Building Kibana Dashboards

1. Creating New Dashboard

Example: Create a new dashboard in Kibana

{
  "title": "My New Dashboard",
  "description": "A dashboard to visualize system metrics",
  "version": 1,
  "panels": [],
  "time": {
    "from": "now-1h",
    "to": "now"
  }
}

Property	Description	Default Value
title	Dashboard title displayed in Kibana UI	""
description	Optional description of the dashboard's purpose	""
version	Version number for tracking changes	1
panels	List of visualization panels to include	[]
time	Time range filter for dashboard	{ "from": "now-1h", "to": "now" }

Note: The time filter can be customized using Kibana's time picker syntax.

2. Adding Visualizations

Visualization Type	Description	Use Case	Configuration
Area Chart	Displays data as filled areas over time	Showing trends in metrics over time	`{ "type": "area" }`
Bar Chart	Displays data in vertical bars	Comparing values across categories	`{ "type": "bar" }`
Line Chart	Shows trends over time or ordered categories	Tracking performance metrics	`{ "type": "line" }`
Pie Chart	Represents parts of a whole	Showing distribution of data	`{ "type": "pie" }`
Table	Displays raw data in tabular format	Viewing detailed logs or metrics	`{ "type": "table" }`

Example: Adding a Line Chart Visualization

{
  "title": "CPU Usage Over Time",
  "type": "line",
  "params": {
    "addLegend": true,
    "addTimeMarker": false
  },
  "aggs": [
    {
      "id": "1",
      "enabled": true,
      "type": "avg",
      "schema": "metric",
      "params": {
        "field": "cpu.usage"
      }
    },
    {
      "id": "2",
      "enabled": true,
      "type": "date_histogram",
      "schema": "group",
      "params": {
        "field": "@timestamp",
        "interval": "auto"
      }
    }
  ]
}

Example: Adding a Bar Chart for Log Volume

{
  "title": "Log Volume by Level",
  "type": "bar",
  "params": {
    "addLegend": true,
    "addTimeMarker": false
  },
  "aggs": [
    {
      "id": "1",
      "enabled": true,
      "type": "count",
      "schema": "metric"
    },
    {
      "id": "2",
      "enabled": true,
      "type": "terms",
      "schema": "group",
      "params": {
        "field": "log.level"
      }
    }
  ]
}

Note: Visualizations are built using aggregations in Kibana. Each visualization requires at least one metric aggregation and one grouping aggregation.

3. Arranging Panels

Panel Property	Description	Values	Notes
panel.id	Unique identifier for the panel	`string`	Required for each panel
panel.type	Panel type (e.g., visualization, markdown)	`string`	Must match available panel types
panel.width	Width of the panel in grid units	`number`	Default is 6; max is 12
panel.height	Height of the panel in grid units	`number`	Default is 4; height can be adjusted
panel.x	Horizontal position in grid units	`number`	Starts at 0, increases left to right
panel.y	Vertical position in grid units	`number`	Starts at 0, increases top to bottom

Example: Panel Configuration in Kibana Dashboard

{
  "id": "panel-1",
  "type": "area",
  "width": 6,
  "height": 4,
  "x": 0,
  "y": 0
}

Note: Panel coordinates (x, y) are relative to the dashboard grid and must be within the defined grid size.

4. Resizing Panels

Panel Property	Values	Description
width	`12`	Panel width in grid units (1-24)
height	`6`	Panel height in grid units (1-24)
size	`medium`	Predefined size options: `small`, `medium`, `large`

Example: Setting Panel Size

{
  "id": "panel-1",
  "type": "area",
  "width": 12,
  "height": 6,
  "size": "medium"
}

Note: Panel dimensions are relative to the Kibana grid system. Adjusting width and height affects layout in real-time.

5. Configuring Time Range

Property	Description	Default Value	Notes
time.from	Start time for the dashboard	`now-15m`	Can use relative or absolute timestamps
time.to	End time for the dashboard	`now`	Can use relative or absolute timestamps
time.refreshInterval	Auto-refresh interval in milliseconds	`0`	Set to 0 to disable auto-refresh

Example: Setting Time Range in Kibana

{
  "time": {
    "from": "2024-01-01T00:00:00Z",
    "to": "2024-01-02T00:00:00Z",
    "refreshInterval": 30000
  }
}

Note: Time range can be adjusted using Kibana's time picker UI or via URL parameters.

6. Using Query Bar

Example: Basic Query Syntax

message:'error' AND timestamp:>1609459200000

Component	Description	Usage
Field	Field name to query	`status_code`
Operator	Comparison operator	`:`, `>`, `<`
Value	Value to match	`500`, `"GET"`

Note: Query bar supports full Lucene query syntax including wildcards and boolean operators.

