Using Kibana Dev Tools

1. Understanding Console

Feature	Description	Usage
Console	Interactive shell for executing Elasticsearch queries	Access via Kibana Dev Tools
Query Syntax	Supports full Elasticsearch Query DSL	Write queries in JSON format
Response Format	Formatted JSON output with syntax highlighting	View results in structured format

Example: Basic Query

{
  "query": {
    "match_all": {}
  }
}

Note: Console supports both GET and POST requests to Elasticsearch endpoints.

2. Executing API Requests

Example: Execute a simple GET request

{
  "method": "GET",
  "path": "/_cat/indices?v"
}

Field	Description	Values
method	HTTP method to use	`GET`, `POST`, `PUT`, `DELETE`
path	Endpoint to call	`/_cat/indices?v`
body	Request body (for POST/PUT)	JSON object or string

Note: The body field is optional and only used for methods that support a request payload.

Example: Execute a POST request with body

{
  "method": "POST",
  "path": "/my-index/_doc",
  "body": {
    "message": "Hello, World!",
    "timestamp": "2025-04-05T10:00:00Z"
  }
}

Example: Using variables in the request path

{
  "method": "GET",
  "path": "/my-index/_search?q=message:hello"
}

3. Using Auto-Complete

Example: Auto-completing a query in Kibana Dev Tools

// Example of auto-completed query in Kibana Dev Tools
GET /_search
{
  "query": {
    "match": {
      "message": "error"
    }
  }
}

Feature	Description	Usage
Auto-Complete	Provides intelligent suggestions for queries and syntax	Start typing a query in the Kibana Dev Tools console to see suggestions
Query Suggestions	Displays relevant fields and query structures based on index mapping	Type `GET /` to see available indices and `query.` to get query structure suggestions
Field Suggestions	Shows fields that match the current context	When typing `query.match.`, Kibana suggests fields from the index

Note: Auto-complete works best when the index mapping is properly defined and updated.

Warning: Auto-complete does not guarantee syntactically correct queries; it provides suggestions only.

4. Viewing Request History

Example: View request history in Kibana Dev Tools

// In Kibana Dev Tools console
GET /_cat/requests?v

// Output includes:
// id, timestamp, user, method, url, status, response_time

Field	Description	Notes
id	Unique identifier for the request	Used for tracking and debugging
timestamp	Time when the request was made	ISO 8601 format
user	User who made the request	Can be anonymous or authenticated
method	HTTP method used (GET, POST, etc.)	Standard HTTP methods
url	Endpoint accessed	Full URL path including query parameters
status	HTTP status code returned	200, 404, 500, etc.
response_time	Time taken to process the request	Measured in milliseconds

Note: Request history is stored in Elasticsearch and can be queried using the _cat/requests API endpoint.

Warning: The request history is limited by default to 1000 entries. Configure elasticsearch.request_history.max_entries to increase this limit.

5. Formatting JSON

Property	Description	Example
pretty	Formats JSON output with indentation and line breaks for readability	`true`
format	Specifies the output format (e.g., `json`, `yaml`)	`json`

Example: Formatting JSON in Kibana Dev Tools

GET /_search
{
  "query": {
    "match_all": {}
  },
  "pretty": true
}

Note: The pretty parameter is useful for debugging and viewing results in a readable format.

6. Using Variables

Example: Setting and Using Variables in Kibana Dev Tools

// Define a variable for the index name
&#x27;my_index&#x27;

// Use the variable in a query
GET /my_index/_search
{
  "query": {
    "match_all": {}
  }
}

Variable Type	Description	Usage
Index Name	Used to reference an Elasticsearch index	`GET /{index_name}/_search`
Query Parameter	Used to pass dynamic values into queries	`GET /my_index/_search?q={query_param}`
Date Range	Used to define time ranges for queries	`GET /my_index/_search?from={start_date}&to={end_date}`

Note: Variables in Kibana Dev Tools are defined using single quotes and can be reused throughout the query.

7. Copying as cURL

Example: Copying a request as cURL

curl -X GET "http://localhost:9200/_cat/indices?v" -H "Content-Type: application/json"

Feature	Description	Notes
cURL command	`curl -X GET "http://localhost:9200/_cat/indices?v" -H "Content-Type: application/json"`	Generated from Kibana Dev Tools

Note: The cURL command can be copied directly from the Kibana Dev Tools interface to execute the same request in a terminal or script.

