Kaarina Tungseth
GitHub
parent
ce349622f3
commit
cc452ed4bb
|
|
@ -3,9 +3,9 @@
|
|||
|
||||
[partintro]
|
||||
--
|
||||
_Visualize_ enables you to create visualizations of the data from your Elasticsearch indices, which you can then add to dashboards for analysis.
|
||||
_Visualize_ enables you to create visualizations of the data from your {es} indices, which you can then add to dashboards for analysis.
|
||||
|
||||
{kib} visualizations are based on Elasticsearch queries. By using a series of {es} {ref}/search-aggregations.html[aggregations] to extract and process your data, you can create charts that show you the trends, spikes, and dips you need to know about.
|
||||
{kib} visualizations are based on {es} queries. By using a series of {es} {ref}/search-aggregations.html[aggregations] to extract and process your data, you can create charts that show you the trends, spikes, and dips you need to know about.
|
||||
|
||||
[float]
|
||||
[[create-a-visualization]]
|
||||
|
|
@ -15,42 +15,59 @@ _Visualize_ enables you to create visualizations of the data from your Elasticse
|
|||
. Click *Create new visualization*.
|
||||
. Choose the visualization type:
|
||||
+
|
||||
* *Basic charts*
|
||||
<<lens,Lens>>:: Quickly build several types of basic visualizations by simply dragging and dropping the data fields you want to display.
|
||||
* Basic charts
|
||||
[horizontal]
|
||||
<<lens,Lens>>::
|
||||
Quickly build several types of basic visualizations by simply dragging and dropping the data fields you want to display.
|
||||
|
||||
* *<<most-frequent,Most frequently used visualizations>>*
|
||||
[horizontal]
|
||||
Line, area, and bar charts:: Compare different series in X/Y charts.
|
||||
|
||||
Pie chart:: Display each source contribution to a total.
|
||||
|
||||
Data table:: Flattens aggregations into table format.
|
||||
|
||||
Metric:: Display a single number.
|
||||
|
||||
Goal and gauge:: Display a number with progress indicators.
|
||||
Heat maps:: Display shaded cells within a matrix.
|
||||
|
||||
Tag cloud:: Display words in a cloud, where the size of the word corresponds to its importance.
|
||||
|
||||
* *Time series optimized*
|
||||
[horizontal]
|
||||
<<TSVB,TSVB>>:: Visualize time series data using pipeline aggregations.
|
||||
|
||||
<<timelion,Timelion>>:: Compute and combine data from multiple time series
|
||||
data sets.
|
||||
|
||||
* *Maps*
|
||||
[horizontal]
|
||||
<<maps, Elastic maps>>:: The most powerful way of visualizing map data in {kib}.
|
||||
<<tilemap,_Coordinate map_>>:: Displays points on a map using a geohash aggregation.
|
||||
<<regionmap,_Region map_>>:: Merge any structured map data onto a shape.
|
||||
* *<<for-dashboard, For use in dashboards>>*
|
||||
<<maps,Elastic Maps>>:: The most powerful way of visualizing map data in {kib}.
|
||||
|
||||
<<tilemap,Coordinate map>>:: Displays points on a map using a geohash aggregation.
|
||||
|
||||
<<regionmap,Region map>>:: Merge any structured map data onto a shape.
|
||||
|
||||
<<heatmap,Heat map>>:: Display shaded cells within a matrix.
|
||||
|
||||
* *<<for-dashboard,Dashboard tools>>*
|
||||
[horizontal]
|
||||
<<for-dashboard,Controls>>:: Provides the ability to add interactive inputs to a Dashboard.
|
||||
|
||||
<<for-dashboard,Markdown widget>>:: Display free-form information or instructions.
|
||||
|
||||
* *For developers*
|
||||
[horizontal]
|
||||
<<vega-graph,Vega>>:: Complete control over query and display.
|
||||
|
||||
. Specify a search query to retrieve the data for your visualization:
|
||||
** To enter new search criteria, select the <<index-patterns, index pattern>> for the indices that
|
||||
contain the data you want to visualize. This opens the visualization builder
|
||||
contain the data you want to visualize. The visualization builder opens
|
||||
with a wildcard query that matches all of the documents in the selected
|
||||
indices.
|
||||
** To build a visualization from a saved search, click the name of the saved
|
||||
search you want to use. This opens the visualization builder and loads the
|
||||
search you want to use. The visualization builder opens and loads the
|
||||
selected query.
