2016-10-25 03:41:32 +02:00
|
|
|
|
[[connect-to-elasticsearch]]
|
2020-06-08 23:46:26 +02:00
|
|
|
|
== Add data to {kib}
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-06-05 18:06:12 +02:00
|
|
|
|
To start working with your data in {kib}, you can:
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-06-05 18:06:12 +02:00
|
|
|
|
* Upload a CSV, JSON, or log file with the File Data Visualizer.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-06-05 18:06:12 +02:00
|
|
|
|
* Upload geospatial data with the GeoJSON Upload feature.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-06-05 18:06:12 +02:00
|
|
|
|
* Index logs, metrics, events, or application data by setting up a Beats module.
|
|
|
|
|
|
|
|
|
|
* Connect {kib} with existing {es} indices.
|
|
|
|
|
|
2020-09-03 23:34:25 +02:00
|
|
|
|
If you're not ready to use your own data, you can add a <<gs-get-data-into-kibana, sample data set>>
|
2020-06-05 18:06:12 +02:00
|
|
|
|
to see all that you can do in {kib}.
|
|
|
|
|
|
|
|
|
|
[float]
|
|
|
|
|
[[upload-data-kibana]]
|
|
|
|
|
=== Upload a CSV, JSON, or log file
|
|
|
|
|
|
2020-06-25 11:26:31 +02:00
|
|
|
|
experimental[]
|
|
|
|
|
|
|
|
|
|
To visualize data in a CSV, JSON, or log file, you can upload it using the File
|
|
|
|
|
Data Visualizer. On the home page, click *Import a CSV, NDSON, or log file*, and
|
|
|
|
|
then drag your file into the File Data Visualizer. Alternatively, you can open
|
2020-06-26 07:58:55 +02:00
|
|
|
|
it by navigating to *Machine Learning* from the side navigation and selecting
|
|
|
|
|
*Data Visualizer*.
|
2020-06-25 11:26:31 +02:00
|
|
|
|
|
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image::images/data-viz-homepage.jpg[File Data Visualizer on the home page]
|
2020-06-05 20:10:52 +02:00
|
|
|
|
|
|
|
|
|
You can upload a file up to 100 MB. This value is configurable up to 1 GB in
|
|
|
|
|
<<kibana-ml-settings, Advanced Settings>>.
|
2020-06-05 18:06:12 +02:00
|
|
|
|
|
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image::images/add-data-fv.png[File Data Visualizer]
|
|
|
|
|
|
|
|
|
|
The File Data Visualizer uses the {ref}/ml-find-file-structure.html[find_file_structure API] to analyze
|
|
|
|
|
the uploaded file and to suggest ingest pipelines and mappings for your data.
|
|
|
|
|
|
|
|
|
|
NOTE: This feature is not intended for use as part of a
|
|
|
|
|
repeated production process, but rather for the initial exploration of your data.
|
|
|
|
|
|
|
|
|
|
[float]
|
|
|
|
|
[[upload-geoipdata-kibana]]
|
|
|
|
|
=== Upload geospatial data
|
|
|
|
|
|
|
|
|
|
To visualize geospatial data in a point or shape file, you can upload it using the <<geojson-upload, GeoJSON Upload>>
|
2020-06-17 16:31:37 +02:00
|
|
|
|
feature in Maps, and then use that data as a layer in a map.
|
2020-06-05 18:06:12 +02:00
|
|
|
|
The data is also available for use in the broader Kibana ecosystem, for example,
|
|
|
|
|
in visualizations and Canvas workpads.
|
|
|
|
|
With GeoJSON Upload, you can upload a file up to 50 MB.
|
|
|
|
|
|
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image::images/fu_gs_select_source_file_upload.png[]
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[float]
|
2020-06-05 18:06:12 +02:00
|
|
|
|
[[add-data-tutorial-kibana]]
|
|
|
|
|
=== Index metrics, log, security, and application data
|
|
|
|
|
|
|
|
|
|
The built-in data tutorials can help you quickly get up and running with
|
|
|
|
|
metrics data, log analytics, security events, and application data.
|
|
|
|
|
These tutorials walk you through installing and configuring a
|
|
|
|
|
Beats data shipper to periodically collect and send data to {es}.
|
|
|
|
|
You can then use the pre-built dashboards to explore and analyze the data.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-06-05 18:06:12 +02:00
|
|
|
|
You access the tutorials from the home page.
|
|
|
|
|
If a tutorial doesn’t exist for your data, go to the {beats-ref}/beats-reference.html[Beats overview]
|
|
|
|
|
to learn about other data shippers in the Beats family.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-06-05 18:06:12 +02:00
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image::images/add-data-tutorials.png[Add Data tutorials]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
[float]
|
|
|
|
|
[[connect-to-es]]
|
|
|
|
|
=== Connect with {es} indices
|
|
|
|
|
|
|
|
|
|
To visualize data in existing {es} indices, you must
|
|
|
|
|
create an index pattern that matches the names of the indices that you want to explore.
|
|
|
|
|
When you add data with the File Data Visualizer, GeoJSON Upload feature,
|
|
|
|
|
or built-in tutorial, an index pattern is created for you.
|
|
|
|
|
|
|
|
|
|
. Go to *Stack Management*, and then click *Index Patterns*.
|
|
|
|
|
|
|
|
|
|
. Click *Create index pattern*.
|
|
|
|
|
|
|
|
|
|
. Specify an index pattern that matches the name of one or more of your Elasticsearch indices.
|
|
|
|
|
+
|
|
|
|
|
For example, an index pattern can point to your Apache data from yesterday,
|
|
|
|
|
`filebeat-apache-4-3-2022`, or any index that matches the pattern, `filebeat-*`.
|
|
|
|
|
Using a wildcard is the more popular approach.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
. Click *Next Step*, and then select the index field that contains the timestamp you want to use to perform time-based
|
|
|
|
|
comparisons.
|
|
|
|
|
+
|
|
|
|
|
Kibana reads the index mapping and lists all fields that contain a timestamp. If your
|
2020-08-12 22:58:16 +02:00
|
|
|
|
index doesn't have time-based data, choose *I don't want to use the time filter*.
|
2020-06-05 18:06:12 +02:00
|
|
|
|
+
|
|
|
|
|
You must select a time field to use global time filters on your dashboards.
|
|
|
|
|
|
|
|
|
|
. Click *Create index pattern*.
|
|
|
|
|
+
|
|
|
|
|
{kib} is now configured to access your {es} indices.
|
|
|
|
|
You’ll see a list of fields configured for the matching index.
|
|
|
|
|
You can designate your index pattern as the default by clicking the star icon on this page.
|
|
|
|
|
+
|
|
|
|
|
When searching in *Discover* and creating visualizations, you choose a pattern
|
|
|
|
|
from the index pattern menu to specify the {es} indices that contain the data you want to explore.
|