2020-09-03 23:34:25 +02:00
|
|
|
|
[[explore-kibana-using-sample-data]]
|
2019-07-25 22:46:23 +02:00
|
|
|
|
== Explore {kib} using sample data
|
2018-08-16 14:52:38 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
Ready to get some hands-on experience with {kib}?
|
|
|
|
|
In this tutorial, you’ll work with {kib} sample data and learn to:
|
2018-08-16 14:52:38 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
* <<explore-the-data, Explore the sample data using *Discover*>>
|
2018-08-16 14:52:38 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
* <<view-and-analyze-the-data, View and analyze the data on a dashboard>>
|
2018-08-16 14:52:38 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
* <<filter-and-query-the-data, Filter and query the dashboard data>>
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
NOTE: If security is enabled, you must have `read`, `write`, and `manage` privileges
|
|
|
|
|
on the `kibana_sample_data_*` indices. For more information, refer to
|
|
|
|
|
{ref}/security-privileges.html[Security privileges].
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
|
|
|
|
[float]
|
2020-09-03 23:34:25 +02:00
|
|
|
|
[[add-the-sample-data]]
|
|
|
|
|
=== Add the sample data
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
Add the *Sample flight data*.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-06-12 16:39:36 +02:00
|
|
|
|
. On the home page, click *Load a data set and a {kib} dashboard*.
|
2020-09-03 23:34:25 +02:00
|
|
|
|
|
2019-07-25 22:46:23 +02:00
|
|
|
|
. On the *Sample flight data* card, click *Add data*.
|
2018-08-16 14:52:38 +02:00
|
|
|
|
|
2019-07-25 22:46:23 +02:00
|
|
|
|
[float]
|
2020-09-03 23:34:25 +02:00
|
|
|
|
[[explore-the-data]]
|
|
|
|
|
=== Explore the data
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
Explore the documents in the index that
|
|
|
|
|
match the selected index pattern. The index pattern tells {kib} which {es} index you want to
|
|
|
|
|
explore.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
. Open the menu, then go to *Discover*.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
. Make sure `kibana_sample_data_flights` is the current index pattern.
|
|
|
|
|
You might need to click *New* in the {kib} toolbar to refresh the data.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
+
|
2020-09-03 23:34:25 +02:00
|
|
|
|
You'll see a histogram that shows the distribution of
|
|
|
|
|
documents over time. A table lists the fields for
|
|
|
|
|
each document that matches the index. By default, all fields are shown.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
+
|
2020-09-03 23:34:25 +02:00
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image::getting-started/images/tutorial-sample-discover1.png[]
|
|
|
|
|
|
|
|
|
|
. Hover over the list of *Available fields*, then click *Add* next
|
|
|
|
|
to each field you want explore in the table.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
+
|
|
|
|
|
[role="screenshot"]
|
2020-09-03 23:34:25 +02:00
|
|
|
|
image::getting-started/images/tutorial-sample-discover2.png[]
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
[float]
|
|
|
|
|
[[view-and-analyze-the-data]]
|
|
|
|
|
=== View and analyze the data
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
A _dashboard_ is a collection of panels that provide you with an overview of your data that you can
|
|
|
|
|
use to analyze your data. Panels contain everything you need, including visualizations,
|
|
|
|
|
interactive controls, Markdown, and more.
|
|
|
|
|
|
|
|
|
|
To open the *Global Flight* dashboard, open the menu, then go to *Dashboard*.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image::getting-started/images/tutorial-sample-dashboard.png[]
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
|
|
|
|
[float]
|
2020-09-03 23:34:25 +02:00
|
|
|
|
[[change-the-panel-data]]
|
|
|
|
|
==== Change the panel data
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
To gain insights into your data, change the appearance and behavior of the panels.
|
|
|
|
|
For example, edit the metric panel to find the airline that has the lowest average fares.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
. In the {kib} toolbar, click *Edit*.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
. In the *Average Ticket Price* metric panel, open the panel menu, then select *Edit visualization*.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
. To change the data on the panel, use an {es} {ref}/search-aggregations.html[bucket aggregation],
|
|
|
|
|
which sorts the documents that match your search criteria into different categories or buckets.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
.. In the *Buckets* pane, select *Add > Split group*.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
.. From the *Aggregation* dropdown, select *Terms*.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
.. From the *Field* dropdown, select *Carrier*.
