[DOCS] Moved rolled up index content (#59372)
* [DOCS] Moved rolled up index content * Review comments
This commit is contained in:
parent
a2c002d130
commit
6e7df195d3
|
@ -52,9 +52,8 @@ If {kib} detects an index with a timestamp, you’re asked to choose a field to
|
|||
filter your data by time. If you don’t specify a field, you won’t be able
|
||||
to use the time filter.
|
||||
|
||||
|
||||
|
||||
[float]
|
||||
[[rollup-index-pattern]]
|
||||
==== Rollup index pattern
|
||||
|
||||
If a rollup index is detected in the cluster, clicking *Create index pattern*
|
||||
|
@ -62,7 +61,11 @@ includes an item for creating a rollup index pattern.
|
|||
You can match an index pattern to only rolled up data, or mix both rolled
|
||||
up and raw data to explore and visualize all data together.
|
||||
An index pattern can match
|
||||
only one rollup index.
|
||||
only one rollup index. When matching multiple indices,
|
||||
use a comma to separate the names, with no space after the comma.
|
||||
|
||||
For specific fields, the data in a rollup index includes only summarized metrics.
|
||||
From the original raw data, you are unable to search any other field.
|
||||
|
||||
[float]
|
||||
[[management-cross-cluster-search]]
|
||||
|
|
|
@ -56,6 +56,7 @@ job—reusing the same name can lead to problems with mismatched job configu
|
|||
You can read more at {ref}/rollup-job-config.html[rollup job configuration].
|
||||
|
||||
[float]
|
||||
[[rollup-data-tutorial]]
|
||||
=== Try it: Create and visualize rolled up data
|
||||
|
||||
This example creates a rollup job to capture log data from sample web logs.
|
||||
|
@ -138,8 +139,7 @@ is `rollup_logstash,kibana_sample_data_logs`.
|
|||
image::images/management_rollup_job_vis.png[][Visualization of rolled up data]
|
||||
|
||||
You can then create a dashboard that contains visualizations of the rolled up
|
||||
data, raw data, or both. See <<visualize-rollup-data, Using rolled up data in a visualization>>
|
||||
for more information.
|
||||
data, raw data, or both. For more information, refer to <<rollup-index-pattern,rolled up data>>.
|
||||
|
||||
[role="screenshot"]
|
||||
image::images/management_rollup_job_dashboard.png[][Dashboard with rolled up data]
|
||||
|
|
|
@ -7,73 +7,78 @@ _Visualize_ enables you to create visualizations of the data from your {es} indi
|
|||
|
||||
{kib} visualizations are based on {es} queries. By using a series of {es} {ref}/search-aggregations.html[aggregations] to extract and process your data, you can create charts that show you the trends, spikes, and dips you need to know about.
|
||||
|
||||
[float]
|
||||
[[create-a-visualization]]
|
||||
== Create visualizations
|
||||
To begin, open *Visualize*, then click *Create new visualization*.
|
||||
|
||||
[float]
|
||||
[[visualization-types]]
|
||||
== Types of visualizations
|
||||
|
||||
{kib} supports several types of visualizations.
|
||||
|
||||
. Open *Visualize*.
|
||||
. Click *Create new visualization*.
|
||||
. Choose the visualization type:
|
||||
+
|
||||
* Basic charts
|
||||
[horizontal]
|
||||
<<lens,Lens>>::
|
||||
Quickly build several types of basic visualizations by simply dragging and dropping the data fields you want to display.
|
||||
|
||||
* *<<most-frequent,Most frequently used visualizations>>*
|
||||
[horizontal]
|
||||
Line, area, and bar charts:: Compare different series in X/Y charts.
|
||||
<<most-frequent,Most frequently used visualizations>>::
|
||||
|
||||
Pie chart:: Display each source contribution to a total.
|
||||
* *Line, area, and bar charts* — Compares different series in X/Y charts.
|
||||
|
||||
Data table:: Flattens aggregations into table format.
|
||||
* *Pie chart* — Displays each source contribution to a total.
|
||||
|
||||
Metric:: Display a single number.
|
||||
* *Data table* — Flattens aggregations into table format.
|
||||
|
||||
Goal and gauge:: Display a number with progress indicators.
|
||||
* *Metric* — Displays a single number.
|
||||
|
||||
Tag cloud:: Display words in a cloud, where the size of the word corresponds to its importance.
|
||||
* *Goal and gauge* — Displays a number with progress indicators.