8. Using Grok Debugger

Example: Grok Pattern Matching

{&#34;pattern&#34;: &#34;%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:loglevel} %{GREEDYDATA:message}&#34;, &#34;sample&#34;: &#34;2025-04-05T14:30:45.123Z INFO Application started successfully&#34;}

Field	Description	Usage
pattern	Grok pattern to test	Define the pattern you want to match logs against
sample	Sample log line to test	Input a real log line for pattern matching

Note: Grok patterns use named captures with %{PATTERN_NAME:field_name} syntax.

Example: Testing with Log Sample

{&#34;pattern&#34;: &#34;%{IP:clientip} %{WORD:method} %{URIPATH:uri}&#34;, &#34;sample&#34;: &#34;192.168.1.1 GET /index.html&#34;}

Common Grok Patterns

%{IP} - Matches IPv4 addresses
%{TIMESTAMP_ISO8601} - Matches ISO 8601 timestamps
%{LOGLEVEL} - Matches log levels like INFO, ERROR
%{GREEDYDATA} - Matches any remaining data

9. Using Painless Lab

Example: Basic Painless Script

{
  "script": {
    "source": "ctx._source.field1 = ctx._source.field2 + 10"
  }
}

Feature	Description	Usage
Painless Lab	Interactive environment for testing Painless scripts	Accessible via Kibana Dev Tools
Script Context	Context in which Painless scripts execute	Supports various contexts like `score`, `index`
Variables	Available variables in Painless scripts	`ctx`, `params`, `_score`

Note: Painless scripts run in a sandboxed environment and are safe to execute.

Warning: Avoid complex logic in Painless scripts to maintain performance.

Key Features of Painless Lab

Real-time script testing
Supports all Painless syntax
Interactive debugging capabilities

10. Using Search Profiler

Example: Enable Search Profiler

{
  "profile": true,
  "query": {
    "match": {
      "message": "error"
    }
  }
}

Property	Description	Values	Notes
profile	Enables search profiling	`true`	Set to `true` to enable profiling
query	Search query to profile	`object`	Query object to analyze performance

Note: Profiling can significantly slow down query execution and should only be used for debugging.

Search Profiler Features

Query Analysis: Identifies bottlenecks in query execution
Performance Metrics: Provides detailed timing information
Resource Usage: Shows memory and CPU consumption

11. Testing Index Templates

Example: Test Index Template

{
  "index_patterns": ["my-index-*"],
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1
  },
  "mappings": {
    "properties": {
      "timestamp": {
        "type": "date"
      },
      "message": {
        "type": "text"
      }
    }
  }
}

Property	Description	Values
index_patterns	Defines the index pattern to match	`["my-index-*"]`
settings	Index-level settings	`{"number_of_shards": 1, "number_of_replicas": 1}`
mappings	Field mappings for the index	`{"properties": {"timestamp": {"type": "date"}, "message": {"type": "text"}}}`

Note: Use the indices:admin/put API to test templates.

Example: Test Template via Dev Tools

PUT /_template/my-template
{
  "index_patterns": ["my-index-*"],
  "settings": {
    "number_of_shards": 1,
    "number_of_replicas": 1
  },
  "mappings": {
    "properties": {
      "timestamp": {
        "type": "date"
      },
      "message": {
        "type": "text"
      }
    }
  }
}

12. Debugging Aggregations

Example: Debugging a terms aggregation

{
  "aggs": {
    "popular_categories": {
      "terms": {
        "field": "category.keyword",
        "size": 10
      }
    }
  },
  "size": 0
}

Property	Description	Values
aggs	Container for aggregation definitions	Object
terms	Aggregation type to group by unique values	Object
field	The field to group by	String (e.g., `category.keyword`)
size	Maximum number of unique terms to return	Integer (default: 10)

Note: Use size: 0 in the main query to avoid returning documents, only aggregations.

Example: Using debug output to inspect aggregation results

{
  "aggs": {
    "category_stats": {
      "stats": {
        "field": "price"
      }
    }
  },
  "size": 0
}

Aggregation Type	Use Case	Notes
terms	Group by unique values in a field	Best for categorical data
stats	Calculate statistics (min, max, avg) on numeric fields	Use `size: 0` to suppress document results
cardinality	Count unique values in a field	Approximate count using HyperLogLog

Debugging Aggregations Workflow

Start with a simple aggregation (e.g., terms) on a known field
Set size: 0 to return only aggregation results
Check for errors in Kibana Dev Tools console
Use size: 1 to inspect a single document if needed
Iterate with more complex aggregations once base works