Creating Kibana Visualizations

1. Understanding Visualization Types

Type	Description	Use Case	Code Example
Area Chart	Displays data as filled areas over time, useful for showing trends and cumulative values.	Tracking metrics over time with a focus on volume or accumulation	`{ "visState": "{\n \"type\": \"area\",\n \"params\": {\n \"addTimeMarker\": false,\n \"addLegend\": true\n }\n}" }`
Bar Chart	Displays data using vertical or horizontal bars, ideal for comparing categories.	Comparing values across different groups or categories	`{ "visState": "{\n \"type\": \"bar\",\n \"params\": {\n \"addTimeMarker\": false,\n \"addLegend\": true\n }\n}" }`
Line Chart	Shows trends over time using connected data points, great for continuous data.	Tracking changes in metrics over a time period	`{ "visState": "{\n \"type\": \"line\",\n \"params\": {\n \"addTimeMarker\": false,\n \"addLegend\": true\n }\n}" }`
Pie Chart	Represents parts of a whole using sectors, best for showing proportions.	Showing distribution or composition of data	`{ "visState": "{\n \"type\": \"pie\",\n \"params\": {\n \"addTimeMarker\": false,\n \"addLegend\": true\n }\n}" }`
Table	Displays data in rows and columns, useful for detailed information.	Showing raw or aggregated data with multiple fields	`{ "visState": "{\n \"type\": \"table\",\n \"params\": {\n \"addTimeMarker\": false,\n \"addLegend\": true\n }\n}" }`
Lens	Advanced visualization type for complex data exploration and filtering.	Interactive dashboards with multi-dimensional analysis	`{ "visState": "{\n \"type\": \"lens\",\n \"params\": {\n \"addTimeMarker\": false,\n \"addLegend\": true\n }\n}" }`

2. Creating Line Charts

Example: Basic Line Chart Configuration

{
  "title": "CPU Usage Over Time",
  "visState": "{\n  \"type\": \"line\",\n  \"params\": {\n    \"addTimeMarker\": false,\n    \"addLegend\": true,\n    \"legendPosition\": \"right\"\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"avg\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"cpu.usage\"\n      }\n    }\n  ]\n}"
}

Property	Description	Default Value	Notes
type	Visualization type	`line`	Must be `line` for line charts
addTimeMarker	Whether to show a time marker	`false`	Useful for real-time monitoring
addLegend	Whether to show a legend	`true`	Improves readability of multi-series charts
legendPosition	Position of the legend	`right`	Options: `top`, `bottom`, `left`, `right`

Note: Line charts are ideal for showing trends over time. Ensure your data has a timestamp field for best results.

3. Creating Bar Charts

Example: Basic Bar Chart Configuration

{
  "title": "Monthly Sales by Product",
  "type": "bar",
  "params": {
    "addLegend": true,
    "addTimeMarker": false,
    "categoryAxes": [
      {
        "id": "CategoryAxis-1",
        "position": "left",
        "scale": "linear",
        "show": true,
        "name": "CategoryAxis-1"
      }
    ],
    "valueAxes": [
      {
        "id": "ValueAxis-1",
        "position": "bottom",
        "scale": "linear",
        "show": true,
        "name": "ValueAxis-1"
      }
    ]
  },
  "aggs": [
    {
      "id": "1",
      "enabled": true,
      "type": "terms",
      "schema": "group",
      "params": {
        "field": "product.keyword",
        "size": 10
      }
    },
    {
      "id": "2",
      "enabled": true,
      "type": "sum",
      "schema": "metric",
      "params": {
        "field": "sales"
      }
    }
  ]
}

Property	Description	Default Value	Notes
type	Visualization type identifier	`"bar"`	Must be `"bar"` for bar charts
params.addLegend	Whether to show the legend	`false`	Set to `true` to display legend
params.addTimeMarker	Whether to show a time marker	`false`	Useful for time-series data
params.categoryAxes	Configuration for category axes	`[]`	Array of axis configurations
params.valueAxes	Configuration for value axes	`[]`	Array of axis configurations

Note: Bar charts in Kibana support both vertical and horizontal orientations. The orientation is controlled by the params.valueAxes configuration.

