7b5df7ce3b
* timelion deprecation doc wip * Create Timelion Deprecation section to Visualize * Code review changes * minor changes * Make some changes in order to give priotization on how to replace an existing timelion worksheet to a dashboard * Syntax related improvements * Final touch * Remove extra lines and some minor changes
143 lines
4.9 KiB
Plaintext
143 lines
4.9 KiB
Plaintext
[[visualize]]
|
|
= Visualize
|
|
|
|
[partintro]
|
|
--
|
|
_Visualize_ enables you to create visualizations of the data from your {es} indices, which you can then add to dashboards for analysis.
|
|
|
|
{kib} visualizations are based on {es} queries. By using a series of {es} {ref}/search-aggregations.html[aggregations] to extract and process your data, you can create charts that show you the trends, spikes, and dips you need to know about.
|
|
|
|
To begin, open the menu, go to *Visualize*, then click *Create visualization*.
|
|
|
|
[float]
|
|
[[visualization-types]]
|
|
== Types of visualizations
|
|
|
|
{kib} supports several types of visualizations.
|
|
|
|
<<lens,Lens>>::
|
|
Quickly build several types of basic visualizations by simply dragging and dropping the data fields you want to display.
|
|
|
|
<<most-frequent,Most frequently used visualizations>>::
|
|
|
|
* *Line, area, and bar charts* — Compares different series in X/Y charts.
|
|
|
|
* *Pie chart* — Displays each source contribution to a total.
|
|
|
|
* *Data table* — Flattens aggregations into table format.
|
|
|
|
* *Metric* — Displays a single number.
|
|
|
|
* *Goal and gauge* — Displays a number with progress indicators.
|
|
|
|
* *Tag cloud* — Displays words in a cloud, where the size of the word corresponds to its importance.
|
|
|
|
<<TSVB,TSVB>>:: Visualizes time series data using pipeline aggregations.
|
|
|
|
<<timelion,Timelion>>:: Computes and combine data from multiple time series
|
|
data sets.
|
|
|
|
<<visualize-maps, Maps>>::
|
|
* *<<maps,Maps>>* — Displays geospatial data in {kib}.
|
|
|
|
* <<heat-map,Heat map>>:: Display shaded cells within a matrix.
|
|
|
|
<<for-dashboard,Dashboard tools>>::
|
|
|
|
* *Markdown widget* — Displays free-form information or instructions.
|
|
|
|
* *Controls* — Adds interactive inputs to a dashboard.
|
|
|
|
<<vega-graph,Vega>>:: Completes control over query and display.
|
|
|
|
[float]
|
|
[[choose-your-data]]
|
|
== Choose your data
|
|
|
|
Specify a search query to retrieve the data for your visualization, or used rolled up data.
|
|
|
|
* To enter new search criteria, select the <<index-patterns, index pattern>> for the indices that
|
|
contain the data you want to visualize. The visualization builder opens
|
|
with a wildcard query that matches all of the documents in the selected
|
|
indices.
|
|
|
|
* To build a visualization from a saved search, click the name of the saved
|
|
search you want to use. The visualization builder opens and loads the
|
|
selected query.
|
|
+
|
|
NOTE: When you build a visualization from a saved search, any subsequent
|
|
modifications to the saved search are reflected in the
|
|
visualization. To disable automatic updates, delete the visualization
|
|
on the *Saved Object* page.
|
|
|
|
* To build a visualization using <<rollup-index-pattern,rolled up data>>, select
|
|
the index pattern that includes the data. Rolled up data is summarized into
|
|
time buckets that can be split into sub buckets for numeric field values or
|
|
terms. To lower granularity, use a time aggregation that uses and combines
|
|
several time buckets. For an example, refer to <<rollup-data-tutorial,Create and visualize rolled up data>>.
|
|
|
|
[float]
|
|
[[vis-inspector]]
|
|
== Inspect visualizations
|
|
|
|
Many visualizations allow you to inspect the query and data behind the visualization.
|
|
|
|
. In the {kib} toolbar, click *Inspect*.
|
|
. To download the data, click *Download CSV*, then choose one of the following options:
|
|
* *Formatted CSV* - Downloads the data in table format.
|
|
* *Raw CSV* - Downloads the data as provided.
|
|
. To view the requests for collecting data, select *Requests* from the *View*
|
|
dropdown.
|
|
|
|
[float]
|
|
[[save-visualize]]
|
|
== Save visualizations
|
|
To use your visualizations in <<dashboard, dashboards>>, you must save them.
|
|
|
|
. In the {kib} toolbar, click *Save*.
|
|
. Enter the visualization *Title* and optional *Description*, then *Save* the visualization.
|
|
|
|
To access the saved visualization, go to *Management > {kib} > Saved Objects*.
|
|
|
|
[float]
|
|
[[save-visualization-read-only-access]]
|
|
==== Read only access
|
|
When you have insufficient privileges to save visualizations, the following indicator is
|
|
displayed and the *Save* button is not visible.
|
|
|
|
For more information, refer to <<xpack-security-authorization>>.
|
|
|
|
[role="screenshot"]
|
|
image::visualize/images/read-only-badge.png[Example of Visualize's read only access indicator in Kibana's header]
|
|
|
|
[float]
|
|
[[visualize-share-options]]
|
|
== Share visualizations
|
|
|
|
When you've finished your visualization, you can share it outside of {kib}.
|
|
|
|
From the *Share* menu, you can:
|
|
|
|
* Embed the code in a web page. Users must have {kib} access
|
|
to view an embedded visualization.
|
|
* Share a direct link to a {kib} visualization.
|
|
* Generate a PDF report.
|
|
* Generate a PNG report.
|
|
|
|
--
|
|
include::{kib-repo-dir}/visualize/aggregations.asciidoc[]
|
|
|
|
include::{kib-repo-dir}/visualize/lens.asciidoc[]
|
|
|
|
include::{kib-repo-dir}/visualize/most-frequent.asciidoc[]
|
|
|
|
include::{kib-repo-dir}/visualize/tsvb.asciidoc[]
|
|
|
|
include::{kib-repo-dir}/visualize/timelion.asciidoc[]
|
|
|
|
include::{kib-repo-dir}/visualize/tilemap.asciidoc[]
|
|
|
|
include::{kib-repo-dir}/visualize/for-dashboard.asciidoc[]
|
|
|
|
include::{kib-repo-dir}/visualize/vega.asciidoc[]
|