|
||||
+
|
||||
NOTE: When you build a visualization from a saved search, any subsequent
|
||||
|
|
@ -58,9 +75,12 @@ modifications to the saved search are automatically reflected in the
|
|||
visualization. To disable automatic updates, you can disconnect a visualization
|
||||
from the saved search.
|
||||
|
||||
|
||||
--
|
||||
include::{kib-repo-dir}/visualize/visualize_rollup_data.asciidoc[]
|
||||
|
||||
include::{kib-repo-dir}/visualize/aggregations.asciidoc[]
|
||||
|
||||
include::{kib-repo-dir}/visualize/lens.asciidoc[]
|
||||
|
||||
include::{kib-repo-dir}/visualize/most-frequent.asciidoc[]
|
||||
|
|
@ -70,6 +90,7 @@ include::{kib-repo-dir}/visualize/timelion.asciidoc[]
|
|||
|
||||
include::{kib-repo-dir}/visualize/tilemap.asciidoc[]
|
||||
include::{kib-repo-dir}/visualize/regionmap.asciidoc[]
|
||||
include::{kib-repo-dir}/visualize/heatmap.asciidoc[]
|
||||
|
||||
include::{kib-repo-dir}/visualize/for-dashboard.asciidoc[]
|
||||
|
||||
|
|
|
|||
|
|
@ -1,136 +1,112 @@
|
|||
[[supported-aggregations]]
|
||||
=== Supported aggregations
|
||||
== Supported aggregations
|
||||
|
||||
The most frequently used visualizations support the following aggregations.
|
||||
Use the supported aggregations to build your visualizations.
|
||||
|
||||
[float]
|
||||
[[visualize-metric-aggregations]]
|
||||
==== Metric aggregations
|
||||
=== Metric aggregations
|
||||
|
||||
The *Count* metric lets you visualize the number of documents in a bucket.
|
||||
If there are no bucket aggregations defined, this is the total number of documents that match the query.
|
||||
It is the default selection.
|
||||
|
||||
All other metric aggregations require a field selection, which will read from the indexed values. Alternatively,
|
||||
you can override field values with a script using the <<visualize-advanced-aggregation-options, JSON input>>. The
|
||||
other metric aggregations are:
|
||||
Metric aggregations extract field from documents to generate data values.
|
||||
|
||||
{ref}/search-aggregations-metrics-avg-aggregation.html[Average]:: The mean value.
|
||||
{ref}/search-aggregations-metrics-max-aggregation.html[Maximum]:: The highest value.
|
||||
{ref}/search-aggregations-metrics-percentile-aggregation.html[Median]:: The value that is in the 50% percentile.
|
||||
{ref}/search-aggregations-metrics-min-aggregation.html[Minimum]:: The lowest value.
|
||||
{ref}/search-aggregations-metrics-sum-aggregation.html[Sum]:: The total value.
|
||||
|
||||
Unique Count:: The {ref}/search-aggregations-metrics-cardinality-aggregation.html[Cardinality] of the field within the bucket.
|
||||
Supports any data type.
|
||||
{ref}/search-aggregations-metrics-valuecount-aggregation.html[Count]:: The total number of documents that match the query, which allows you to visualize the number of documents in a bucket. Count is the default value.
|
||||
|
||||
{ref}/search-aggregations-metrics-max-aggregation.html[Max]:: The highest value.
|
||||
|
||||
{ref}/search-aggregations-metrics-percentile-aggregation.html[Median]:: The value that is in the 50% percentile.
|
||||
|
||||
{ref}/search-aggregations-metrics-min-aggregation.html[Min]:: The lowest value.
|
||||
|
||||
{ref}/search-aggregations-metrics-percentile-rank-aggregation.html[Percentile ranks]:: Returns the percentile rankings for the values in the specified numeric field. Select a numeric field from the drop-down, then specify one or more percentile rank values in the *Values* fields.
|
||||
|
||||
{ref}/search-aggregations-metrics-percentile-aggregation.html[Percentiles]:: Divides the
|
||||
values in a numeric field into specified percentile bands. Select a field from the drop-down, then specify one or more ranges in the *Percentiles* fields.
|
||||
|
||||
Standard Deviation:: Requires a numeric field. Uses the {ref}/search-aggregations-metrics-extendedstats-aggregation.html[_extended stats_] aggregation.
|
||||
|
||||
{ref}/search-aggregations-metrics-top-hits-aggregation.html[Top Hit]:: Returns a sample of individual documents. When the Top Hit aggregation is matched to more than one document, you must choose a technique for combining the values. Techniques include average, minimum, maximum, and sum.