Example: Horizontal Bar Chart

{
  "title": "Top Products by Sales",
  "type": "bar",
  "params": {
    "addLegend": true,
    "addTimeMarker": false,
    "categoryAxes": [
      {
        "id": "CategoryAxis-1",
        "position": "left",
        "scale": "linear",
        "show": true,
        "name": "CategoryAxis-1"
      }
    ],
    "valueAxes": [
      {
        "id": "ValueAxis-1",
        "position": "bottom",
        "scale": "linear",
        "show": true,
        "name": "ValueAxis-1"
      }
    ]
  },
  "aggs": [
    {
      "id": "1",
      "enabled": true,
      "type": "terms",
      "schema": "group",
      "params": {
        "field": "product.keyword",
        "size": 10
      }
    },
    {
      "id": "2",
      "enabled": true,
      "type": "sum",
      "schema": "metric",
      "params": {
        "field": "sales"
      }
    }
  ]
}

Bar Chart Configuration Summary

type: Must be "bar"
params.addLegend: Controls visibility of legend
params.addTimeMarker: Adds time marker for time-series data
categoryAxes: Defines category axis properties
valueAxes: Defines value axis properties
aggs: Aggregations to group and aggregate data

4. Creating Pie Charts

Example: Basic Pie Chart Configuration

{
  "title": "Pie Chart Example",
  "visState": {
    "type": "pie",
    "params": {
      "addTooltip": true,
      "addLegend": true,
      "legendPosition": "right",
      "isDonut": false
    },
    "aggs": [
      {
        "id": "1",
        "enabled": true,
        "type": "terms",
        "schema": "group",
        "params": {
          "field": "status.keyword",
          "size": 5,
          "order": "desc",
          "orderBy": "_count"
        }
      }
    ]
  },
  "uiState": {}
}

Property	Description	Default Value	Notes
type	Visualization type identifier	`pie`	Must be `pie` for pie charts
addTooltip	Whether to show tooltips on hover	`true`	Enables interactive tooltip display
addLegend	Whether to show a legend	`true`	Can be disabled for compact views
legendPosition	Position of the legend	`right`	Options: `right`, `left`, `top`, `bottom`
isDonut	Whether to create a donut chart	`false`	Set to `true` for donut-style visualization

Note: Pie charts are best used for showing proportions of discrete categories. Avoid using them with too many slices or when the differences between slices are minimal.

Warning: Pie charts can be misleading if there are too many categories or if the differences between slices are subtle. Consider using a bar chart instead for better readability.

5. Creating Area Charts

Example: Basic Area Chart Configuration

{
  "title": "Area Chart Example",
  "visState": "{\n  \"type\": \"area\",\n  \"params\": {\n    \"addTimeMarker\": false,\n    \"addLegend\": true,\n    \"legendPosition\": \"right\"\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"date_histogram\",\n      \"schema\": \"group\",\n      \"params\": {\n        \"field\": \"timestamp\",\n        \"interval\": \"auto\"\n      }\n    },\n    {\n      \"id\": \"2\",\n      \"enabled\": true,\n      \"type\": \"avg\",\n      \"schema\": \"metric\",\n      \"params\": {\n        \"field\": \"response_time\"\n      }\n    }\n  ]\n}"
}

Property	Description	Values	Notes
type	Visualization type	`area`	Must be `area` for area charts
addTimeMarker	Whether to show a time marker	`true`, `false`	Default: `false`
addLegend	Whether to show a legend	`true`, `false`	Default: `true`
legendPosition	Position of the legend	`top`, `right`, `bottom`, `left`	Default: `right`

Note: Area charts are ideal for showing trends over time with a focus on the magnitude of change.

6. Creating Data Tables

Property	Description	Example
indexPattern	Specifies the index pattern to query data from	`"logs-*"`
timeField	Defines the field used for time-based filtering	`"@timestamp"`
columns	List of fields to display in the table	`["message", "level"]`
sort	Sorting criteria for the table rows	`[{ "field": "@timestamp", "direction": "desc" }]`

Example: Creating a Data Table in Kibana

{
  "title": "Log Data Table",
  "indexPattern": "logs-*",
  "timeField": "@timestamp",
  "columns": [
    "message",
    "level",
    "user"
  ],
  "sort": [
    {
      "field": "@timestamp",
      "direction": "desc"
    }
  ]
}

Note: Data tables in Kibana are ideal for displaying raw log entries or structured data with multiple fields. They support sorting, filtering, and column customization.

7. Creating Metric Visualizations

Example: Creating a Metric Visualization

{
  "title": "CPU Usage Metric",
  "type": "metric",
  "params": {
    "metric": {
      "field": "system.cpu.user.pct",
      "label": "CPU Usage"
    }
  },
  "aggs": [
    {
      "id": "1",
      "type": "avg",
      "schema": "metric",
      "params": {
        "field": "system.cpu.user.pct"
      }
    }
  ]
}

Property	Description	Values	Notes
type	Visualization type	`metric`	Must be `metric` for metric visualizations
params.metric.field	Field to calculate metric from	`string`	Must be a numeric field in the index pattern
params.metric.label	Label for the metric	`string`	Optional, defaults to field name
params.metric.color	Color of the metric display	`string`	Hex color code or CSS color name

Note: Metric visualizations are ideal for displaying single values or aggregated data, such as average CPU usage or total error count.

8. Creating Tag Clouds

Property	Description	Example
tagCloud	Configuration object for tag cloud visualization	`{ "size": 100, "mode": "frequency" }`
size	Maximum number of tags to display	`50`
mode	Tag cloud rendering mode (frequency, count)	`"frequency"`

{
  "tagCloud": {
    "size": 100,
    "mode": "frequency"
  }
}

Note: Tag clouds are best used for visualizing term frequency in logs or document collections.

