{"id":9137,"date":"2022-07-13T13:30:16","date_gmt":"2022-07-13T18:30:16","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=9137"},"modified":"2022-07-13T14:25:50","modified_gmt":"2022-07-13T19:25:50","slug":"kibana-visualizations-and-dashboards","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=9137","title":{"rendered":"Kibana – Visualizations and Dashboards"},"content":{"rendered":"

Kibana \u2013 Creating Visualizations<\/a><\/p>\n

General<\/a><\/p>\n

Time Series Visualization Pipeline<\/a><\/p>\n

Kibana \u2013 Creating a Dashboard<\/a><\/p>\n

<\/a>Kibana \u2013 Creating Visualizations<\/h1>\n

<\/a>General<\/h2>\n

To create a new visualization, select the visualization icon from the left-hand navigation menu and click \u201cCreate visualization\u201d. You\u2019ll need to select the type of visualization you want to create.<\/p>\n

<\/p>\n

<\/a>TSVB (Time Series Visualization Builder)<\/h2>\n

The Time Series Visualization Pipeline is a GUI visualization builder to create graphs from time series data. This means the x-axis will be datetime values and the y-axis will the data you want to visualize over the time period. To create a new visualization of this type, select \u201cTSVB\u201d on the \u201cNew Visualization\u201d menu.<\/p>\n

<\/p>\n

Scroll down and select \u201cPanel options\u201d \u2013 here you specify the index you want to visualize. Select the field that will be used as the time<\/em> for each document (e.g. if your document has a special field like eventOccuredAt, you\u2019d select that here). I generally leave the time interval at \u2018auto\u2019 \u2013 although you might specifically want to present a daily or hourly report.<\/p>\n

<\/p>\n

Once you have selected the index, return to the \u201cData\u201d tab. First, select the type of aggregation you want to use. In this example, we are showing the number of documents for a variety of policies.<\/p>\n

<\/p>\n

The \u201cGroup by\u201d dropdown allows you to have chart lines for different categories (instead of just having the count of documents over the time series, which is what \u201cEverything\u201d produces) \u2013 to use document data to create the groupings, select \u201cTerms\u201d.<\/p>\n

<\/p>\n

Select the field you want to group on \u2013 in this case, I want the count for each unique \u201cpolicyname\u201d value, so I selected \u201cpolicyname.keyword\u201d as the grouping term.<\/p>\n

<\/p>\n

Voila \u2013 a time series chart showing how many documents are found for each policy name. Click \u201cSave\u201d at the top left of the chart to save the visualization.<\/p>\n

<\/p>\n

Provide a name for the visualization, write a brief description, and click \u201cSave\u201d. The visualization will now be available for others to view or for inclusion in dashboards.<\/p>\n

<\/p>\n

TimeLion<\/h2>\n

TimeLion looks like it is going away soon, but it’s what I’ve seen as the recommendation for drawing horizontal lines on charts.<\/p>\n

<\/p>\n

This visualization type is a little cryptic \u2013 you need to enter Timelion expression<\/a> — .es() retrieves data from ElasticSearch, .value(3500) draws a horizontal line at 3,500<\/p>\n

If there is null data at a time value, TimeLion will draw a discontinuous line. You can modify this behavior by specifying a fit function<\/a>.<\/p>\n

<\/p>\n

<\/a> Note that you\u2019ll need to click \u201cUpdate\u201d to update the chart before you are able to save the visualization.<\/p>\n

Vega<\/h2>\n

Vega<\/a> is an experimental visualization type.<\/p>\n

<\/p>\n

This is, by far, the most flexible but most complex approach to creating a visualization. I\u2019ve used it to create the Sankey visualization showing the source and destination countries from our firewall logs<\/a>. Both Vega<\/a> and Vega-Lite<\/a> grammars can be used. ElasticCo provides a getting started guide<\/a>, and there are many example online that you can use as the basis for your visualization.<\/p>\n

<\/p>\n

Kibana \u2013 Creating a Dashboard<\/h1>\n

To create a dashboard, select the \u201cDashboards\u201d icon on the left-hand navigation bar. Click \u201cCreate dashboard\u201d<\/p>\n

<\/p>\n

Click \u201cAdd an existing\u201d to add existing visualizations to the dashboard.<\/p>\n

<\/p>\n

Select the dashboards you want added, then click \u201cSave\u201d to save your dashboard.<\/p>\n

<\/p>\n

Provide a name and brief description, then click \u201cSave\u201d.<\/p>\n

<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Kibana \u2013 Creating Visualizations General Time Series Visualization Pipeline Kibana \u2013 Creating a Dashboard Kibana \u2013 Creating Visualizations General To create a new visualization, select the visualization icon from the left-hand navigation menu and click \u201cCreate visualization\u201d. You\u2019ll need to select the type of visualization you want to create. TSVB (Time Series Visualization Builder) The …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1588],"tags":[931,1590,1591,1670,1671,1669],"class_list":["post-9137","post","type-post","status-publish","format-standard","hentry","category-elk","tag-data-visualization","tag-elasticsearch","tag-kibana","tag-timelion","tag-tsvb","tag-vega"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9137"}],"version-history":[{"count":4,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9137\/revisions"}],"predecessor-version":[{"id":9157,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9137\/revisions\/9157"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}