151 lines
6 KiB
Plaintext
151 lines
6 KiB
Plaintext
[[visualize]]
|
|
= Visualize
|
|
|
|
[partintro]
|
|
--
|
|
_Visualize_ enables you to create visualizations of the data in your
|
|
Elasticsearch indices. You can then build <<dashboard, dashboards>> that
|
|
display related visualizations.
|
|
|
|
Kibana visualizations are based on Elasticsearch queries. By using a
|
|
series of Elasticsearch {es-ref}search-aggregations.html[aggregations]
|
|
to extract and process your data, you can create charts that show
|
|
you the trends, spikes, and dips you need to know about.
|
|
|
|
You can create visualizations from a search saved from <<discover, Discover>>
|
|
or start with a new search query.
|
|
--
|
|
|
|
[[createvis]]
|
|
== Creating a Visualization
|
|
|
|
To create a visualization:
|
|
|
|
. Click on *Visualize* in the side navigation.
|
|
. Click the *Create new visualization* button or the **+** button.
|
|
. Choose the visualization type:
|
|
+
|
|
* *Basic charts*
|
|
[horizontal]
|
|
<<xy-chart,Line, Area and Bar charts>>:: Compare different series in X/Y charts.
|
|
<<heatmap-chart,Heat maps>>:: Shade cells within a matrix.
|
|
<<pie-chart,Pie chart>>:: Display each source's contribution to a total.
|
|
* *Data*
|
|
[horizontal]
|
|
<<data-table,Data table>>:: Display the raw data of a composed aggregation.
|
|
<<metric-chart,Metric>>:: Display a single number.
|
|
* *Maps*
|
|
[horizontal]
|
|
<<tilemap,Tile map>>:: Associate the results of an aggregation with geographic
|
|
locations.
|
|
* *Time Series*
|
|
[horizontal]
|
|
Timelion:: Compute and combine data from multiple time series
|
|
data sets.
|
|
* *Other*
|
|
[horizontal]
|
|
<<tagcloud-chart,Tag cloud>>:: Display words as a cloud in which the size of the word correspond to its importance
|
|
<<markdown-widget,Markdown widget>>:: Display free-form information or
|
|
instructions.
|
|
. Specify a search query to retrieve the data for your visualization:
|
|
** To enter new search criteria, select the index pattern for the indices that
|
|
contain the data you want to visualize. This opens the visualization builder
|
|
with a wildcard query that matches all of the documents in the selected
|
|
indices.
|
|
** To build a visualization from a saved search, click the name of the saved
|
|
search you want to use. This opens the visualization builder and loads the
|
|
selected query.
|
|
+
|
|
NOTE: When you build a visualization from a saved search, any subsequent
|
|
modifications to the saved search are automatically reflected in the
|
|
visualization. To disable automatic updates, you can disconnect a visualization
|
|
from the saved search.
|
|
|
|
. In the visualization builder, choose the metric aggregation for the
|
|
visualization's Y axis:
|
|
|
|
* *Metric Aggregations*:
|
|
|
|
* {es-ref}search-aggregations-metrics-valuecount-aggregation.html[count]
|
|
* {es-ref}search-aggregations-metrics-avg-aggregation.html[average]
|
|
* {es-ref}search-aggregations-metrics-sum-aggregation.html[sum]
|
|
* {es-ref}search-aggregations-metrics-min-aggregation.html[min]
|
|
* {es-ref}search-aggregations-metrics-max-aggregation.html[max]
|
|
* {es-ref}search-aggregations-metrics-stats-aggregation.html[standard deviation]
|
|
* {es-ref}search-aggregations-metrics-cardinality-aggregation.html[unique count]
|
|
* {es-ref}search-aggregations-metrics-percentile-aggregation.html[median] (50th percentile)
|
|
* {es-ref}search-aggregations-metrics-percentile-aggregation.html[percentiles]
|
|
* {es-ref}search-aggregations-metrics-percentile-rank-aggregation.html[percentile ranks]
|
|
* {es-ref}search-aggregations-metrics-top-hits-aggregation.html[top hit]
|
|
* {es-ref}search-aggregations-metrics-geocentroid-aggregation.html[geo centroid]
|
|
|
|
|
|
* *Parent Pipeline Aggregations*:
|
|
|
|
* {es-ref}search-aggregations-pipeline-derivative-aggregation.html[derivative]
|
|
* {es-ref}search-aggregations-pipeline-cumulative-sum-aggregation.html[cumulative sum]
|
|
* {es-ref}search-aggregations-pipeline-movavg-aggregation.html[moving average]
|
|
* {es-ref}search-aggregations-pipeline-serialdiff-aggregation.html[serial diff]
|
|
|
|
|
|
* *Sibling Pipeline Aggregations*:
|
|
|
|
* {es-ref}search-aggregations-pipeline-avg-bucket-aggregation.html[average bucket]
|
|
* {es-ref}search-aggregations-pipeline-sum-bucket-aggregation.html[sum bucket]
|
|
* {es-ref}search-aggregations-pipeline-min-bucket-aggregation.html[min bucket]
|
|
* {es-ref}search-aggregations-pipeline-max-bucket-aggregation.html[max bucket]
|
|
|
|
|
|
. For the visualizations X axis, select a bucket aggregation:
|
|
+
|
|
* {es-ref}search-aggregations-bucket-datehistogram-aggregation.html[date histogram]
|
|
* {es-ref}search-aggregations-bucket-range-aggregation.html[range]
|
|
* {es-ref}search-aggregations-bucket-terms-aggregation.html[terms]
|
|
* {es-ref}search-aggregations-bucket-filters-aggregation.html[filters]
|
|
* {es-ref}search-aggregations-bucket-significantterms-aggregation.html[significant terms]
|
|
|
|
For example, if you're indexing Apache server logs, you could build bar chart
|
|
that shows the distribution of incoming requests by geographic location by
|
|
specifying a terms aggregation on the `geo.src` field:
|
|
|
|
image::images/bar-terms-agg.jpg[]
|
|
|
|
The y-axis shows the number of requests received from each country, and the
|
|
countries are displayed across the x-axis.
|
|
|
|
Bar, line, or area chart visualizations use _metrics_ for the y-axis and
|
|
_buckets_ for the x-axis. Buckets are analogous to SQL `GROUP BY`
|
|
statements. Pie charts, use the metric for the slice size and the bucket
|
|
for the number of slices.
|
|
|
|
You can futher break down the data by specifying sub aggregations. The first
|
|
aggregation determines the data set for any subsequent aggregations. Sub
|
|
aggregations are applied in order--you can drag the aggregations to change the
|
|
order in which they're applied.
|
|
|
|
For example, you could add a terms sub aggregation on the `geo.dest` field to
|
|
the Country of Origin bar chart to see the locations those requests were
|
|
targeting.
|
|
|
|
image::images/bar-terms-subagg.jpg[]
|
|
|
|
For more information about working with sub aggregations, see
|
|
https://www.elastic.co/blog/kibana-aggregation-execution-order-and-you[Kibana,
|
|
Aggregation Execution Order, and You].
|
|
|
|
include::visualize/xychart.asciidoc[]
|
|
|
|
include::visualize/datatable.asciidoc[]
|
|
|
|
include::visualize/markdown.asciidoc[]
|
|
|
|
include::visualize/metric.asciidoc[]
|
|
|
|
include::visualize/pie.asciidoc[]
|
|
|
|
include::visualize/tilemap.asciidoc[]
|
|
|
|
include::visualize/tagcloud.asciidoc[]
|
|
|
|
include::visualize/heatmap.asciidoc[]
|