Tag Cloud: Good for showing relative importance via font size
Bar Chart: Better for precise value comparisons and sorting

9. Creating Heat Maps

Example: Basic Heat Map Configuration

{
  "visState": "{\n  \"title\": \"Heat Map Example\",\n  \"type\": \"heatmap\",\n  \"params\": {\n    \"colorSchema\": \"Green to Red\",\n    \"maxBuckets\": 50,\n    \"legendPosition\": \"right\"\n  },\n  \"aggs\": [\n    {\n      \"id\": \"1\",\n      \"enabled\": true,\n      \"type\": \"date_histogram\",\n      \"schema\": \"segment\",\n      \"params\": {\n        \"field\": \"@timestamp\",\n        \"interval\": \"hour\"\n      }\n    },\n    {\n      \"id\": \"2\",\n      \"enabled\": true,\n      \"type\": \"terms\",\n      \"schema\": \"group\",\n      \"params\": {\n        \"field\": \"status_code\"\n      }\n    },\n    {\n      \"id\": \"3\",\n      \"enabled\": true,\n      \"type\": \"count\",\n      \"schema\": \"metric\",\n      \"params\": {}\n    }\n  ]\n}",
  "description": "A basic heatmap visualization showing request counts by status code over time",
  "version": "8.10.0"
}

Property	Description	Default Value	Notes
colorSchema	Color scheme for the heatmap	`Green to Red`	Options: `Green to Red`, `Blue to Red`, `Yellow to Blue`
maxBuckets	Maximum number of buckets to display	`50`	Higher values may impact performance
legendPosition	Position of the color legend	`right`	Options: `right`, `bottom`, `left`, `top`
showEmptyBuckets	Whether to show empty buckets in the visualization	`false`	Set to `true` to include zero-value buckets

Note: Heat maps require at least two aggregations: one for grouping (e.g., terms) and one for metric (e.g., count or avg). The first aggregation is typically a date histogram or terms aggregation.

Warning: Large datasets may cause performance issues when rendering heat maps. Consider using filters or reducing the time range to optimize performance.

10. Creating Coordinate Maps

Property	Description	Example
geo.coordinates	Field containing latitude and longitude values	`{"lat": 40.7128, "lon": -74.0060}`
map.type	Map visualization type (e.g., "tile", "heatmap")	`"tile"`
zoom.level	Initial zoom level of the map	`10`

Example: Basic Coordinate Map Configuration

{
  "title": "Coordinate Map",
  "type": "region_map",
  "params": {
    "mapType": "tile",
    "zoomLevel": 10,
    "geoCoordinatesField": "location.coordinates"
  }
}

Note: Ensure that the geo.coordinates field is mapped correctly in Kibana's index pattern.

Warning: Coordinate maps require valid latitude and longitude values in the format { "lat": number, "lon": number }.

11. Creating Gauge Visualizations

Example: Basic Gauge Visualization Setup

{
  "title": "CPU Usage Gauge",
  "type": "gauge",
  "params": {
    "gauge": {
      "backgroundColor": "#f0f0f0",
      "foregroundColor": "#4a90e2",
      "gaugeType": "full",
      "percentageMode": true
    }
  },
  "aggs": [
    {
      "id": "1",
      "type": "avg",
      "schema": "metric",
      "params": {
        "field": "cpu_usage"
      }
    }
  ]
}

Property	Description	Values	Notes
gaugeType	Defines the shape of the gauge	`"full"`, `"semi"`	Default: `"full"`
backgroundColor	Background color of the gauge	Hex color code or `"transparent"`	Default: `"#f0f0f0"`
foregroundColor	Color of the gauge's filled portion	Hex color code or `"transparent"`	Default: `"#4a90e2"`
percentageMode	Whether to show percentage or absolute value	`true`, `false`	Default: `true`

Note: Gauge visualizations are ideal for displaying single metric values in a visually intuitive way, such as system resource usage or performance indicators.

12. Creating Markdown Panels

Example: Basic Markdown Panel Configuration

{
  "id": "markdown-panel-1",
  "type": "markdown",
  "title": "Project Overview",
  "description": "Overview of the project and its goals.",
  "content": "# Project Overview\n\nThis panel provides a summary of the project.\n\n- Goal: Improve performance\n- Status: In progress"
}

Property	Description	Values
id	Unique identifier for the panel	`string`
type	Panel type, must be `markdown`	`markdown`
title	Display title of the panel	`string`
description	Optional description of the panel's content	`string`
content	Markdown content to render in the panel	`string`

Note: The content field supports standard Markdown syntax including headers, lists, and links.

Warning: Markdown panels do not support dynamic data binding or queries. They are best used for static documentation or summaries.