Adds What's New, filter management information, updates several screenshots.
|
@ -139,3 +139,7 @@ image:images/NYCTA-Statistics.jpg[]
|
|||
|
||||
Click the _Edit_ button image:images/EditVis.png[Pencil button] at the top right of a container to open the
|
||||
visualization in the <<visualize,Visualize>> page.
|
||||
|
||||
[float]
|
||||
[[dashboard-filters]]
|
||||
include::filter-pinning.asciidoc[]
|
||||
|
|
|
@ -71,9 +71,8 @@ to find entries that have 4xx status codes and have an extension of `php` or `ht
|
|||
499] AND (extension:php OR extension:html)`.
|
||||
+
|
||||
NOTE: These examples use the Lucene query syntax. You can also submit queries using the Elasticsearch Query DSL. For
|
||||
examples, see
|
||||
http://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-query-string-query.html#query-string-syntax[query string syntax]
|
||||
in the Elasticsearch Reference.
|
||||
examples, see {ref}/query-dsl-query-string-query.html#query-string-syntax[query string syntax] in the Elasticsearch
|
||||
Reference.
|
||||
+
|
||||
. Press *Enter* or click the *Search* button to submit your search query.
|
||||
|
||||
|
@ -146,7 +145,8 @@ To add a filter from the Documents table:
|
|||
|
||||
. Expand a document in the Documents table by clicking the *Expand* button image:images/ExpandButton.jpg[Expand Button]
|
||||
to the left of the document's entry in the first column (the first column is usually Time). To the right of each field
|
||||
name, there are two magnifying glass buttons--one for adding a regular (positive) filter, and one for adding a negative filter.
|
||||
name, there are two magnifying glass buttons--one for adding a regular (positive) filter, and one for adding a negative
|
||||
filter.
|
||||
. To add a positive filter based on the document's value in a field, click the
|
||||
*Positive Filter* button image:images/PositiveFilter.jpg[Positive Filter Button]. This filters out documents that don't
|
||||
contain the specified value in that field.
|
||||
|
@ -154,6 +154,10 @@ contain the specified value in that field.
|
|||
*Negative Filter* button image:images/NegativeFilter.jpg[Negative Filter Button]. This excludes documents that contain
|
||||
the specified value in that field.
|
||||
|
||||
[float]
|
||||
[[discover-filters]]
|
||||
include::filter-pinning.asciidoc[]
|
||||
|
||||
[float]
|
||||
[[document-data]]
|
||||
=== Viewing Document Data
|
||||
|
@ -192,12 +196,14 @@ of the field name. Clicking the field name a second time reverses the sort order
|
|||
[[adding-columns]]
|
||||
==== Adding Field Columns to the Documents Table
|
||||
By default, the Documents table shows the localized version of the time field specified in the selected index pattern
|
||||
and the document `_source`. You can add fields to the table from the Fields list.
|
||||
and the document `_source`. You can add fields to the table from the Fields list or from a document's expanded view.
|
||||
|
||||
To add field columns to the Documents table:
|
||||
|
||||
. Mouse over a field in the Fields list and click its *add* button image:images/AddFieldButton.jpg[Add Field Button].
|
||||
. Repeat until you've added all the fields you want to display in the Documents table.
|
||||
. Alternately, add a field column directly from a document's expanded view by clicking the
|
||||
image:images/add-column-button.png[Add Column] *Toggle column in table* button.
|
||||
|
||||
The added field columns replace the `_source` column in the Documents table. The added fields are also
|
||||
listed in the *Selected Fields* section at the top of the field list.
|
||||
|
@ -229,5 +235,4 @@ Fields, or the list of other fields.
|
|||
|
||||
image:images/Discover-FieldStats.jpg[Field Statistics]
|
||||
|
||||
|
||||
TIP: To create a visualization based on the field, click the *Visualize* button below the field statistics.
|
||||
|
|
26
docs/filter-pinning.asciidoc
Normal file
|
@ -0,0 +1,26 @@
|
|||
=== Working with Filters
|
||||
|
||||
When you create a filter anywhere in Kibana, the filter conditions display in a green oval under the search text
|
||||
entry box:
|
||||
|
||||
image::images/filter-sample.png[]
|
||||
|
||||
Hovering on the filter oval displays the following icons:
|
||||
|
||||
image::images/filter-allbuttons.png[]
|
||||
|
||||
Enable Filter image:images/filter-enable.png[]:: Click this icon to disable the filter without removing it. You can
|
||||
enable the filter again later by clicking the icon again. Disabled filters display a striped shaded color, green for
|
||||
inclusion filters and red for exclusion filters.