Example: Date Range Filter

timestamp:[2021-01-01 TO 2021-12-31]

Example: Aggregation Query

response_time:<1000 | aggregation:avg(response_time)

7. Applying Filters

Filter Type	Description	Usage Example	Notes
Query String	Text-based query using Lucene syntax	`status:200 AND response_time < 500`	Supports full Lucene query syntax including wildcards, ranges, and boolean logic
KQL (Kibana Query Language)	Human-readable query language for Kibana	`status:200 AND response_time < 500`	More intuitive than Lucene for basic queries
Range Filters	Filter documents by numeric or date ranges	`{ "range": { "response_time": { "gte": 100, "lte": 500 } } }`	Can be applied to date, numeric, or string fields
Term Filters	Match exact values in fields	`{ "term": { "status": "200" } }`	Useful for exact matches and aggregations
Date Histogram	Group documents by date intervals	`{ "date_histogram": { "field": "timestamp", "calendar_interval": "1h" } }`	Essential for time-series analysis

Example: Applying a Query String Filter

const queryStringFilter = {
  query: {
    query_string: {
      query: "status:200 AND response_time < 500"
    }
  }
};

Example: Using KQL in a Dashboard Filter

const kqlFilter = {
  query: {
    kql: {
      query: "status:200 AND response_time < 500"
    }
  }
};

Note: KQL is more readable and easier to write than Lucene syntax, but both support the same features.

Warning: Complex filters can impact dashboard performance. Use indexed fields for better query efficiency.

8. Setting Auto-Refresh

Property	Value	Description
autoRefresh	`true` / `false`	Enables or disables auto-refresh for the dashboard
refreshInterval	`5s`, `10s`, `30s`, etc.	Time interval between automatic refreshes

Example: Enable Auto-Refresh

{
  "autoRefresh": true,
  "refreshInterval": "10s"
}

Note: Auto-refresh is useful for real-time monitoring dashboards but can impact performance with large datasets.

9. Using Global Filters

Example: Applying a Global Filter

{
  "query": {
    "bool": {
      "must": [
        {
          "term": {
            "status": "active"
          }
        }
      ]
    }
  }
}

Filter Type	Description	Usage
Term Filter	Matches documents with a specific term in a field	`{"term": {"status": "active"}}`
Range Filter	Matches documents within a range of values	`{"range": {"age": {"gte": 18, "lte": 65}}}`
Query String Filter	Allows complex queries using query string syntax	`{"query_string": {"query": "status:active AND type:user"}}`

Note: Global filters apply to all visualizations in a dashboard and are useful for focusing on specific data subsets.

10. Creating Drilldowns

Drilldowns in Kibana allow users to navigate through visualizations by clicking on data points to explore related information. They are particularly useful for creating interactive dashboards that provide deeper insights into datasets.

Drilldown Type	Description	Use Case
Field Drilldown	Drill down into a specific field value from a visualization.	Explore all documents matching a selected term in a filter.
Range Drilldown	Drill down into a range of values (e.g., date ranges, numeric intervals).	Filter data by a specific time range or value interval.
Custom Drilldown	Define custom logic for navigating to another visualization or dashboard.	Build complex navigation flows between related dashboards.

Example: Setting Up a Field Drilldown

To create a drilldown from a pie chart to a table visualization:

{
  "id": "field-drilldown",
  "name": "Drill Down to Table",
  "type": "field",
  "target": {
    "dashboardId": "table-dashboard-id",
    "filterField": "status"
  }
}

Note: Drilldowns require that the target visualization or dashboard is accessible and configured to receive filter values from the parent dashboard.

Workflow to Create a Drilldown

Navigate to the dashboard containing the visualization you want to add a drilldown to.
Edit the visualization and go to the Drilldowns tab in the settings panel.
Select Add Drilldown and choose a drilldown type (e.g., Field or Range).
Define the target dashboard or visualization and specify filter fields.
Save and test the drilldown by clicking on a data point in the visualization.

11. Saving Dashboards

Option	Values	Description
dashboard.title	`"My Dashboard"`	Title of the Kibana dashboard
dashboard.id	`"my-dashboard-id"`	Unique identifier for the dashboard
dashboard.time.from	`"now-1h"`	Start time for the dashboard's time range
dashboard.time.to	`"now"`	End time for the dashboard's time range

Example: Saving a Kibana Dashboard

{
  "title": "System Metrics Dashboard",
  "id": "system-metrics-123",
  "time": {
    "from": "now-1h",
    "to": "now"
  },
  "panels": []
}

Note: Dashboards are saved in Kibana's .kibana index by default.

12. Exporting Dashboards

Option	Values	Notes
dashboard.id	`string`	Unique identifier for the dashboard
dashboard.title	`string`	Title of the dashboard
dashboard.panels	`array`	List of panel configurations
dashboard.timeFrom	`string`	Default start time for the dashboard
dashboard.timeTo	`string`	Default end time for the dashboard

Example: Exporting a Dashboard as JSON

{
  "id": "dashboard-123",
  "title": "System Metrics Dashboard",
  "panels": [
    {
      "id": "panel-1",
      "type": "area",
      "query": "avg(cpu_usage)"
    }
  ],
  "timeFrom": "now-1h",
  "timeTo": "now"
}

Note: Dashboard exports can be imported into other Kibana instances or used to version control dashboard configurations.