Lens visualizations

Lens is Kibana's visualization editor for building charts, tables, maps, and metrics. It supports two modes for creating visualizations:

• Point-and-click: Configure your visualization interactively by selecting fields from a data view, choosing aggregations, and setting dimensions and display options. No query writing required. Data views are created automatically when you upload a file or add sample data; otherwise, you need to create one manually.
• Query: Write an ES|QL or PromQL query to retrieve and transform your data, then configure the visualization on top of the result. Best suited for cross-index queries, complex filtering, and custom calculations. Refer to ES|QL visualizations for details.

With Lens, you can create the following visualization types:

You can create and manage Lens visualizations programmatically using the Visualizations API (stateful, serverless). This is useful for managing visualizations as code, automating their lifecycle, or building tooling around Lens charts.

Visualizations created through this API can be added to dashboards using the Kibana UI or the Dashboards API.

If you’re unsure about the visualization type you want to use, or how you want to display the data, drag the fields you want to visualize onto the workspace, then let Lens choose for you.

If you already know the visualization type you want to use, and how you want to display the data, use the following process.

Once you have created your visualization, you can edit it directly on the dashboard. Click the Edit visualization configuration icon on the panel.

When you can create a visualization, you can change the fields list to display a different data view, a different time range, or add your own fields. To do that, open the data view dropdown and select Add a field to this data view.

If the fields list is empty, change the time filter.

For more information about adding fields to data views and examples, refer to Explore your data with runtime fields.

You can assign specific colors to terms in your visualizations. This color mapping can be useful in several situations:

• Visual recognition and recall: Keep colors consistent for each term regardless of filters or sorting.
• Semantic meaning: Use colors to convey meaning or categorization.
• Consistency: Align with brand colors and improve overall aesthetic consistency.

Color mapping is available for the following Lens visualization types:

• Data tables: Assign colors to terms in Rows or Metrics fields. You can apply colors to cell backgrounds or text.
• XY charts (Area, Bar, Line): Assign colors to breakdown dimensions that split your data into multiple series.
• Partition charts (Donut, Pie, Treemap, Waffle): Assign colors to the main slice or group-by dimension that defines the chart segments.
• Tag clouds: Assign colors to the tags dimension that determines the terms displayed in the cloud.

To assign colors to terms in your visualization:

1. Create a visualization using one of the supported types.
2. Add a categorical field that contains the terms you want to color.
3. In the field configuration, look for the Color by value option:
   • For data tables: Select Cell or Text
   • For other chart types: This option appears when you have a categorical breakdown
4. Click the Edit colors icon. In the menu that opens, keep Use legacy palettes turned off to be able to assign colors to specific terms
5. Select a color palette from the available options:
   • Elastic: The default and most recent palette. It is intentionally built from a color spectrum designed for flexibility and consistency, while being suited for future accessibility improvements.
   • Elastic (line optimized): A variant of the Elastic palette that reorders colors for better contrast between adjacent series in line charts. Lens automatically applies this palette when you create or switch to a line chart. Switching to a different chart type reverts to the standard palette. You can override this by manually selecting a different palette.
   • Severity: A theme-aware categorical palette designed for severity-based data, with colors that adapt to both light and dark themes.
   • Kibana 7.0: A palette that matches the Kibana 7.0 color theme for visualizations
   • Kibana 4.0: A palette that matches the Kibana 4.0 color theme for visualizations
   • Elastic classic: A palette made of classic Elastic brand colors
6. Select the color mode you'd like to use with this palette:
   • Categorical: Assign a distinct color to each term
   • Gradient: Assign gradients of the same color to each term
7. Choose which terms to color. You can assign colors manually or select Add all unassigned terms for automatic assignment.
   Tip

   You can assign several terms to the same color.

8. Choose how to handle unassigned terms: Use the selected color palette or assign a single color.

Discrete colors and gradients

Choose from discrete color sets or generate sequential or divergent gradients. Gradients work well for Likert scales and other term scales.

Theme-aware neutral colors

Use neutral gray colors that adjust automatically between light and dark themes. These help de-emphasize less important data.

Accessibility warnings

The system warns you when colors don't have enough contrast for accessibility.

Maintain consistency

Use color mapping to create consistent color schemes when the same categorical data appears across multiple visualizations in your dashboards.

Use semantic colors

Leverage color associations that users already understand (such as red for errors, green for success) to make your visualizations more intuitive.

Consider performance

Color mapping works best with fields that have a reasonable number of distinct values. Fields with hundreds or thousands of unique terms may impact visualization performance.

Plan for themes

When choosing colors, consider how they appear in both light and dark themes. Use theme-aware neutral colors when you want to de-emphasize data.

To use a keyboard instead of a mouse, use the Lens fully accessible and continuously improved drag system.

1. Select the field in the fields list or layer pane. Most fields have an inner and outer select state. The inner state opens a panel with detailed information or options. The outer state allows you to drag the field. Tab through the fields until you get the outer state on the field.

   
   ×

2. Complete the following actions:

   • To select a field, press Space bar.

   • To select where you want to drop the field, use the Left and Right arrows.

   • To reorder the fields on the layer pane, use the Up and Down arrows.

   • To duplicate an action, use the Left and Right arrows, then select the Drop a field or click to add field you want to use.

     
     ×

3. To confirm the action, press Space bar. To cancel, press Esc.

Lens formulas let you do math using a combination of Elasticsearch aggregations and math functions. For example, you can use formulas to divide two values and produce a percent value.

