* Initial import * updating the editor width to match the new specs * Adding tribe node support * Adding tests for server libs * removing bluebird * removing extra cruft * Fixing the font sizes * Fixed the updating code * Adding brushing * Fixing linting issues * Adding global filters * Adding missing packages * Default gauge style to half circle * Fixing the markdown css bug * Adding tests for the get_vis_data api * Adding time offset * Adding time offset to each type * fixing bugs from time offset * adding index pattern option to series * Adding index pattern overrides * Adding index pattern overrides * Fixing tests * Fixing brushing in the vis editor * Changing the label * Change the behavior of selecting a pipeline agg when only one exists. * Refactoring series a bit * Changing series options to just options * Making sure we honor the toaster container height * Adding first tests * renaming vis_config to panel_config * renaming vis_config to panel_config * Adding more tests * adding more tests * removing api subdirectory * refactoring get_vis_data (breaking it up and removing unused imports) * reorganizing the visualization directory * Re-organizing directory layouts and moving things to more logical places * Refactoring React compontents to use ES6 syntax and adding propTypes for each. Also refactored out splats as much as possible. * Adding serial differencing * Refactored gauge to use 2 components instead of 4 * Finishing react refactor on visualizations. Consolidated legned funtionality * Refactoring series config and removing a bunch of duplicate code * fixing series config name * Fixing numbers and strings (doesnt matter which it is); Fixing classname * Changing the way the dark theme works * Adding new vis into list for test * Adding empty bucket check * Fixing the index patterns in the aggs * Fixing typo * Refactoring vis_data * Fixing std_metric * Fixing refresh-hack * Adding tests for get_splits, get_last_metric, map_bucket * Fixing the error handing * removing restrictions * Sometimes values are strings or numbers... it doesn't matter * Adding new color options for splits * Fixing colors * fixing size * Adding support for fitlers agg * Fixing tests * Fixing splits for filters * Fixing Top N to work better with fitlers * Adding annotation editor * initial work for annotations * Finalizing annotations * Fixing label * making it expandable * Fixing hacks fixed by #10175 * Fixing bars to use the same stacking options as lines * Getting rid of align by colons * removing unused depends * removing unused depends * Changing to readable lodash function * Adding missing parens * refactoring custom color picker * Removing string refs and converting uncontrolled components * Fixing the controlled components where value maybe null; converting error to css * refactoring styles from components * fixing the refresh behavoir borked by fullEditor * Adding the executor service * Fixing the test directories * fixing save * Adding filter ratios * Fixing controlled components * Trying to fix the weird typing * Fixing offset bug with days * Adding percentile rank * Fixing yaxis updates; fixing percentile rank layout; adding steps to line chart * removing unused depends * Fixed a bug with the index patterns updating; fixed bug with charts rendering too much * Fixing tests * Commenting out React tests because the ENV must have change and they are no longer working * Moving bucket transform * moving calculate auto * Moving calculate_indices * moving extended_stats_types && get_agg_value * moving get_buckets_path * moving get_sibling_agg_value * moving parse_settings * moving series_agg * Moving unit_to_seconds * Fixing tests * Fixing per PR * Renaming vars to make it more clear what's happening * Changing the way testible functions are exported * fixing tests * removing unused imports; fixing typos; fixing package name * Name has to match the plugin path * Fixing typos; removing unused imports * fixing tests * rearanging and removing unused imports * Fixing a bug with unque names for radio buttons on the same form * Fixing filter ratio to use a metric instead of just count * fixing a bug with the new filter ratios * Fixing the file path from the #8 * Fixing renderComplete trigger; Fixing embedded mode; Changing names for Timelion and Time Series Visual Builder * Fixing name * Fixing docs * Fixing a typo for the field select for terms splits * Fixing tests
119 lines
4.8 KiB
Plaintext
119 lines
4.8 KiB
Plaintext
[[visualize]]
|
|
= Visualize
|
|
|
|
[partintro]
|
|
--
|
|
_Visualize_ enables you to create visualizations of the data in your
|
|
Elasticsearch indices. You can then build <<dashboard, dashboards>> that
|
|
display related visualizations.
|
|
|
|
Kibana visualizations are based on Elasticsearch queries. By using a
|
|
series of Elasticsearch {es-ref}search-aggregations.html[aggregations]
|
|
to extract and process your data, you can create charts that show
|
|
you the trends, spikes, and dips you need to know about.
|
|
|
|
You can create visualizations from a search saved from <<discover, Discover>>
|
|
or start with a new search query.
|
|
--
|
|
|
|
[[createvis]]
|
|
== Creating a Visualization
|
|
|
|
To create a visualization:
|
|
|
|
. Click on *Visualize* in the side navigation.
|
|
. Choose the visualization type:
|
|
+
|
|
[horizontal]
|
|
<<xy-chart,Line, Area and Bar chart>>:: Compare different series in X/Y charts.