|
||||
{ref}/search-aggregations-metrics-sum-aggregation.html[Sum]:: The total value.
|
||||
|
||||
{ref}/search-aggregations-metrics-percentile-aggregation.html[Percentiles]:: Divides the
|
||||
values in a numeric field into specified percentile bands. Select a field from the drop-down, then specify one or more ranges in the *Percentiles* fields. Click the *X* to remove a percentile field. Click *+ Add* to add a percentile field.
|
||||
{ref}/search-aggregations-metrics-top-hits-aggregation.html[Top hit]:: Returns a sample of individual documents. When the Top Hit aggregation is matched to more than one document, you must choose a technique for combining the values. Techniques include average, minimum, maximum, and sum.
|
||||
|
||||
{ref}/search-aggregations-metrics-percentile-rank-aggregation.html[Percentile Rank]:: Returns the percentile rankings for the values in the specified numeric field. Select a numeric field from the drop-down, then specify one or more percentile rank values in the *Values* fields. Click the *X* to remove a values field. Click *+Add* to add a values field.
|
||||
Unique Count:: The {ref}/search-aggregations-metrics-cardinality-aggregation.html[Cardinality] of the field within the bucket.
|
||||
|
||||
Alternatively, you can override the field values with a script using JSON input. For example:
|
||||
|
||||
[source,shell]
|
||||
{ "script" : "doc['grade'].value * 1.2" }
|
||||
|
||||
The example implements a {es} {ref}/search-aggregations.html[Script Value Source], which replaces
|
||||
the value in the metric. The options available depend on the aggregation you choose.
|
||||
|
||||
[float]
|
||||
[[visualize-parent-pipeline-aggregations]]
|
||||
=== Parent pipeline aggregations
|
||||
|
||||
Parent pipeline aggregations assume the bucket aggregations are ordered and are especially useful for time series data. For each parent pipeline aggregation, you must define a bucket aggregation and metric aggregation.
|
||||
|
||||
You can also nest these aggregations. For example, if you want to produce a third derivative.
|
||||
|
||||
{ref}/search-aggregations-pipeline-bucket-script-aggregation.html[Bucket script]:: Executes a script that performs computations for each bucket that specifies metrics in the parent multi-bucket aggregation.
|
||||
|
||||
{ref}/search-aggregations-pipeline-cumulative-sum-aggregation.html[Cumulative sum]:: Calculates the cumulative sum of a specified metric in a parent histogram.
|
||||
|
||||
{ref}/search-aggregations-pipeline-derivative-aggregation.html[Derivative]:: Calculates the derivative of specific metrics.
|
||||
|
||||
{ref}/search-aggregations-pipeline-movavg-aggregation.html[Moving avg]:: Slides a window across the data and emits the average value of the window.
|
||||
|
||||
{ref}/search-aggregations-pipeline-serialdiff-aggregation.html[Serial diff]:: Values in a time series are subtracted from itself at different time lags or periods.
|
||||
|
||||
Custom {kib} plugins can <<development-visualize-index, add more capabilities to the default editor>>, which includes support for adding more aggregations.
|
||||
|
||||
[float]
|
||||
[[visualize-sibling-pipeline-aggregations]]
|
||||
==== Sibling pipeline aggregations
|
||||
=== Sibling pipeline aggregations
|
||||
|
||||
For each of the sibling pipeline aggregations you have to define a bucket and metric to calculate. This
|
||||
has the effect of condensing many buckets into one number.
|
||||
Sibling pipeline aggregations condense many buckets into one. For each sibling pipeline aggregation, you must define a bucket aggregations and metric aggregation.
|
||||
|
||||
{ref}/search-aggregations-pipeline-avg-bucket-aggregation.html[Average Bucket]:: Calculates the mean, or average, value of a specified metric in a sibling aggregation.
|
||||
|
||||
{ref}/search-aggregations-pipeline-avg-bucket-aggregation.html[Sum Bucket]:: Calculates the sum of the values of a specified metric in a sibling aggregation.
|
||||
|
||||
{ref}/search-aggregations-pipeline-avg-bucket-aggregation.html[Min Bucket]:: Calculates the minimum value of a specified metric in a sibling aggregation.
|
||||
{ref}/search-aggregations-pipeline-avg-bucket-aggregation.html[Average bucket]:: Calculates the mean, or average, value of a specified metric in a sibling aggregation.