|
||||
|
||||
* *Time series optimized*
|
||||
[horizontal]
|
||||
<<TSVB,TSVB>>:: Visualize time series data using pipeline aggregations.
|
||||
* *Tag cloud* — Displays words in a cloud, where the size of the word corresponds to its importance.
|
||||
|
||||
<<timelion,Timelion>>:: Compute and combine data from multiple time series
|
||||
<<TSVB,TSVB>>:: Visualizes time series data using pipeline aggregations.
|
||||
|
||||
<<timelion,Timelion>>:: Computes and combine data from multiple time series
|
||||
data sets.
|
||||
|
||||
* *Maps*
|
||||
[horizontal]
|
||||
<<maps,Elastic Maps>>:: The most powerful way of visualizing map data in {kib}.
|
||||
<<visualize-maps, Maps>>::
|
||||
* *<<maps,Elastic Maps>>* — Displays geospatial data in {kib}.
|
||||
|
||||
<<visualize-maps,Coordinate map>>:: Displays points on a map using a geohash aggregation.
|
||||
* *Coordinate map* — Displays points on a map using a geohash aggregation.
|
||||
|
||||
<<visualize-maps,Region map>>:: Merge any structured map data onto a shape.
|
||||
* *Region map* — Merges any structured map data onto a shape.
|
||||
|
||||
<<visualize-maps,Heat map>>:: Display shaded cells within a matrix.
|
||||
* *Heat map* — Displays shaded cells within a matrix.
|
||||
|
||||
* *<<for-dashboard,Dashboard tools>>*
|
||||
[horizontal]
|
||||
Controls:: Adds interactive inputs to a Dashboard.
|
||||
<<for-dashboard,Dashboard tools>>::
|
||||
|
||||
Markdown widget:: Display free-form information or instructions.
|
||||
* *Markdown widget* — Displays free-form information or instructions.
|
||||
|
||||
* *For developers*
|
||||
[horizontal]
|
||||
<<vega-graph,Vega>>:: Complete control over query and display.
|
||||
* *Controls* — Adds interactive inputs to a dashboard.
|
||||
|
||||
. Specify a search query to retrieve the data for your visualization:
|
||||
** To enter new search criteria, select the <<index-patterns, index pattern>> for the indices that
|
||||
<<vega-graph,Vega>>:: Completes control over query and display.
|
||||
|
||||
[float]
|
||||
[[choose-your-data]]
|
||||
== Choose your data
|
||||
|
||||
Specify a search query to retrieve the data for your visualization, or used rolled up data.
|
||||
|
||||
* To enter new search criteria, select the <<index-patterns, index pattern>> for the indices that
|
||||
contain the data you want to visualize. The visualization builder opens
|
||||
with a wildcard query that matches all of the documents in the selected
|
||||
indices.
|
||||
** To build a visualization from a saved search, click the name of the saved
|
||||
|
||||
* To build a visualization from a saved search, click the name of the saved
|
||||
search you want to use. The visualization builder opens and loads the
|
||||
selected query.
|
||||
+
|
||||
NOTE: When you build a visualization from a saved search, any subsequent
|
||||
modifications to the saved search are automatically reflected in the
|
||||
visualization. To disable automatic updates, you can disconnect a visualization
|
||||
from the saved search.
|
||||
modifications to the saved search are reflected in the
|
||||
visualization. To disable automatic updates, delete the visualization
|
||||
on the *Saved Object* page.
|
||||
|
||||
* To build a visualization using <<rollup-index-pattern,rolled up data>>, select
|
||||
the index pattern that includes the data. Rolled up data is summarized into
|
||||
time buckets that can be split into sub buckets for numeric field values or
|
||||
terms. To lower granularity, use a time aggregation that uses and combines
|
||||
several time buckets. For an example, refer to <<rollup-data-tutorial,Create and visualize rolled up data>>.
|
||||
|
||||
[float]
|
||||
[[vis-inspector]]
|
||||
|
@ -124,8 +129,6 @@ to view an embedded visualization.
|
|||
* Generate a PNG report.
|
||||
|
||||
--
|
||||
include::{kib-repo-dir}/visualize/visualize_rollup_data.asciidoc[]
|
||||
|
||||
include::{kib-repo-dir}/visualize/aggregations.asciidoc[]
|
||||
|
||||
include::{kib-repo-dir}/visualize/lens.asciidoc[]
|
||||
|
|
Loading…
Reference in a new issue