|
|
|
|
|
|
|
|
|
|
.. Set *Descending* to *4*, then click *Update*.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
+
|
2020-09-03 23:34:25 +02:00
|
|
|
|
The average ticket price for all four airlines appear in the visualization builder.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
+
|
|
|
|
|
[role="screenshot"]
|
2020-09-03 23:34:25 +02:00
|
|
|
|
image::getting-started/images/tutorial-sample-edit1.png[]
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
. To save your changes, click *Save and return* in the {kib} toolbar.
|
|
|
|
|
|
|
|
|
|
. To save the dashboard, click *Save* in the {kib} toolbar.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
+
|
|
|
|
|
[role="screenshot"]
|
2020-09-03 23:34:25 +02:00
|
|
|
|
image::getting-started/images/tutorial-sample-edit2.png[]
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
|
|
|
|
[float]
|
2020-09-03 23:34:25 +02:00
|
|
|
|
[[filter-and-query-the-data]]
|
|
|
|
|
==== Filter and query the data
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
To focus in on the data you want to explore, use filters and queries.
|
|
|
|
|
For more information, refer to
|
|
|
|
|
{ref}/query-filter-context.html[Query and filter context].
|
|
|
|
|
|
|
|
|
|
To filter the data:
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
. In the *Controls* visualization, select an *Origin City* and *Destination City*, then click *Apply changes*.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
+
|
2020-09-03 23:34:25 +02:00
|
|
|
|
The `OriginCityName` and the `DestCityName` fields filter the data in the panels.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
+
|
2020-09-03 23:34:25 +02:00
|
|
|
|
For example, the following dashboard shows the data for flights from London to Milan.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
+
|
|
|
|
|
[role="screenshot"]
|
2020-09-03 23:34:25 +02:00
|
|
|
|
image::getting-started/images/tutorial-sample-filter.png[]
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
. To manually add a filter, click *Add filter*,
|
|
|
|
|
then specify the data you want to view.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
. When you are finished experimenting, remove all filters.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
[[query-the-data]]
|
|
|
|
|
To query the data:
|
|
|
|
|
|
|
|
|
|
. To view all flights out of Rome, enter the following in the *KQL* query bar, then click *Update*:
|
2019-07-25 22:46:23 +02:00
|
|
|
|
+
|
2020-09-03 23:34:25 +02:00
|
|
|
|
[source,text]
|
|
|
|
|
OriginCityName: Rome
|
|
|
|
|
|
|
|
|
|
. For a more complex query with AND and OR, enter:
|
|
|
|
|
+
|
|
|
|
|
[source,text]
|
|
|
|
|
OriginCityName:Rome AND (Carrier:JetBeats OR Carrier:"Kibana Airlines")
|
|
|
|
|
+
|
|
|
|
|
The dashboard panels update to display the flights out of Rome on JetBeats and
|
|
|
|
|
{kib} Airlines.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
+
|
|
|
|
|
[role="screenshot"]
|
2020-09-03 23:34:25 +02:00
|
|
|
|
image::getting-started/images/tutorial-sample-query.png[]
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
. When you are finished exploring, remove the query by
|
|
|
|
|
clearing the contents in the *KQL* query bar, then click *Update*.
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
|
|
|
|
[float]
|
|
|
|
|
=== Next steps
|
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
Now that you know the {kib} basics, try out the <<create-your-own-dashboard, Create your own dashboard>> tutorial, where you'll learn to:
|
|
|
|
|
|
|
|
|
|
* Add a data set to {kib}
|
2019-07-25 22:46:23 +02:00
|
|
|
|
|
|
|
|
|
* Define an index pattern
|
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
* Discover and explore data
|
2018-08-16 14:52:38 +02:00
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
* Create and add panels to a dashboard
|
2018-08-16 14:52:38 +02:00
|
|
|
|
|
|
|
|
|
|