|
||||
|
||||
{ref}/search-aggregations-pipeline-avg-bucket-aggregation.html[Max Bucket]:: Calculates the maximum value of a specified metric in a sibling aggregation.
|
||||
|
||||
{ref}/search-aggregations-pipeline-avg-bucket-aggregation.html[Min Bucket]:: Calculates the minimum value of a specified metric in a sibling aggregation.
|
||||
|
||||
{ref}/search-aggregations-pipeline-avg-bucket-aggregation.html[Sum Bucket]:: Calculates the sum of the values of a specified metric in a sibling aggregation.
|
||||
|
||||
[float]
|
||||
[[visualize-bucket-aggregations]]
|
||||
==== Bucket aggregations
|
||||
=== Bucket aggregations
|
||||
|
||||
{ref}/search-aggregations-bucket-datehistogram-aggregation.html[Date Histogram]:: Splits a date field into buckets by interval. If the date field is the primary time field for the index pattern, it will pick an automatic interval for you. You can also choose a minimum time interval, or specify a custom interval frame by selecting *Custom* as the interval and
|
||||
specifying a number and a time unit in the text field. Custom interval time units are *s* for seconds, *m* for minutes,
|
||||
*h* for hours, *d* for days, *w* for weeks, and *y* for years. Different units support different levels of precision,
|
||||
down to one millisecond. Intervals are labeled at the start of the interval, using the date-key returned by Elasticsearch.For example, the tooltip for a monthly interval will show the first day of the month.
|
||||
Bucket aggregations sort documents into buckets, depending on the contents of the document.
|
||||
|
||||
{ref}/search-aggregations-bucket-histogram-aggregation.html[Histogram]:: Builds from a numeric field. Specify an integer interval for this field. Select the *Show empty buckets* checkbox to include empty intervals in the histogram.
|
||||
{ref}/search-aggregations-bucket-datehistogram-aggregation.html[Date histogram]:: Splits a date field into buckets by interval. If the date field is the primary time field for the index pattern, it chooses an automatic interval for you. Intervals are labeled at the start of the interval, using the date-key returned by {es}. For example, the tooltip for a monthly interval displays the first day of the month.
|
||||
|
||||
{ref}/search-aggregations-bucket-range-aggregation.html[Range]:: Specify ranges of values for a numeric field. Click *Add Range* to add a set of range endpoints. Click the red *(x)* symbol to remove a range.
|
||||
{ref}/search-aggregations-bucket-daterange-aggregation.html[Date range]:: Reports values that are within a range of dates that you specify. You can specify the ranges for the dates using {ref}/common-options.html#date-math[_date math_] expressions.
|
||||
|
||||
{ref}/search-aggregations-bucket-daterange-aggregation.html[Date Range]:: Reports values that are within a range of dates that you specify. You can specify the ranges for the dates using {ref}/common-options.html#date-math[_date math_] expressions. Click *Add Range* to add a set of range endpoints.
|
||||
Click the red *(x)* symbol to remove a range.
|
||||
{ref}/search-aggregations-bucket-filter-aggregation.html[Filter]:: Each filter creates a bucket of documents. You can specify a filter as a
|
||||
<<kuery-query, KQL>> or <<lucene-query, Lucene>> query string.
|
||||
|
||||
{ref}/search-aggregations-bucket-iprange-aggregation.html[IPv4 Range]:: Specify ranges of IPv4 addresses. Click *Add Range* to add a set of range endpoints. Click the red *(x)* symbol to remove a range.
|
||||
{ref}/search-aggregations-bucket-geohashgrid-aggregation.html[Geohash]:: Displays points based on a geohash. Supported by the tile map and data table visualizations.
|
||||
|
||||
*Filters*:: Each filter creates a bucket of documents. You can specify a filter as a
|
||||
<<kuery-query, KQL>> or <<lucene-query, Lucene>> query string. Click *Add Filter* to
|
||||
add another filter. Click the image:images/labelbutton.png[Label button icon] *label* button to open the label field, where
|
||||
you can type in a name to display on the visualization.
|
||||
{ref}/search-aggregations-bucket-geotilegrid-aggregation.html[Geotile]:: Groups points based on web map tiling. Supported by the tile map and data table visualizations.
|
||||
|
||||
{ref}/search-aggregations-bucket-terms-aggregation.html[Terms]:: Specify the top or bottom _n_ elements of a given field to display, ordered by count or a custom metric.