|
||||
Pin Filter image:images/filter-pin.png[]:: Click this icon to _pin_ a filter. Pinned filters persist across Kibana tabs.
|
||||
You can pin filters from the _Visualize_ tab, click on the _Discover_ or _Dashboard_ tabs, and those filters remain in
|
||||
place.
|
||||
NOTE: If you have a pinned filter and you're not seeing any query results, that your current tab's index pattern is one
|
||||
that the filter applies to.
|
||||
Toggle Filter image:images/filter-toggle.png[]:: Click this icon to _toggle_ a filter. By default, filters are inclusion
|
||||
filters, and display in green. Only elements that match the filter are displayed. To change this to an exclusion
|
||||
filters, displaying only elements that _don't_ match, toggle the filter. Exclusion filters display in red.
|
||||
Remove Filter image:images/filter-delete.png[]:: Click this icon to remove a filter entirely.
|
||||
|
||||
To apply any of the filter actions to all the filters currently in place, click the image:images/filter-actions.png[]
|
||||
*Global Filter Actions* button and select an action.
|
|
@ -19,17 +19,15 @@ The material in this section assumes you have a working Kibana install connected
|
|||
The tutorials in this section rely on the following data sets:
|
||||
|
||||
* The complete works of William Shakespeare, suitably parsed into fields. Download this data set by clicking here:
|
||||
https://www.elastic.co/guide/en/kibana/3.0/snippets/shakespeare.json[shakespeare.json.gz].
|
||||
https://www.elastic.co/guide/en/kibana/3.0/snippets/shakespeare.json[shakespeare.json].
|
||||
* A set of fictitious accounts with randomly generated data. Download this data set by clicking here:
|
||||
https://github.com/bly2k/files/blob/master/accounts.zip?raw=true[accounts.json.gz]
|
||||
https://github.com/bly2k/files/blob/master/accounts.zip?raw=true[accounts.json]
|
||||
* A set of randomly generated log files. Download this data set by clicking here: [logstash.json.gz]
|
||||
|
||||
The data sets are compressed with the `gzip` utility. Unzip the files after downloading them with the following
|
||||
commands:
|
||||
Two of the data sets are compressed. Use the following commands to extract the files:
|
||||
|
||||
[source,shell]
|
||||
gunzip shakespeare.json.gz
|
||||
gunzip accounts.json.gz
|
||||
unzip accounts.zip
|
||||
gunzip logstash.json.gz
|
||||
|
||||
The Shakespeare data set is organized in the following schema:
|
||||
|
@ -124,7 +122,6 @@ yellow open logstash-2015.05.18 5 1 4631 0 15.6mb
|
|||
yellow open logstash-2015.05.19 5 1 4624 0 15.7mb 15.7mb
|
||||
yellow open logstash-2015.05.20 5 1 4750 0 16.4mb 16.4mb
|
||||
|
||||
[float]
|
||||
[[tutorial-define-index]]
|
||||
=== Defining Your Index Patterns
|
||||
|
||||
|
@ -175,7 +172,6 @@ display from the full text of five records to a simple list of five account numb
|
|||
|
||||
image::images/tutorial-discover-3.png[]
|
||||
|
||||
[float]
|
||||
[[tutorial-visualizing]]
|
||||
=== Data Visualization: Beyond Discovery
|
||||
|
||||
|
@ -277,9 +273,10 @@ this:
|
|||
|
||||
image::images/tutorial-visualize-map-2.png[]
|
||||
|
||||
You can navigate the map by clicking and dragging, zoom with the *+/-* buttons, or hit the *Fit Data Bounds* button to
|
||||
zoom to the lowest level that includes all the points. You can also create a filter to define a rectangle on the map,
|
||||
either to include or exclude, by clicking the *Latitude/Longitude Filter* button and drawing a bounding box on the map.
|
||||
You can navigate the map by clicking and dragging, zoom with the image:images/viz-zoom.png[] buttons, or hit the *Fit
|
||||
Data Bounds* image:images/viz-fit-bounds.png[] button to zoom to the lowest level that includes all the points. You can
|
||||
also create a filter to define a rectangle on the map, either to include or exclude, by clicking the
|
||||
*Latitude/Longitude Filter* image:images/viz-lat-long-filter.png[] button and drawing a bounding box on the map.
