Elasticsearch Kibana Dashboards

Elasticsearch holds the data, and Kibana turns it into something people can see. Kibana is a web application that connects to a cluster and offers search screens, charts, maps, and shareable dashboards. A manager reads sales trends from a dashboard. An engineer hunts for an error in the Discover screen. Both use the same data through different views.

  Elasticsearch index
        │
        ▼
  Data view  (tells Kibana which indexes to read)
        │
   ┌────┼──────────────┐
   ▼    ▼              ▼
Discover  Visualizations  Maps
 (search)  (charts, Lens)  (geo data)
        │
        ▼
   Dashboard  (many panels on one page)

Creating a Data View

A data view tells Kibana which indexes to read and which field holds the time. Open Stack Management, choose Data Views, and create one with a name and an index pattern such as web-logs-*. Select the timestamp field so Kibana can filter by time range.

Name:            Web Logs
Index pattern:   web-logs-*
Timestamp field: @timestamp

Older documentation calls this object an index pattern. The purpose stays the same.

Searching in Discover

Discover lists raw documents with a histogram of event counts over time. The time picker in the top right limits the range, and the search bar accepts Kibana Query Language (KQL) for quick filtering.

Goal	KQL Query
Match a field value	status: 500
Match a phrase	message: "connection refused"
Combine conditions	service: "payments" and status >= 500
Exclude values	not method: "GET"
Wildcard match	host.name: web-*
Field exists	error.message: *

Click a field name in the left sidebar to see its top values, and click the plus icon beside a value to add it as a filter. Save a useful search to reuse it in dashboards.

Building Charts with Lens

Lens builds charts through drag and drop. Pick a data view, drag a field onto the canvas, and Lens suggests a fitting chart type. Change the type with one click, and compare options without starting over.

Goal: show errors per hour

  Horizontal axis:  @timestamp  (hourly)
  Vertical axis:    Count of records
  Filter:           status >= 500

Result:  bar chart with one bar per hour

Common Chart Types

Chart	Best For
Line or area	Trends over time
Bar	Comparing categories
Pie or donut	Shares of a small whole
Metric	One key number such as total orders
Table	Detailed rows with several measures
Heat map	Patterns across two dimensions
Map	Data with locations

Behind each chart, Kibana runs the same aggregations covered earlier in the course. A bar chart of orders per region performs a terms aggregation with a sum inside.

Assembling a Dashboard

A dashboard collects many panels on one page. Open Dashboards, create a new one, and add saved charts and searches. Drag panels to arrange them, and resize them to give important numbers more space.

+---------------------------------------------------+
|Time range: Last 24 hours      Filter: service:web |
+----------------+----------------+-----------------+
| Total requests | Error rate     | Average latency |
|   1.2 million  |     0.8 %      |     240 ms      |
+----------------+----------------+-----------------+
| Requests per hour (line chart)                    |
+---------------------------+-----------------------+
| Top 10 pages (bar chart)  | Visitors by country   |
|                           | (map)                 |
+---------------------------+-----------------------+

Filters and Interactivity

Filters and the time range apply to every panel at once. Clicking a bar or a slice adds a filter, and the whole dashboard updates to match. Drilldowns link a panel to another dashboard or to Discover with the selected value carried along.

Sharing and Access

Kibana spaces separate dashboards by team, such as Sales and Operations. Each space has its own saved objects and permissions. Reports export as PDF or PNG on licenses that include reporting, and short links share a dashboard with the current filters. Role-based security decides who sees which data.

Alerts from Dashboards

Alerting rules watch a query or a threshold and notify through email, chat tools, or webhooks. A rule might trigger when the error count exceeds 100 in five minutes. Some connector types require a paid license, so check the subscription level before planning.

Dashboard Design Tips

Tip	Reason
Place key numbers at the top	Readers see the summary immediately
Limit panels to 8 or 10	Crowded pages slow loading and attention
Name panels clearly	Titles explain the measure without guessing
Use consistent colors	The same category keeps the same color everywhere
Set a sensible default time range	The page opens with useful data

Start with one question per dashboard, such as "Is the website healthy right now?" Add panels that answer it, and remove panels that do not.