Learn data exploration and visualization with Kibana

Open Discover and switch to ES|QL

1. From the navigation menu, go to Discover.
2. Select ES|QL or Try ES|QL from the application menu.

Result: The query bar changes to an ES|QL editor where you can write piped queries.

Run your first query

Enter the following query, then select Run or Search. If you choose to type your own query, the editor helps you with relevant autocomplete suggestions for commands, fields, and values.

FROM kibana_sample_data_logs
| KEEP @timestamp, clientip, response, message
| SORT @timestamp DESC
| LIMIT 50
		

1. Reads from the sample web logs index.
2. Retains only these four fields in the output, discarding everything else.
3. Orders results by timestamp, most recent first.
4. Returns only the first 50 rows. Without LIMIT, ES|QL returns up to 1,000 rows by default. A smaller limit keeps the result set focused and the response fast while you explore.

For a complete list of commands and functions, refer to the ES|QL reference.

Result: The results table displays the most recent web log entries with only the fields you selected. To discover which fields are available, browse the field list in the sidebar.

×

Inspect individual results and documents

The results table gives you an overview, but sometimes you need the full details of a single event. To inspect a document:

1. Select the expand icon ( ) on any row in the results table. A flyout opens.
2. The flyout shows the fields returned by your query in a detailed view. Use the Table tab to see field names and values, or the JSON tab to see the raw document.
3. Use the navigation arrows at the top of the flyout to move between documents without closing it. This is useful when you need to compare consecutive events or trace a sequence.

×

Filter and aggregate

Browsing individual events is useful, but you can also summarize data directly in ES|QL. In this step, you check which HTTP response codes appear in the logs and how frequently. Use WHERE to filter out rows with missing values and STATS to count events per response code:

FROM kibana_sample_data_logs
| WHERE response IS NOT NULL
| STATS event_count = COUNT(*) BY response
| SORT event_count DESC
| LIMIT 50
		

1. Excludes rows where the HTTP response code is missing.
2. Groups rows by response code and counts events in each group.
3. Puts the most frequent response codes at the top.

Result: The table shows the HTTP response codes ranked by frequency. A chart appears above the table to visualize the aggregation, so you can see at a glance how traffic breaks down by status (200, 404, 503, and so on). A four-line query turned thousands of raw log entries into a ranked breakdown with a chart. Notice that the field list in the sidebar now only shows the fields produced by the query (event_count and response), reflecting the narrower result set.

×

Save the visualization to a dashboard

The aggregation query produced a chart showing event counts by response code. You can save this chart directly to a dashboard:

1. Select Save visualization above the chart. You can also select Edit visualization to open the Lens editor inline and customize the chart before saving it.
2. Enter a title, for example Events by response code.
3. Under Add to dashboard, select New.
4. Select Save and go to dashboard.

×

Result: Kibana opens a new, unsaved dashboard with your response code chart already on it.

Save the dashboard

Before adding more panels, save your dashboard so you don't lose your work:

1. In the toolbar, select Save.
2. Enter a title, for example Web logs overview.
3. Select Save.

Add a metric panel for median response size

1. Create the visualization:

   • Select Add > Visualization in the toolbar.
   • Select Create visualization.

2. Once in the Lens editor, switch the visualization type to Metric.

3. From the Available fields list on the left, drag bytes to the Primary metric area. Lens selects the Median aggregation automatically.

4. Select the "Median of bytes" Primary metric that we just added, then go to the Appearance section and configure the following:

   • Name: Median response size
   • Value format: Bytes (1024)
   • Background chart (or Supporting visualization): Line. A sparkline appears behind the number, showing how the median changes over the selected time range.
   • Color by value (or Color mode): Dynamic. Set three color stops: green at 0, yellow at 6000, and red at 10000. With these thresholds, the panel color reflects whether the median response size is small (under 6 KB), moderate, or large (over 10 KB).

×

5. Select Close, then select Save and return.

Result: A metric panel appears on the dashboard showing the median response size in a human-readable format (for example, 5.6 KB instead of 5,748), with a background sparkline for context.

Add a bar chart of requests by file extension

1. Create the visualization:

   • Select Add > Visualization in the toolbar.
   • Select Create visualization.

2. Make sure the correct data view is selected (for example, kibana_sample_data_logs).

3. From the Available fields list, drag extension.keyword to the workspace.

   Lens detects that this is a categorical field and creates a bar chart of its top values by count. It picks the chart type and axis configuration automatically.

×

4. Select Save and return.

Add a panel title:

1. Hover over the panel and select Settings. The Settings flyout appears.
2. In the Title field, enter Requests by file extension, then select Apply.

Add a line chart of log volume over time

1. Create the visualization:

   • Select Add > Visualization in the toolbar.
   • Select Create visualization.

2. Once in the Lens editor, switch the visualization type to Line.

3. From the Available fields list, drag Records to the workspace.

   Because the data contains a time field, Lens places @timestamp on the horizontal axis and Count of Records on the vertical axis automatically.

4. Add a reference line to give the chart visual context:

   1. Select the Add layer icon , then select Reference lines.
   2. Select the reference line value and enter 150. This marks a "high traffic" threshold on the chart.
   3. Set the color to red, then under Text decoration, enter a label such as High traffic and select Fill below to shade the area under the line.

×

5. Select Save and return.

Add a panel title:

1. Hover over the panel and select Settings.
2. In the Title field, enter Log volume over time, then select Apply.

Result: Your dashboard now has four panels: the response code chart from Discover, the metric, the bar chart, and the line chart.

×

Customize a panel with inline editing

You can fine-tune any Lens panel without leaving the dashboard. Try it on the Requests by file extension panel:

1. Hover over the panel and select Edit visualization configuration. A Configuration flyout opens on the right side of the panel.
2. In the flyout, select the Horizontal axis configuration.
3. Expand Advanced, then in the Include values field, enter .+ and select Use regular expression. This regular expression matches any non-empty string, which filters out documents where the extension field is blank. The panel updates immediately to reflect the change.
4. Select Back, then Apply and close.

×

Try interactive filtering

Dashboard panels are interactive. Try selecting the 404 bar in the Events by response code chart. Kibana adds a filter for that value, and the other panels update to show only the matching log events. The metric, bar chart, and line chart now reflect only the 404 traffic.

To remove the filter, select the next to it in the dashboard's filter bar.

Arrange and save

Resize and reposition the panels to create a clear layout. Place the metric panel at the top, and arrange the charts below it. For larger dashboards, you can also group panels into collapsible sections to keep things organized.

When you are happy with the layout, select Save in the toolbar.