|
||||
A green oval with the filter definition displays right under the query box:
|
||||
|
||||
image::images/tutorial-visualize-map-3.png[]
|
||||
|
@ -305,7 +302,6 @@ image::images/tutorial-visualize-md-2.png[]
|
|||
|
||||
Save this visualization with the name _Markdown Example_.
|
||||
|
||||
[float]
|
||||
[[tutorial-dashboard]]
|
||||
=== Putting it all Together with Dashboards
|
||||
|
||||
|
|
Before Width: | Height: | Size: 39 KiB After Width: | Height: | Size: 31 KiB |
Before Width: | Height: | Size: 178 KiB After Width: | Height: | Size: 180 KiB |
Before Width: | Height: | Size: 66 KiB After Width: | Height: | Size: 62 KiB |
BIN
docs/images/filter-actions.png
Normal file
After Width: | Height: | Size: 2 KiB |
BIN
docs/images/filter-allbuttons.png
Normal file
After Width: | Height: | Size: 7.1 KiB |
BIN
docs/images/filter-delete.png
Normal file
After Width: | Height: | Size: 760 B |
BIN
docs/images/filter-enable.png
Normal file
After Width: | Height: | Size: 1.1 KiB |
BIN
docs/images/filter-pin.png
Normal file
After Width: | Height: | Size: 1 KiB |
BIN
docs/images/filter-sample.png
Normal file
After Width: | Height: | Size: 17 KiB |
BIN
docs/images/filter-toggle.png
Normal file
After Width: | Height: | Size: 1.6 KiB |
Before Width: | Height: | Size: 856 KiB After Width: | Height: | Size: 855 KiB |
|
@ -3,6 +3,7 @@
|
|||
|
||||
:ref: http://www.elastic.co/guide/en/elasticsearch/reference/current
|
||||
:shield: https://www.elastic.co/guide/en/shield/current
|
||||
:k4pull: https://github.com/elastic/kibana/pull/
|
||||
|
||||
include::introduction.asciidoc[]
|
||||
|
||||
|
|
|
@ -53,4 +53,5 @@ that displays several visualizations of the TFL data:
|
|||
image:images/TFL-Dashboard.jpg[Dashboard]
|
||||
|
||||
For more information about creating and sharing visualizations and dashboards, see the <<visualize, Visualize>>
|
||||
and <<dashboard, Dashboard>> topics.
|
||||
and <<dashboard, Dashboard>> topics. A complete <<getting-started,tutorial>> covering several aspects of Kibana's
|
||||
functionality is also available.
|
||||
|
|
|
@ -10,7 +10,7 @@ All you need is:
|
|||
** Which Elasticsearch indices you want to search.
|
||||
|
||||
NOTE: If your Elasticsearch installation is protected by http://www.elastic.co/overview/shield/[Shield] see
|
||||
https://www.elastic.co/guide/en/shield/current/_shield_with_kibana_4.html[Shield with Kibana 4] for additional setup instructions.
|
||||
{shield}/_shield_with_kibana_4.html[Shield with Kibana 4] for additional setup instructions.
|
||||
|
||||
[float]
|
||||
[[install]]
|
||||
|
|
|
@ -131,6 +131,10 @@ NOTE: Remember, each subsequent bucket slices the data from the previous bucket.
|
|||
To render the visualization on the _preview canvas_, click the green *Apply Changes* button at the top right of the
|
||||
Aggregation Builder.
|
||||
|
||||
[float]
|
||||
[[visualize-filters]]
|
||||
include::filter-pinning.asciidoc[]
|
||||
|
||||
[float]
|
||||
[[preview-canvas]]
|
||||
===== Preview Canvas
|
||||
|
|
|
@ -1,58 +1,35 @@
|
|||
[[whats-new]]
|
||||
== What's New in Kibana 4
|
||||
|
||||
Kibana 4 provides dozens of new features that enable you to compose questions,
|
||||
get answers, and solve problems like never before. It has a brand-new look and
|
||||
feel and improved workflows for discovering and visualizing your data and
|
||||
building and sharing dashboards.
