Skip to main content
Mapagam

Using Kibana Lens and TSVB

1. Understanding Lens

Kibana Lens is a powerful visualization and analytics tool within the ELK Stack that enables users to create interactive dashboards, charts, and reports without writing code. It provides a drag-and-drop interface for building visualizations from Elasticsearch data.

Feature Description Status
Drag-and-Drop Interface Build visualizations by dragging fields onto the canvas NEW
Real-time Analytics Supports real-time data analysis and visualization NEW
Multiple Chart Types Supports bar, line, pie, and other chart types DEPRECATED
Dashboard Integration Seamlessly integrates with Kibana dashboards NEW

Example: Creating a Basic Lens Visualization

{
  "title": "CPU Usage by Host",
  "description": "Interactive chart showing CPU usage over time",
  "visState": {
    "type": "area",
    "params": {
      "addTimeMarker": true,
      "addLegend": true
    },
    "aggs": [
      {
        "id": "1",
        "enabled": true,
        "type": "avg",
        "schema": "metric",
        "params": {
          "field": "cpu.usage"
        }
      },
      {
        "id": "2",
        "enabled": true,
        "type": "date_histogram",
        "schema": "group",
        "params": {
          "field": "@timestamp",
          "interval": "auto"
        }
      }
    ]
  }
}
Note: Lens supports a wide range of aggregations and chart types, making it suitable for complex analytics workflows.

2. Creating Lens Visualizations

Example: Basic Lens Visualization Creation

{
  "title": "CPU Usage Over Time",
  "visualizationType": "area",
  "data": {
    "index": "logs-*",
    "timeField": "@timestamp",
    "series": [
      {
        "label": "CPU Usage",
        "metric": "avg",
        "field": "system.cpu.user.pct"
      }
    ]
  }
}
Property Description Values Notes
title Visualization title string Used in dashboard and saved objects
visualizationType Chart type to render area, bar, line, pie, table See supported types below
data.index Index pattern to query string Must match existing index pattern
data.timeField Timestamp field for time-based aggregations string Required for time-series charts
data.series Chart series definitions array Each item defines one data series
Note: Lens supports a wide variety of chart types including area, bar, line, pie, and table. Each visualization can be customized with filters, aggregations, and time ranges.

Supported Chart Types

  • area - Time-series area chart
  • bar - Horizontal or vertical bar chart
  • line - Line chart with time axis
  • pie - Pie or donut chart
  • table - Tabular data view

3. Using Lens Suggestions

Example: Applying a Lens Suggestion

{
  "title": "User Activity Overview",
  "description": "Suggested visualization for user login trends",
  "visualizationType": "area",
  "data": {
    "timeField": "@timestamp",
    "metrics": [
      {
        "label": "Login Count",
        "field": "user.login_count"
      }
    ],
    "groupBy": "user.id"
  }
}
Suggestion Type Description Use Case Notes
Area Chart Displays trends over time with filled areas User activity, system metrics Best for continuous data with time series
Bar Chart Compares discrete categories or groups Top users, error counts by type Good for categorical comparisons
Line Chart Shows trends over time or ordered categories Response times, CPU usage Effective for continuous variables
Pie Chart Displays proportions of a whole Percentage breakdowns, distribution Best for fewer than 6 categories
Table Lists raw data in rows and columns Full logs, detailed metrics Useful for filtering and sorting
Note: Lens suggestions are generated based on your data schema and common visualization patterns. You can customize any suggestion by modifying the fields, aggregations, or filters.
Warning: Some suggestions may not be suitable for large datasets. Lens might recommend a visualization that performs poorly with millions of records.

4. Configuring Lens Layers

Example: Basic Lens Layer Configuration

{
  "layer": {
    "type": "lens",
    "label": "Sales Data Layer",
    "source": {
      "index": "sales-logs-*",
      "query": {
        "language": "kuery",
        "query": "status:200"
      }
    },
    "visualizations": [
      {
        "id": "line-chart",
        "params": {
          "xAxis": "timestamp",
          "yAxis": "revenue"
        }
      }
    ]
  }
}
Property Description Values Notes
layer.type Specifies the type of layer "lens" Must be set to "lens" for Kibana Lens
layer.label Human-readable name for the layer string Used in UI to identify the layer
layer.source.index Index pattern to query data from string Can use wildcards like *-logs-
layer.source.query.language Query language to use "kuery", "lucene" Default is "kuery"
layer.source.query.query Query string to filter data string Can include field filters like status:200
layer.visualizations List of visualizations to render in this layer array Each item is a visualization config object
Note: Lens layers support multiple visualization types, including line charts, bar charts, and tables. Each layer can have its own data source and visualization configuration.

5. Understanding TSVB

Note: TSVB (Time Series Visual Builder) is a Kibana feature for creating visualizations and dashboards using time-series data.
Feature Description Availability
Time Series Visual Builder Interactive tool for building visualizations from time-series data. NEW in Kibana 7.10
Data Aggregation Supports various aggregation functions like sum, average, count, etc. Standard
Time Range Selection Allows selection of time ranges for visualizing trends. Standard
Multiple Metrics Supports multiple metrics in a single visualization. Standard

Example: Creating a TSVB Visualization

{
  "title": "CPU Usage Over Time",
  "timeRange": {
    "from": "now-1h",
    "to": "now"
  },
  "metrics": [
    {
      "id": "1",
      "type": "avg",
      "field": "cpu.usage"
    }
  ],
  "annotations": []
}

Key Features of TSVB

  • Builds visualizations using time-series data.
  • Supports various aggregation methods (avg, sum, count).
  • Allows customization of time ranges for analysis.
  • Enables creation of multiple metric visualizations in one view.