|
||||
{ref}/search-aggregations-bucket-histogram-aggregation.html[Histogram]:: Builds from a numeric field.
|
||||
|
||||
{ref}/search-aggregations-bucket-significantterms-aggregation.html[Significant Terms]:: Returns interesting or unusual occurrences of terms in a set.
|
||||
{ref}/search-aggregations-bucket-iprange-aggregation.html[IPv4 range]:: Specify ranges of IPv4 addresses.
|
||||
|
||||
Both Terms and Significant Terms support {es} {ref}/search-aggregations-bucket-terms-aggregation.html#_filtering_values_4[exclude and include patterns] which
|
||||
are available by clicking *Advanced* after selecting a field.
|
||||
{ref}/search-aggregations-bucket-range-aggregation.html[Range]:: Specify ranges of values for a numeric field.
|
||||
|
||||
Kibana only supports filtering string fields with regular expression patterns, it does not support matching with arrays or filtering numeric fields.
|
||||
Patterns are case sensitive.
|
||||
{ref}/search-aggregations-bucket-significantterms-aggregation.html[Significant terms]:: Returns interesting or unusual occurrences of terms in a set. Supports {es} {ref}/search-aggregations-bucket-terms-aggregation.html#_filtering_values_4[exclude and include patterns].
|
||||
|
||||
Example:
|
||||
{ref}/search-aggregations-bucket-terms-aggregation.html[Terms]:: Specify the top or bottom _n_ elements of a given field to display, ordered by count or a custom metric. Supports {es} {ref}/search-aggregations-bucket-terms-aggregation.html#_filtering_values_4[exclude and include patterns].
|
||||
|
||||
{kib} filters string fields with only regular expression patterns, and does not filter numeric fields or match with arrays.
|
||||
|
||||
For example:
|
||||
|
||||
* You want to exclude the metricbeat process from your visualization of top processes: `metricbeat.*`
|
||||
* You only want to show processes collecting beats: `.*beat`
|
||||
* You want to exclude two specific values, the string `"empty"` and `"none"`: `empty|none`
|
||||
|
||||
*Geo aggregations*
|
||||
|
||||
These are only supported by the tile map and table visualizations:
|
||||
|
||||
{ref}/search-aggregations-bucket-geohashgrid-aggregation.html[Geohash]:: Displays points based on a geohash.
|
||||
|
||||
{ref}/search-aggregations-bucket-geotilegrid-aggregation.html[Geotile]:: Groups points based on web map tiling.
|
||||
|
||||
|
||||
[float]
|
||||
[[visualize-parent-pipeline-aggregations]]
|
||||
==== Parent pipeline aggregations
|
||||
|
||||
For each of the parent pipeline aggregations you have to define a bucket and metric to calculate. These
|
||||
metrics expect the buckets to be ordered, and are especially useful for time series data.
|
||||
You can also nest these aggregations. For example, if you want to produce a third derivative.
|
||||
|
||||
These visualizations support parent pipeline aggregations:
|
||||
|
||||
* Line, Area and Bar charts
|
||||
* Data table
|
||||
|
||||
{ref}/search-aggregations-pipeline-derivative-aggregation.html[Derivative]:: Calculates the derivative of specific metrics.
|
||||
|
||||
{ref}/search-aggregations-pipeline-cumulative-sum-aggregation.html[Cumulative Sum]:: Calculates the cumulative sum of a specified metric in a parent histogram.
|
||||
|
||||
{ref}/search-aggregations-pipeline-movavg-aggregation.html[Moving Average]:: Slides a window across the data and emits the average value of the window.
|
||||
|
||||
{ref}/search-aggregations-pipeline-serialdiff-aggregation.html[Serial Diff]:: Values in a time series are subtracted from itself at different time lags or periods.
|
||||
|
||||
Custom {kib} plugins can <<development-visualize-index, add more capabilities to the default editor>>, which includes support for adding more aggregations.
|
||||
|
||||
[float]
|
||||
[[visualize-advanced-aggregation-options]]
|
||||
==== Advanced aggregation options
|
||||
|
||||
*JSON Input*:: A text field where you can add specific JSON-formatted properties to merge with the aggregation
|
||||
definition, as in the following example:
|
||||
|
||||
[source,shell]
|
||||
{ "script" : "doc['grade'].value * 1.2" }
|
||||
|
||||
This example implements a {es} {ref}/search-aggregations.html[Script Value Source] which replaces
|
||||
the value in the metric. The availability of these options varies depending on the aggregation
|
||||
you choose.
