categorical values. Unmapped values receive the unassigned color.
Gradient color mapping across categorical values.
Color mapping for dimension values, either categorical (for specific values) or as a gradient.
Palette color assignment for specific categorical values. Unmapped values receive the unassigned color.
Gradient color mapping across categorical values.
Datatable state configuration for ES|QL queries
Pie chart state: standard query or ES|QL query
Pie chart configuration for standard queries
Pie chart configuration for ES|QL queries
Mosaic chart configuration schema supporting both data source queries (non-ES|QL) and ES|QL query modes
Mosaic chart configuration schema for data source queries (non-ES|QL mode), defining metrics and breakdown dimensions
Mosaic chart configuration schema for ES|QL queries, defining metrics and breakdown dimensions using column-based configuration
Treemap chart configuration schema supporting both data source queries (non-ES|QL) and ES|QL query modes
Treemap chart configuration schema for data source queries (non-ES|QL mode), defining metrics and breakdown dimensions
Treemap chart configuration schema for ES|QL queries, defining metrics and breakdown dimensions using column-based configuration
Waffle chart configuration: DSL or ES|QL query based
Waffle chart configuration for standard queries
Waffle chart configuration for ES|QL queries
Panel configuration stored in a linked library item
A collapsible group of panels.
url_drilldown
An ES|QL variable control whose selected value is injected into ES|QL visualizations using the ?variable_name syntax. Options can come from a fixed list or an ES|QL query. Define the options source in config.
A dropdown control that filters data by selecting field values from a data view. Define the data view, field, and selection settings in config.
A slider control that filters data by selecting a numeric range for the configured field. Define the data view, field, and selection settings in config.
A control panel that filters a time field to a selected sub-range of the global time range. Define the start and end positions in config as fractions of the global range (0 to 1).
A panel that was excluded from the response because its type is not supported by the API.
A property that was excluded from the response because it failed validation.
invalid response
forbidden
not found
internal server error