[DOCS] Moved rolled up index content (#59372)

* [DOCS] Moved rolled up index content

* Review comments
This commit is contained in:
Kaarina Tungseth 2020-03-10 16:37:17 -05:00 committed by GitHub
parent a2c002d130
commit 6e7df195d3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 53 additions and 47 deletions

View file

@ -52,9 +52,8 @@ If {kib} detects an index with a timestamp, youre asked to choose a field to
filter your data by time. If you dont specify a field, you wont be able
to use the time filter.
[float]
[[rollup-index-pattern]]
==== Rollup index pattern
If a rollup index is detected in the cluster, clicking *Create index pattern*
@ -62,7 +61,11 @@ includes an item for creating a rollup index pattern.
You can match an index pattern to only rolled up data, or mix both rolled
up and raw data to explore and visualize all data together.
An index pattern can match
only one rollup index.
only one rollup index. When matching multiple indices,
use a comma to separate the names, with no space after the comma.
For specific fields, the data in a rollup index includes only summarized metrics.
From the original raw data, you are unable to search any other field.
[float]
[[management-cross-cluster-search]]

View file

@ -56,6 +56,7 @@ job—reusing the same name can lead to problems with mismatched job configu
You can read more at {ref}/rollup-job-config.html[rollup job configuration].
[float]
[[rollup-data-tutorial]]
=== Try it: Create and visualize rolled up data
This example creates a rollup job to capture log data from sample web logs.
@ -138,8 +139,7 @@ is `rollup_logstash,kibana_sample_data_logs`.
image::images/management_rollup_job_vis.png[][Visualization of rolled up data]
You can then create a dashboard that contains visualizations of the rolled up
data, raw data, or both. See <<visualize-rollup-data, Using rolled up data in a visualization>>
for more information.
data, raw data, or both. For more information, refer to <<rollup-index-pattern,rolled up data>>.
[role="screenshot"]
image::images/management_rollup_job_dashboard.png[][Dashboard with rolled up data]

View file

@ -7,73 +7,78 @@ _Visualize_ enables you to create visualizations of the data from your {es} indi
{kib} visualizations are based on {es} queries. By using a series of {es} {ref}/search-aggregations.html[aggregations] to extract and process your data, you can create charts that show you the trends, spikes, and dips you need to know about.
[float]
[[create-a-visualization]]
== Create visualizations
To begin, open *Visualize*, then click *Create new visualization*.
[float]
[[visualization-types]]
== Types of visualizations
{kib} supports several types of visualizations.
. Open *Visualize*.
. Click *Create new visualization*.
. Choose the visualization type:
+
* Basic charts
[horizontal]
<<lens,Lens>>::
Quickly build several types of basic visualizations by simply dragging and dropping the data fields you want to display.
* *<<most-frequent,Most frequently used visualizations>>*
[horizontal]
Line&comma; area, and bar charts:: Compare different series in X/Y charts.
<<most-frequent,Most frequently used visualizations>>::
Pie chart:: Display each source contribution to a total.
* *Line, area, and bar charts* &mdash; Compares different series in X/Y charts.
Data table:: Flattens aggregations into table format.
* *Pie chart* &mdash; Displays each source contribution to a total.
Metric:: Display a single number.
* *Data table* &mdash; Flattens aggregations into table format.
Goal and gauge:: Display a number with progress indicators.
* *Metric* &mdash; Displays a single number.
Tag cloud:: Display words in a cloud, where the size of the word corresponds to its importance.
* *Goal and gauge* &mdash; Displays a number with progress indicators.
* *Time series optimized*
[horizontal]
<<TSVB,TSVB>>:: Visualize time series data using pipeline aggregations.
* *Tag cloud* &mdash; Displays words in a cloud, where the size of the word corresponds to its importance.
<<timelion,Timelion>>:: Compute and combine data from multiple time series
<<TSVB,TSVB>>:: Visualizes time series data using pipeline aggregations.
<<timelion,Timelion>>:: Computes and combine data from multiple time series
data sets.
* *Maps*
[horizontal]
<<maps,Elastic Maps>>:: The most powerful way of visualizing map data in {kib}.
<<visualize-maps, Maps>>::
* *<<maps,Elastic Maps>>* &mdash; Displays geospatial data in {kib}.
<<visualize-maps,Coordinate map>>:: Displays points on a map using a geohash aggregation.
* *Coordinate map* &mdash; Displays points on a map using a geohash aggregation.
<<visualize-maps,Region map>>:: Merge any structured map data onto a shape.
* *Region map* &mdash; Merges any structured map data onto a shape.
<<visualize-maps,Heat map>>:: Display shaded cells within a matrix.
* *Heat map* &mdash; Displays shaded cells within a matrix.
* *<<for-dashboard,Dashboard tools>>*
[horizontal]
Controls:: Adds interactive inputs to a Dashboard.
<<for-dashboard,Dashboard tools>>::
Markdown widget:: Display free-form information or instructions.
* *Markdown widget* &mdash; Displays free-form information or instructions.
* *For developers*
[horizontal]
<<vega-graph,Vega>>:: Complete control over query and display.
* *Controls* &mdash; Adds interactive inputs to a dashboard.
. Specify a search query to retrieve the data for your visualization:
** To enter new search criteria, select the <<index-patterns, index pattern>> for the indices that
<<vega-graph,Vega>>:: Completes control over query and display.
[float]
[[choose-your-data]]
== Choose your data
Specify a search query to retrieve the data for your visualization, or used rolled up data.
* To enter new search criteria, select the <<index-patterns, index pattern>> for the indices that
contain the data you want to visualize. The visualization builder opens
with a wildcard query that matches all of the documents in the selected
indices.
** To build a visualization from a saved search, click the name of the saved
* To build a visualization from a saved search, click the name of the saved
search you want to use. The visualization builder opens and loads the
selected query.
+
NOTE: When you build a visualization from a saved search, any subsequent
modifications to the saved search are automatically reflected in the
visualization. To disable automatic updates, you can disconnect a visualization
from the saved search.
modifications to the saved search are reflected in the
visualization. To disable automatic updates, delete the visualization
on the *Saved Object* page.
* To build a visualization using <<rollup-index-pattern,rolled up data>>, select
the index pattern that includes the data. Rolled up data is summarized into
time buckets that can be split into sub buckets for numeric field values or
terms. To lower granularity, use a time aggregation that uses and combines
several time buckets. For an example, refer to <<rollup-data-tutorial,Create and visualize rolled up data>>.
[float]
[[vis-inspector]]
@ -124,8 +129,6 @@ to view an embedded visualization.
* Generate a PNG report.
--
include::{kib-repo-dir}/visualize/visualize_rollup_data.asciidoc[]
include::{kib-repo-dir}/visualize/aggregations.asciidoc[]
include::{kib-repo-dir}/visualize/lens.asciidoc[]