|
||||
|
||||
When multiple bucket aggregations are defined, you can use the drag target on each aggregation to change the priority. For more information about working with aggregation order, see https://www.elastic.co/blog/kibana-aggregation-execution-order-and-you[Kibana, Aggregation Execution Order, and You].
|
||||
Patterns are case sensitive.
|
||||
|
|
|
|||
40
docs/visualize/heatmap.asciidoc
Normal file
40
docs/visualize/heatmap.asciidoc
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
[[heatmap]]
|
||||
== Heat map
|
||||
|
||||
Heat maps are graphical representations of data where the individual values are represented as colors.
|
||||
|
||||
NOTE: Heat map has been replaced with <<maps>>, which offers more functionality and is easier to use.
|
||||
|
||||
[float]
|
||||
[[heatmap-aggregation]]
|
||||
=== Supported aggregations
|
||||
|
||||
Heat maps support the following aggregations:
|
||||
|
||||
* <<visualize-metric-aggregations,Metric>>
|
||||
|
||||
* <<visualize-parent-pipeline-aggregations,Parent pipeline>>
|
||||
|
||||
* <<visualize-sibling-pipeline-aggregations,Sibling pipeline>>
|
||||
|
||||
* <<visualize-bucket-aggregations,Bucket>>
|
||||
|
||||
[float]
|
||||
[[navigate-heatmap]]
|
||||
=== Change the color ranges
|
||||
|
||||
When only one color displays on the heat map, you might need to change the color ranges.
|
||||
|
||||
To specify the number of color ranges:
|
||||
|
||||
. Click *Options*.
|
||||
|
||||
. Enter the *Number of colors* to display.
|
||||
|
||||
To specify custom ranges:
|
||||
|
||||
. Click *Options*.
|
||||
|
||||
. Select *Use custom ranges*.
|
||||
|
||||
. Enter the ranges to display.
|
||||
|
|
@ -4,7 +4,7 @@
|
|||
|
||||
beta[]
|
||||
|
||||
*Lens* provides you with a simple and fast way to create visualizations from your Elasticsearch data. With Lens, you can:
|
||||
*Lens* provides you with a simple and fast way to create visualizations from your {es} data. With Lens, you can:
|
||||
|
||||
* Quickly build visualizations by dragging and dropping data fields.
|
||||
|
||||
|
|
@ -14,6 +14,20 @@ beta[]
|
|||
|
||||
* Save your visualization for use in a dashboard.
|
||||
|
||||
[float]
|
||||
[[lens-aggregation]]
|
||||
=== Supported aggregations
|
||||
|
||||
Lens supports the following aggregations:
|
||||
|
||||
* <<visualize-metric-aggregations,Metric>>
|
||||
|
||||
* <<visualize-parent-pipeline-aggregations,Parent pipeline>>
|
||||
|
||||
* <<visualize-sibling-pipeline-aggregations,Sibling pipeline>>
|
||||
|
||||
* <<visualize-bucket-aggregations,Bucket>>
|
||||
|
||||
[float]
|
||||
[[drag-drop]]
|
||||
=== Drag and drop
|
||||
|
|
|
|||
|
|
@ -2,3 +2,15 @@
|
|||
=== Metric
|
||||
|
||||
Click the *Options* tab to display the font size slider.
|
||||
|
||||
[float]
|
||||
[[metric-aggregation]]
|
||||
==== Supported aggregations
|
||||
|
||||
Metric support the following aggregations:
|
||||
|
||||
* <<visualize-metric-aggregations,Metric>>
|
||||
|
||||
* <<visualize-sibling-pipeline-aggregations,Sibling pipeline>>
|
||||
|
||||
* <<visualize-bucket-aggregations,Bucket>>
|
||||
|
|
|
|||
|
|
@ -1,30 +1,42 @@
|
|||
[[most-frequent]]
|
||||
== Most frequently used visualizations
|
||||
|
||||
The most frequently used visualizations allow you to plot aggregated data from a <<save-open-search, saved search>> or <<index-patterns, index pattern>>. They all support a single level of
|
||||
Elasticsearch {es} {ref}/search-aggregations-metrics.html[metric] aggregations, and one or more
|
||||
levels of {es} {ref}/search-aggregations-bucket.html[bucket] aggregations.
|
||||
The most frequently used visualizations allow you to plot aggregated data from a <<save-open-search, saved search>> or <<index-patterns, index pattern>>.