|
||||
== What's New in Kibana 4.1
|
||||
|
||||
[float]
|
||||
[[key-features]]
|
||||
=== Key Features
|
||||
* New data search and discovery interface
|
||||
* Unified visualization builder for your favorite visualizations and some brand
|
||||
new ones:
|
||||
** Area Chart
|
||||
** Data Table
|
||||
** Line Chart
|
||||
** Markdown Text Widget
|
||||
** Pie Chart (including "doughnut" charts)
|
||||
** Raw Document Widget
|
||||
** Single Metric Widget
|
||||
** Tile Map
|
||||
** Vertical Bar Chart
|
||||
* Drag and drop dashboard builder that enables you to quickly add, rearrange,
|
||||
resize, and remove visualizations
|
||||
* Advanced aggregation-based analytics capabilities, including support for:
|
||||
** Unique counts (cardinality)
|
||||
** Non-date histograms
|
||||
** Ranges
|
||||
** Significant terms
|
||||
** Percentiles
|
||||
* Expressions-based scripted fields enable you to perform ad-hoc analysis by
|
||||
performing computations on the fly
|
||||
|
||||
* {k4pull}2518[*Pull Request 2518*]: You can pin filters to make the filter persist across Kibana functionality, from
|
||||
the Visualize tab to Discover to a Dashboard.
|
||||
* {k4pull}2731[*Pull Request 2731*]: Field formatting options now supported in Settings.
|
||||
* {k4pull}3154[*Pull Request 3154*]: New chart: Bubble chart, derived from the basic line chart.
|
||||
* {k4pull}3212[*Pull Request 3212*]: You can now install Kibana on Linux with a package manager such as `yum` or
|
||||
`apt-get`.
|
||||
* {k4pull}3271[*Pull Request 3271*] and {k4pull}3262[*3262*]: New aggregations: IPv4 and Date range aggregations enable
|
||||
you to specify buckets for these qualities.
|
||||
* {k4pull}3290[*Pull Request 3290*]: You can select a time interval for the Discover display of time series data.
|
||||
* {k4pull}3470[*Pull Request 3470*]: New metric: Percentile ranks.
|
||||
* {k4pull}3573[*Pull Request 3573*]: Kibana objects (visualizations, dashboards, and searches) can be imported and
|
||||
exported.
|
||||
* {k4pull}3830[*Pull Request 3830*]: New chart: Heatmap, a tile map display variant.
|
||||
|
||||
[float]
|
||||
[[improvements]]
|
||||
=== Improvements
|
||||
* Ability to save searches and visualizations enables you to link
|
||||
searches to visualizations and add the same visualization to multiple dashboards
|
||||
* Visualizations support an unlimited number of nested aggregations so you can
|
||||
display new types of visualizations, such as "doughnut" charts
|
||||
* New URL format eliminates the need for templated and scripted dashboards
|
||||
* Better mobile experience
|
||||
* Faster dashboard loading due to a reduction in the number HTTP calls needed to load the page
|
||||
* SSL encryption for client requests as well as requests to and from Elasticsearch
|
||||
* Search result highlighting
|
||||
* Easy to access and export the data behind any visualization:
|
||||
** View in a table or view as JSON
|
||||
** Export in CSV format
|
||||
** See the Elasticsearch request and response
|
||||
* Share and embed individual visualizations as well as dashboards
|
||||
|
||||
[float]
|
||||
[[nuts-bolts]]
|
||||
=== Nuts and Bolts
|
||||
* Ships with its own webserver and uses Node.js on the backend--installation
|
||||
binaries are provided for Linux, Windows, and Mac OS
|
||||
* Uses the D3 framework to display visualizations
|
||||
* {k4pull}3164[*Pull Request 3164*]: You can now store a specific time range with a dashboard.
|
||||
* {k4pull}3233[*Pull Request 3233*]: New Y axis scale options, log scale and square root scale.
|
||||
* {k4pull}3237[*Pull Request 3237*]: Dat Histogram bucket aggregation now supports custom intervals, from seconds to
|
||||
years.
|
||||
* {k4pull}3273[*Pull Request 3273*]: Line smoothing for for line and area charts.
|
||||
* {k4pull}3464[*Pull Request 3464*]: You can now specify the extent of the Y axis for charts.
|
||||
* {k4pull}3526[*Pull Request 3526*]: You can add columns to Dicover's list of results directly from an entry's table of
|
||||
fields.
|
||||
* {k4pull}3671[*Pull Request 3671*]: Tile maps now support latitude/longitude filtering.
|
||||
* {k4pull}3800[*Pull Request 3800*]: You can now pause auto-refresh on a dashboard.
|
||||
|
|