Chapter 6. Finding Insights with Kibana

In the previous chapter, we saw how Elasticsearch plays a role in ELK Stack to support fast searches and a variety of aggregations. In this chapter, we will take a look at how Kibana acts as the frontend of ELK, where it hides all the complexities of data and presents beautiful visualizations, charts, and dashboards built over the data, which helps gain essential insights into the data.

Kibana makes it easy to create and share dashboards consisting of various types of charts and graphs. Kibana visualizations automatically display changes in data over time based on Elasticsearch queries. It's easy to install and set up, and helps us quickly explore and discover many aspects of data.

Kibana 4 features

Some of the unique features in Kibana 4 are as follows:

Search highlights

Search terms are highlighted in the list of documents shown after the search:

Search highlight in Kibana 4

Elasticsearch aggregations

Kibana 4 makes extensive use of Elasticsearch aggregations and sub aggregations to provide more than one aggregation for visualizations. There are mainly two types of aggregations—Bucketing and Metrics. Bucketing produces a list of buckets, each one with a set of documents belonging to it, for example, terms, range, histograms, and so on. Metrics calculate the compute metrics for a set of documents, for example, min, max, sum, average, and so on. These types of computations can only be done on numeric type of fields.

Scripted fields

Scripted fields are used to make computations on the fly on indexed data. For example, for a certain field you always want to multiply by 100 before you show it. You can save it as a scripted field. Scripted fields, though, can't be searched.

Let...

Kibana interface

A Kibana interface consists of four main tabs:

• Discover: The Discover page enables free text searches, field-based searches, range-based searches, and so on.

• Visualize: The Visualize page enables building many visualizations, such as pie charts, bar charts, line charts, and so on, which can be saved and used in dashboards later.

• Dashboard: The Dashboard represents collections of multiple visualizations and searches, which can be used to easily apply filters based on click interaction, and draw conclusions based on multiple data aggregations.

• Settings: Settings enables the configuration of index patterns, scripted fields, the data types of fields, and so on.

Let's take a look at the Discover page in more detail.

Discover page

The Discover page is used to perform interactive searches on your indexed data. It allows you to perform ad hoc searches based on fields, the filtering of data, and allows you to view indexed documents as well.

A typical Kibana home page, which defaults...

Summary

In this chapter, we saw how we can use Kibana's Discover page to gain insights into the data with some quick searches, which can be saved and used later.

In the next chapter, we will see the Visualize, Dashboard, and Settings pages in Kibana in detail.