6. Creating TSVB Visualizations

Example: Basic TSVB Visualization Setup

{
  "title": "CPU Usage Over Time",
  "type": "metric",
  "series": [
    {
      "name": "cpu_usage",
      "data": "avg(cpu.usage)"
    }
  ],
  "timeRange": {
    "from": "now-1h",
    "to": "now"
  }
}
Property Description Values Notes
title Visualization title string Displayed in Kibana UI
type TSVB visualization type metric, area, line, bar Default: metric
series Visualization data series array Each item defines a metric or aggregation
timeRange Time range for data {from: string, to: string} Supports relative time formats like now-1h
Note: TSVB visualizations are built using the Kibana Lens API and support various chart types including line, bar, area, and metric charts.

7. Using TSVB Annotations

Property Description Values Notes
annotations Defines annotation configuration for TSVB visualizations object Used to overlay annotations on time series charts
annotations.enabled Enables or disables annotations true | false Default: false
annotations.source Source of annotation data index | query Index-based annotations are more common
annotations.index Index pattern for annotation data string Must match existing index pattern in Kibana
annotations.query KQL or Lucene query to filter annotation data string Allows filtering annotations by specific criteria

Example: TSVB Annotation Configuration

{
  "annotations": {
    "enabled": true,
    "source": "index",
    "index": "annotations-*",
    "query": "event_type:deployment"
  }
}
Note: Annotations in TSVB are useful for highlighting events or data points on a time series chart, such as deployments, incidents, or any custom markers.

8. Configuring TSVB Panel Filters

Filter Type Description Configuration Example Notes
Time Range Applies time-based filtering to the panel data { "from": "now-1h", "to": "now" } Used to scope data to a specific time window
Query DSL Allows filtering using Elasticsearch Query DSL 
{
  "query": {
    "match": {
      "status": "success"
    }
  }
}
 Supports complex queries for data filtering
Terms Filter Filters by specific field values { "terms": { "environment": ["prod", "staging"] } } Useful for filtering by categories or tags
Range Filter Filters based on numeric or date ranges { "range": { "response_time": { "gte": 100 } } } Can be used for performance thresholds

Example: Applying Time Range Filter

{
  "timeRange": {
    "from": "now-24h",
    "to": "now"
  }
}

Example: Using Query DSL Filter

{
  "query": {
    "bool": {
      "must": [
        { "term": { "service": "api" } },
        { "range": { "timestamp": { "gte": "2025-01-01T00:00:00Z" } } }
      ]
    }
  }
}

9. Using TSVB Math Expressions

TSVB (Time Series Visual Builder) supports math expressions to perform calculations on time series data. These expressions can combine multiple metrics, apply mathematical functions, and create derived values for visualization.

Expression Description Example
math Applies mathematical operations to metric values. math(100 * (metric1 / metric2))
derivative Calculates the rate of change of a metric over time. derivative(metric1)
rate Calculates the rate of increase per second for counters. rate(metric1)
percentile Calculates percentiles (e.g., 95th, 99th) of metric values. percentile(metric1, 95)
moving_avg Calculates a moving average over a specified window. moving_avg(metric1, 5)

Example: Calculating CPU Usage Percentage

{"math": "100 * (cpu_used / cpu_total)" }

Example: Derivative of Memory Usage

{"derivative": "memory_usage" }
Note: TSVB math expressions are evaluated in the context of a time range and can include functions like abs, ceil, floor, and round.

10. Creating Vega Visualizations

Example: Basic Vega Visualization

{
  "title": "Basic Bar Chart",
  "data": [
    {
      "name": "table",
      "values": [
        {"category": "A", "value": 28},
        {"category": "B", "value": 55},
        {"category": "C", "value": 43}
      ]
    }
  ],
  "mark": "bar",
  "encoding": {
    "x": {"field": "category", "type": "nominal", "axis": {"title": "Category"}},
    "y": {"field": "value", "type": "quantitative", "axis": {"title": "Value"}}
  }
}
Property Description Values
title Chart title string
data Data source configuration array
mark Chart type (bar, line, etc.) string
encoding Mapping of data fields to visual properties object
Note: Vega visualizations in Kibana require the vega visualization type and are defined using the Vega-Lite specification.

11. Using Vega-Lite

Example: Basic Vega-Lite Specification

{
  "data": {
    "url": "elasticsearch://my-index"
  },
  "mark": "bar",
  &quot"encoding": {
    "x": {
      "field": "category",
      "type": "nominal",
      "title": "Category"
    },
    "y": {
      "field": "sales",
      "type": "quantitative",
      "title": "Sales"
    }
  }
}
Property Description Values
data Source of data for the visualization url or inline
mark Type of visual mark to use bar, line, point, area
encoding Maps fields to visual properties Object with x, y, etc.
Note: Vega-Lite specifications are processed by Kibana Lens and rendered in the browser.
Warning: Complex aggregations in Vega-Lite may impact performance on large datasets.

Was this article helpful?

Related Cheat Sheets