|
||||
|
||||
The most frequently used visualizations include:
|
||||
|
||||
* Line, area, and bar charts
|
||||
* Pie charts
|
||||
* Data tables
|
||||
* Metrics, goals, and gauges
|
||||
* Heat maps
|
||||
* Tag clouds
|
||||
* Pie chart
|
||||
* Data table
|
||||
* Metric, goal, and gauge
|
||||
* Tag cloud
|
||||
|
||||
[float]
|
||||
[[frequently-used-viz-aggregation]]
|
||||
=== Supported aggregations
|
||||
|
||||
The most frequently used visualizations support the following aggregations:
|
||||
|
||||
* <<visualize-metric-aggregations,Metric>>
|
||||
|
||||
* <<visualize-parent-pipeline-aggregations,Parent pipeline>>
|
||||
|
||||
* <<visualize-sibling-pipeline-aggregations,Sibling pipeline>>
|
||||
|
||||
* <<visualize-bucket-aggregations,Bucket>>
|
||||
>>>>>>> 0ac60494d6... [DOCS] Updates to heat map page (#55097)
|
||||
|
||||
[float]
|
||||
=== Configure your visualization
|
||||
|
||||
You configure visualizations using the default editor, which is broken into metrics and buckets, and includes a default count
|
||||
metric. Each visualization supports different configurations for what the metrics and buckets
|
||||
represent. For example, a bar chart allows you to add an X-axis:
|
||||
You configure visualizations using the default editor. Each visualization supports different configurations of the metrics and buckets.
|
||||
|
||||
For example, a bar chart allows you to add an x-axis:
|
||||
|
||||
[role="screenshot"]
|
||||
image::images/add-bucket.png["",height=478]
|
||||
|
||||
A common configuration for the X-axis is to use a {es} {ref}/search-aggregations-bucket-datehistogram-aggregation.html[date histogram] aggregation:
|
||||
A common configuration for the x-axis is to use a {es} {ref}/search-aggregations-bucket-datehistogram-aggregation.html[date histogram] aggregation:
|
||||
|
||||
[role="screenshot"]
|
||||
image::images/visualize-date-histogram.png[]
|
||||
|
|
@ -58,5 +70,3 @@ Each visualization also has its own customization options. Most visualizations a
|
|||
|
||||
[role="screenshot"]
|
||||
image::images/color-picker.png[An array of color dots that users can select,height=267]
|
||||
|
||||
include::aggregations.asciidoc[]
|
||||
|
|
|
|||
|
|
@ -18,17 +18,18 @@ To create a region map, you configure an inner join that joins the result of an
|
|||
and a reference vector file based on a shared key.
|
||||
|
||||
[float]
|
||||
==== Data
|
||||
[[region-map-aggregation]]
|
||||
=== Supported aggregations
|
||||
|
||||
[float]
|
||||
===== Metrics
|
||||
Region maps support the following aggregations:
|
||||
|
||||
Select any of the supported _Metric_ or _Sibling Pipeline Aggregations_.
|
||||
* <<visualize-metric-aggregations,Metric>>
|
||||
|
||||
[float]
|
||||
===== Buckets
|
||||
* <<visualize-sibling-pipeline-aggregations,Sibling pipeline>>
|
||||
|
||||
Configure a _Terms_ aggregation. The term is the _key_ that is used to join the results to the vector data on the map.
|
||||
* <<visualize-bucket-aggregations,Terms bucket aggregation>>
|
||||
|
||||
Use the _key_ term to join the results to the vector data on the map.
|
||||
|
||||
[float]
|
||||
==== Options
|
||||
|
|
|
|||
|
|
@ -17,36 +17,11 @@ in `kibana.yml`.
|
|||
[[coordinate-map-aggregation]]
|
||||
=== Supported aggregations
|
||||
|
||||
Coordinate maps support the metric and bucket aggregations.
|
||||
Coordinate maps support the following aggregations:
|
||||
|
||||
[float]
|
||||
===== Metric aggregations
|
||||
* <<visualize-metric-aggregations,Metric>>
|
||||
|
||||
The following metric aggregations are supported:
|
||||
|
||||
{ref}/search-aggregations-metrics-valuecount-aggregation.html[Count]:: Returns a raw count of
|
||||
the elements in the index pattern. The default metrics aggregation for a coordinate map is *Count*.
|
||||
|
||||
{ref}/search-aggregations-metrics-avg-aggregation.html[Average]:: Returns the average of a numeric
|
||||
field.