When you add a categorical field to your visualization, select the field to open its appearance settings, choose Formula, and set Appearance > Value format to Percent for a more accurate display.

For more details on how it works, click the Formula reference icon on the Formula panel.

These are examples of common formulas:

Filter ratio

To filter a document set, use kql='', then compare to other documents within the same grouping:

count(kql='response.status_code > 400') / count()
		

Week over week

To get the value for each grouping from the previous week, use shift='1w'.

percentile(system.network.in.bytes, percentile=99) /
percentile(system.network.in.bytes, percentile=99, shift='1w')
		

You are unable to combine different time shifts, such as count(shift="1w") - count() and count(shift="1w") - count(shift="1m"), with the Top values function.

Percent of total

To convert each grouping into a percent of the total, formulas calculate overall_sum for all groupings:

sum(products.base_price) / overall_sum(sum(products.base_price))
		

Compare your real-time data to the results that are offset by a time increment. For example, you can compare the real-time percentage of a user CPU time spent to the results offset by one hour.

1. In the layer pane, click the field you want to offset.
2. Click Advanced.
3. In the Time shift field, enter the time offset increment.

For a time shift example, refer to Compare time ranges.

To create partition charts, such as pie charts, configure one or more Slice by dimensions to define the partitions, and a Metric dimension to define the size. To create partition charts with multiple metrics, use the layer settings. Multiple metrics are unsupported for mosaic visualizations.

For detailed instructions on creating pie charts, including best practices and configuration options, refer to Build pie charts with Kibana.

1. In the layer pane, click , then select Settings/Layer settings.
2. Select Multiple metrics.
3. Click X.

Data sampling allows you to improve the visualization loading time. When you create your visualization, click the Settings/Layer settings icon and use the slider to adjust the Sampling percentage. For example, on large datasets, you can decrease loading time by using a lower sampling percentage. This increases performance but reduces accuracy.

Annotations allow you to call out specific points in your visualizations that are important, such as significant changes in the data. You can add annotations for any data view, add text and icons, specify the line format and color, and more. Click the Add layer icon , select Annotations and select the annotation method you want to use:

×

With reference lines, you can identify specific values in your visualizations with icons, colors, and other display options. You can add reference lines to any visualization type that displays axes.

For example, to track the number of bytes in the 75th percentile, add a shaded Percentile reference line to your time series visualization.

×

From your visualization, click Add layer > Reference lines. Click the vertical axis value, and specify the reference line you want to use by choosing one fhe following placement methods:

Static

To add a static reference line.

Quick functions

To add a dynamic reference line.

Formula

To calculate the reference line value with math.

You can also customize the display by adjusting the Appearance settings.

You can use the query bar to create queries that filter all the data in a visualization, or use the layer pane and legend filters to apply filters based on field values.

With the Filters function, you can apply more than one KQL filter, and apply a KQL filter to a single layer so you can visualize filtered and unfiltered data at the same time.

1. In the layer pane, click a field.

2. Click the Filters function.

3. Click Add a filter, then enter the KQL filter you want to apply.

   To try the Filters function on your own, refer to Compare a subset of documents to all documents.

With the Filter by advanced option, you can assign a color to each filter group in Bar and Line and area visualizations, and build complex tables. For example, to display failure rate and the overall data.

1. In the layer pane, click a field.
2. Click Add advanced options, then select Filter by.
3. Enter the KQL filter you want to apply.

Apply filters to visualizations directly from the values in the legend. Bar, Line and area, and Proportion visualizations support legend filters.

In the legend, click the field, then choose one of the following options:

• Filter for value — Applies a filter that displays only the field data in the visualization.
• Filter out value — Applies a filter that removes the field data from the visualization.

You can interact with filter pills to edit them, temporarily alter their behavior without having to remove them, or make them available in other contexts. The following options are available when selecting a filter pill:

Pin across all apps and Unpin

Adds this filter to available dashboards and to apps such as Discover, Lens, Maps, and Visualize. You remove the filter if you:

• Unpin it. In this case, the filter only remains on the currently open app, unpinned.
• Remove it from any place while it's still pinned.
• Refresh your session, for example by opening a dashboard in a new tab. Pinned filters are not saved along with the dashboard, visualization, or Discover session that you added them to.

Tip

When a pinned filter can't be applied, for example if a field specified in the filter doesn't exist in the current data view, the filter is ignored and shows in a different color.

Edit filter

Lets you edit and update the filter.

Exclude results and Include results

Reverses the filter behavior.

Temporarily disable and Re-enable

Lets you temporarily deactivate a filter instead of requiring you to remove it. This is particularly useful for testing different filter combinations.

Delete

Removes the filter.

You can perform most of these actions at once for all filters in your current view using the Query menu. From that menu, select Apply to all, then choose the action you'd like to perform.

When at least one filter pill is present, you can collapse the filter pills section to reclaim screen space. Select Collapse filters to hide the pills, or Expand filters to show them again. Your preference is saved across sessions.

When your visualization includes one data view, you can open and explore the visualization data in Discover.

To get started, click Explore data in Discover in the toolbar.

For more information about exploring your data with Discover, check out Discover.

To view the data included in the visualization and the requests that collected the data, use the Inspector.

1. In the toolbar, click Inspect.

2. Open the View dropdown, then click Data.

   1. From the dropdown, select the table that contains the data you want to view.
   2. To download the data, click Download CSV, then select the format type.

3. Open the View dropdown, then click Requests.

   1. From the dropdown, select the requests you want to view.
   2. To view the requests in Console, click Request, then click Open in Console.

For answers to common Lens questions, review the following.