c77619352b
* [DOCS] 7.10 screenCore UI changes * Kibana access options * Removed Kibana from Set up Kibana * Removed rogue symbols * Update docs/spaces/index.asciidoc Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com> * Update docs/management/managing-beats.asciidoc Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com> * Review comments * Update docs/user/introduction.asciidoc Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com> * Review comments * Changed menu to main menu Co-authored-by: gchaps <33642766+gchaps@users.noreply.github.com>
124 lines
4.4 KiB
Plaintext
124 lines
4.4 KiB
Plaintext
[role="xpack"]
|
|
[[graph-getting-started]]
|
|
== Create a graph
|
|
|
|
You must index data into {es} before you can create a graph.
|
|
<<index-patterns, Learn how>> or get started with a <<add-sample-data, sample data set>>.
|
|
|
|
[float]
|
|
[[exploring-connections]]
|
|
=== Graph a data connection
|
|
|
|
. Open the main menu, then click *Graph*.
|
|
+
|
|
If this is your first graph, follow the prompts to create it.
|
|
For subsequent graphs, click *New*.
|
|
|
|
. Select a data source to explore.
|
|
|
|
. Add one or more multi-value fields that contain the terms you want to
|
|
graph.
|
|
+
|
|
The vertices in the graph are selected from these terms.
|
|
|
|
. Enter a search query to discover relationships between terms in the selected
|
|
fields.
|
|
+
|
|
For example, if you are using the {kib} sample web logs data set, and you want
|
|
to generate a graph of the successful requests to
|
|
particular pages from different locations, you could search for the 200
|
|
response code. The weight of the connection between two vertices indicates how strongly they
|
|
are related.
|
|
+
|
|
[role="screenshot"]
|
|
image::user/graph/images/graph-url-connections.png["URL connections"]
|
|
|
|
. To view more information about the relationship, click any connection.
|
|
+
|
|
[role="screenshot"]
|
|
image::user/graph/images/graph-link-summary.png["Link summary"]
|
|
|
|
. Use the control bar to explore
|
|
additional connections:
|
|
+
|
|
* To display additional vertices that connect to your graph, click the expand icon
|
|
image:user/graph/images/graph-expand-button.png[Expand Selection].
|
|
* To display additional
|
|
connections between the displayed vertices, click the link icon
|
|
image:user/graph/images/graph-link-button.png[Add links to existing terms].
|
|
* To explore a particular area of the
|
|
graph, select the vertices you are interested in, and then click expand or link.
|
|
* To step back through your changes to the graph, click undo
|
|
image:user/graph/images/graph-undo-button.png[Undo] and redo
|
|
image:user/graph/images/graph-redo-button.png[Redo].
|
|
|
|
. To see more relationships in your data, submit additional queries.
|
|
+
|
|
[role="screenshot"]
|
|
image::user/graph/images/graph-add-query.png["Adding networks"]
|
|
|
|
. *Save* your graph.
|
|
|
|
[float]
|
|
[[style-vertex-properties]]
|
|
=== Style vertex properties
|
|
|
|
Each vertex has a color, icon, and label. To change
|
|
the color or icon of all vertices
|
|
of a certain field, click it's badge, and then
|
|
select *Edit settings*.
|
|
|
|
To change the color and label of selected vertices,
|
|
click the style icon image:user/graph/images/graph-style-button.png[Style]
|
|
in the control bar.
|
|
|
|
|
|
[float]
|
|
[[edit-graph-settings]]
|
|
=== Edit graph settings
|
|
|
|
By default, *Graph* is configured to tune out noise in your data.
|
|
If this isn't a good fit for your data, use *Settings > Advanced settings*
|
|
to adjust the way *Graph* queries your data. You can tune the graph to show
|
|
only the results relevant to you and to improve performance.
|
|
For more information, see <<graph-troubleshooting, Graph troubleshooting>>.
|
|
|
|
You can configure the number of vertices that a search or
|
|
expand operation adds to the graph.
|
|
By default, only the five most relevant terms for any given field are added
|
|
at a time. This keeps the graph from overflowing. To increase this number, click
|
|
a field, select *Edit Settings*, and change *Terms per hop*.
|
|
|
|
[float]
|
|
[[graph-block-terms]]
|
|
=== Block terms from the graph
|
|
Documents that match a blocked term are not allowed in the graph.
|
|
To block a term, select its vertex and click
|
|
the block icon
|
|
image:user/graph/images/graph-block-button.png[Block selection]
|
|
in the control panel.
|
|
For a list of blocked terms, go to *Settings > Blocked terms*.
|
|
|
|
[float]
|
|
[[graph-drill-down]]
|
|
=== Drill down into raw documents
|
|
With drilldowns, you can display additional information about a
|
|
selected vertex in a new browser window. For example, you might
|
|
configure a drilldown URL to perform a web search for the selected vertex term.
|
|
|
|
Use the drilldown icon image:user/graph/images/graph-info-icon.png[Drilldown selection]
|
|
in the control panel to show the drilldown buttons for the selected vertices.
|
|
To configure drilldowns, go to *Settings > Drilldowns*. See also
|
|
<<disable-drill-down, Disabling drilldown configuration>>.
|
|
|
|
[float]
|
|
[[graph-run-layout]]
|
|
=== Run and pause layout
|
|
Graph uses a "force layout", where vertices behave like magnets,
|
|
pushing off of one another. By default, when you add a new vertex to
|
|
the graph, all vertices begin moving. In some cases, the movement might
|
|
go on for some time. To freeze the current vertex position,
|
|
click the pause icon
|
|
image:user/graph/images/graph-pause-button.png[Block selection]
|
|
in the control panel.
|