|
||||
|
||||
{ref}/search-aggregations-metrics-sum-aggregation.html[Sum]:: Returns the total sum of a numeric
|
||||
field.
|
||||
|
||||
{ref}/search-aggregations-metrics-min-aggregation.html[Min]:: Returns the minimum value of a
|
||||
numeric field.
|
||||
|
||||
{ref}/search-aggregations-metrics-max-aggregation.html[Max]:: Returns the maximum value of a
|
||||
numeric field.
|
||||
|
||||
{ref}/search-aggregations-metrics-cardinality-aggregation.html[Unique Count]:: Returns
|
||||
the number of unique values in a field.
|
||||
|
||||
[float]
|
||||
[[coordinate-bucket-aggregation]]
|
||||
===== Bucket aggregation
|
||||
|
||||
Coordinate maps support the {ref}/search-aggregations-bucket-geohashgrid-aggregation.html[_geohash_] bucket aggregation.
|
||||
* <<visualize-bucket-aggregations,Geohash Bucket aggregation>>
|
||||
|
||||
When you deselect *Change precision on map zoom*, the *Precision* slider appears. The *Precision* slider determines the granularity of the results displayed on the map. For details on the area specified by each precision level, refer to {ref}/search-aggregations-bucket-geohashgrid-aggregation.html#_cell_dimensions_at_the_equator[geohash grid].
|
||||
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
[[TSVB]]
|
||||
== TSVB
|
||||
|
||||
TSVB is a time series data visualizer that allows you to use the full power of the
|
||||
Elasticsearch aggregation framework. With TSVB, you can combine an infinite
|
||||
TSVB is a time series data visualizer that allows you to use the full power of the
|
||||
Elasticsearch aggregation framework. With TSVB, you can combine an infinite
|
||||
number of aggregations to display complex data.
|
||||
|
||||
NOTE: In Elasticsearch version 7.3.0 and later, the time series data visualizer is now referred to as TSVB instead of Time Series Visual Builder.
|
||||
|
|
@ -43,6 +43,18 @@ Table:: Display data from multiple time series by defining the field group to sh
|
|||
[role="screenshot"]
|
||||
image:images/tsvb-table.png["Table visualization"]
|
||||
|
||||
[float]
|
||||
[[tsvb-aggregation]]
|
||||
=== Supported aggregations
|
||||
|
||||
TSVB supports the following aggregations:
|
||||
|
||||
* <<visualize-metric-aggregations,Metric>>
|
||||
|
||||
* <<visualize-parent-pipeline-aggregations,Parent pipeline>>
|
||||
|
||||
* <<visualize-sibling-pipeline-aggregations,Sibling pipeline>>
|
||||
|
||||
[float]
|
||||
[[create-tsvb-visualization]]
|
||||
=== Create TSVB visualizations
|
||||
|
|
@ -60,7 +72,7 @@ To create a single metric, add multiple data series with multiple aggregations.
|
|||
. Specify the data series labels and colors.
|
||||
|
||||
.. Select *Data*.
|
||||
+
|
||||
+
|
||||
If you are using the *Table* visualization, select *Columns*.
|
||||
|
||||
.. In the *Label* field, enter a name for the data series, which is used on legends and titles.
|
||||
|
|
@ -79,7 +91,7 @@ For series that are grouped by a term, you can specify a mustache variable of `{
|
|||
|
||||
.. To add another metric, click *+*.
|
||||
+
|
||||
When you add more than one metric, the last metric value is displayed, which is indicated by the eye icon.
|
||||
When you add more than one metric, the last metric value is displayed, which is indicated by the eye icon.
|
||||
|
||||
. To specify the format and display options, select *Options*.
|
||||
|
||||
|
|
@ -95,7 +107,7 @@ Change the data that you want to display and choose the style options for the pa
|
|||
|
||||
. Select *Panel options*.
|
||||
|
||||
. Under *Data*, specify how much of the data that you want to display in the visualization.
|
||||
. Under *Data*, specify how much of the data that you want to display in the visualization.
|
||||
|
||||
. Under *Style*, specify how you want the visualization to look.
|
||||
|
||||
|
|
@ -113,7 +125,7 @@ If you are using the Time Series visualization, add annotation data sources.
|
|||
[[tsvb-enter-markdown]]
|
||||
==== Enter Markdown text
|
||||
|
||||
Edit the source for the Markdown visualization.
|
||||
Edit the source for the Markdown visualization.
|
||||
|
||||
. Select *Markdown*.
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue