kibana/docs/getting-started/tutorial-sample-data.asciidoc

[[explore-kibana-using-sample-data]]
== Explore {kib} using sample data

Ready to get some hands-on experience with {kib}?
In this tutorial, you’ll work with {kib} sample data and learn to:

* <<explore-the-data, Explore the sample data using *Discover*>>

* <<view-and-analyze-the-data, View and analyze the data on a dashboard>>

* <<filter-and-query-the-data, Filter and query the dashboard data>>

NOTE: If security is enabled, you must have `read`, `write`, and `manage` privileges
on the `kibana_sample_data_*` indices. For more information, refer to
{ref}/security-privileges.html[Security privileges].

[float]
[[add-the-sample-data]]
=== Add the sample data

Add the *Sample flight data*.

. On the home page, click *Load a data set and a {kib} dashboard*. 

. On the *Sample flight data* card, click *Add data*.

[float]
[[explore-the-data]]
=== Explore the data

Explore the documents in the index that 
match the selected index pattern. The index pattern tells {kib} which {es} index you want to
explore. 

. Open the menu, then go to *Discover*.

. Make sure `kibana_sample_data_flights` is the current index pattern. 
You might need to click *New* in the {kib} toolbar to refresh the data.
+
You'll see a histogram that shows the distribution of 
documents over time. A table lists the fields for 
each document that matches the index. By default, all fields are shown.
+
[role="screenshot"]
image::getting-started/images/tutorial-sample-discover1.png[]

. Hover over the list of *Available fields*, then click *Add* next 
to each field you want explore in the table.
+
[role="screenshot"]
image::getting-started/images/tutorial-sample-discover2.png[]

[float]
[[view-and-analyze-the-data]]
=== View and analyze the data

A _dashboard_ is a collection of panels that provide you with an overview of your data that you can 
use to analyze your data. Panels contain everything you need, including visualizations, 
interactive controls, Markdown, and more.

To open the *Global Flight* dashboard, open the menu, then go to *Dashboard*.

[role="screenshot"]
image::getting-started/images/tutorial-sample-dashboard.png[]

[float]
[[change-the-panel-data]]
==== Change the panel data

To gain insights into your data, change the appearance and behavior of the panels. 
For example, edit the metric panel to find the airline that has the lowest average fares.

. In the {kib} toolbar, click *Edit*.

. In the *Average Ticket Price* metric panel, open the panel menu, then select *Edit visualization*.

. To change the data on the panel, use an {es} {ref}/search-aggregations.html[bucket aggregation],  
which sorts the documents that match your search criteria into different categories or buckets.

.. In the *Buckets* pane, select *Add > Split group*.

.. From the *Aggregation* dropdown, select *Terms*.

.. From the *Field* dropdown, select *Carrier*.

.. Set *Descending* to *4*, then click *Update*.
+
The average ticket price for all four airlines appear in the visualization builder.
+
[role="screenshot"]
image::getting-started/images/tutorial-sample-edit1.png[]

. To save your changes, click *Save and return* in the {kib} toolbar. 

. To save the dashboard, click *Save* in the {kib} toolbar.
+
[role="screenshot"]
image::getting-started/images/tutorial-sample-edit2.png[]

[float]
[[filter-and-query-the-data]]
==== Filter and query the data

To focus in on the data you want to explore, use filters and queries. 
For more information, refer to 
{ref}/query-filter-context.html[Query and filter context].

To filter the data:

. In the *Controls* visualization, select an *Origin City* and *Destination City*, then click *Apply changes*.
+
The `OriginCityName` and the `DestCityName` fields filter the data in the panels. 
+
For example, the following dashboard shows the data for flights from London to Milan. 
+
[role="screenshot"]
image::getting-started/images/tutorial-sample-filter.png[]

. To manually add a filter, click *Add filter*,
then specify the data you want to view.

. When you are finished experimenting, remove all filters.

[[query-the-data]]
To query the data:

. To view all flights out of Rome, enter the following in the *KQL* query bar, then click *Update*:
+
[source,text]
OriginCityName: Rome

. For a more complex query with AND and OR, enter:
+
[source,text]
OriginCityName:Rome AND (Carrier:JetBeats OR Carrier:"Kibana Airlines")
+
The dashboard panels update to display the flights out of Rome on JetBeats and 
{kib} Airlines.  
+
[role="screenshot"]
image::getting-started/images/tutorial-sample-query.png[]

. When you are finished exploring, remove the query by 
clearing the contents in the *KQL* query bar, then click *Update*.

[float]
=== Next steps

Now that you know the {kib} basics, try out the <<create-your-own-dashboard, Create your own dashboard>> tutorial, where you'll learn to:

* Add a data set to {kib}

* Define an index pattern

* Discover and explore data

* Create and add panels to a dashboard