|
|
<<data-table,Data table>>:: Display the raw data of a composed aggregation.
|
|
<<markdown-widget,Markdown widget>>:: Display free-form information or
|
|
instructions.
|
|
<<metric-chart,Metric>>:: Display a single number.
|
|
<<pie-chart,Pie chart>>:: Display each source's contribution to a total.
|
|
<<tagcloud-chart,Tag cloud>>:: Display words as a cloud in which the size of the word correspond to its importance
|
|
<<tilemap,Tile map>>:: Associate the results of an aggregation with geographic
|
|
locations.
|
|
Timelion:: Compute and combine data from multiple time series
|
|
data sets.
|
|
|
|
. Specify a search query to retrieve the data for your visualization:
|
|
** To enter new search criteria, select the index pattern for the indices that
|
|
contain the data you want to visualize. This opens the visualization builder
|
|
with a wildcard query that matches all of the documents in the selected
|
|
indices.
|
|
** To build a visualization from a saved search, click the name of the saved
|
|
search you want to use. This opens the visualization builder and loads the
|
|
selected query.
|
|
+
|
|
NOTE: When you build a visualization from a saved search, any subsequent
|
|
modifications to the saved search are automatically reflected in the
|
|
visualization. To disable automatic updates, you can disconnect a visualization
|
|
from the saved search.
|
|
|
|
. In the visualization builder, choose the metric aggregation for the
|
|
visualization's Y axis:
|
|
+
|
|
* {es-ref}search-aggregations-metrics-valuecount-aggregation.html[count]
|
|
* {es-ref}search-aggregations-metrics-avg-aggregation.html[average]
|
|
* {es-ref}search-aggregations-metrics-sum-aggregation.html[sum]
|
|
* {es-ref}search-aggregations-metrics-min-aggregation.html[min]
|
|
* {es-ref}search-aggregations-metrics-max-aggregation.html[max]
|
|
* {es-ref}search-aggregations-metrics-cardinality-aggregation.html[unique count]
|
|
* {es-ref}search-aggregations-metrics-percentile-aggregation.html[median] (50th percentile)
|
|
* {es-ref}search-aggregations-metrics-percentile-aggregation.html[percentiles]
|
|
* {es-ref}search-aggregations-metrics-percentile-rank-aggregation.html[percentile ranks]
|
|
|
|
. For the visualizations X axis, select a bucket aggregation:
|
|
+
|
|
* {es-ref}search-aggregations-bucket-datehistogram-aggregation.html[date histogram]
|
|
* {es-ref}search-aggregations-bucket-range-aggregation.html[range]
|
|
* {es-ref}search-aggregations-bucket-terms-aggregation.html[terms]
|
|
* {es-ref}search-aggregations-bucket-filters-aggregation.html[filters]
|
|
* {es-ref}search-aggregations-bucket-significantterms-aggregation.html[significant terms]
|
|
|
|
For example, if you're indexing Apache server logs, you could build bar chart
|
|
that shows the distribution of incoming requests by geographic location by
|
|
specifying a terms aggregation on the `geo.src` field:
|
|
|
|
image::images/bar-terms-agg.jpg[]
|
|
|
|
The y-axis shows the number of requests received from each country, and the
|
|
countries are displayed across the x-axis.
|
|
|
|
Bar, line, or area chart visualizations use _metrics_ for the y-axis and
|
|
_buckets_ for the x-axis. Buckets are analogous to SQL `GROUP BY`
|
|
statements. Pie charts, use the metric for the slice size and the bucket
|
|
for the number of slices.
|
|
|
|
You can futher break down the data by specifying sub aggregations. The first
|
|
aggregation determines the data set for any subsequent aggregations. Sub
|
|
aggregations are applied in order--you can drag the aggregations to change the
|
|
order in which they're applied.
|
|
|
|
For example, you could add a terms sub aggregation on the `geo.dest` field to
|
|
the Country of Origin bar chart to see the locations those requests were
|
|
targeting.
|
|
|
|
image::images/bar-terms-subagg.jpg[]
|
|
|
|
For more information about working with sub aggregations, see
|
|
https://www.elastic.co/blog/kibana-aggregation-execution-order-and-you[Kibana,
|
|
Aggregation Execution Order, and You].
|
|
|
|
include::visualize/xychart.asciidoc[]
|
|
|
|
include::visualize/datatable.asciidoc[]
|
|
|
|
include::visualize/markdown.asciidoc[]
|
|
|
|
include::visualize/metric.asciidoc[]
|
|
|
|
include::visualize/pie.asciidoc[]
|
|
|
|
include::visualize/tilemap.asciidoc[]
|
|
|
|
include::visualize/tagcloud.asciidoc[]
|
|
|
|
include::visualize/heatmap.asciidoc[]
|