Kibana
Master Kibana: Elasticsearch visualization, dashboards, log analysis, and the ELK stack.
What is Kibana?
Kibana is the analysis and operations interface for data in Elasticsearch. It provides Discover, visualizations, dashboards, alerting, saved content, and administration workflows. A beginner can think of it as the place where people ask questions, inspect evidence, arrange reusable views, and act on conditions found in Elastic data.
Kibana is not the database or search engine. Elasticsearch stores and indexes the source documents, enforces access to those indices, executes searches, and computes aggregations. Kibana constructs requests, renders the responses, and stores its own configuration as saved objects in Kibana-managed Elasticsearch indices.
The core invariant is simple: a dashboard is credible only when its query, filters, time range, data view, and user privileges all describe the intended evidence. A polished chart cannot repair the wrong scope.
Keep the experience, data, and content boundaries separate
Three layers cooperate to produce one dashboard. Treating them as one product boundary causes confusing authorization failures, broken promotions, and false operational confidence.
Explore and operate
Kibana experience
Discover inspects documents and fields. Lens and other editors define visualizations. Dashboards combine panels, time state, queries, controls, filters, and drill-downs. Kibana alerting schedules rules and runs connector actions.
Store and compute
Elasticsearch data
Indices and data streams hold the source documents. Elasticsearch mappings determine field behavior, index privileges govern data access, and the search and aggregation engines produce the results Kibana displays.
Reusable configuration
Saved objects
Dashboards, data views, visualizations, searches, rules, connectors, and related configuration are saved content. They have references, space behavior, migrations, and a deployment lifecycle separate from the source data.
Deleting a Kibana data view does not delete the Elasticsearch indices or documents, but it can break dashboards, visualizations, and saved Discover sessions that reference that data view.
Lab: scope the evidence before building a panel
Choose an investigation, time range, environment, and service. The lab uses a fixed, inspectable event set, so every count and bar can be traced to matching documents rather than an invented performance formula.
Scope the evidence before charting it
Loading the lesson-owned event set and query definitions.
Read the controls as one request context
- The KQL query filters by fields and values.
- The global time filter limits documents through the configured time field.
- The structured filter pills add conditions that are combined with the query.
- The panel definition asks Elasticsearch to aggregate or otherwise summarize the documents remaining in that scope.
KQL is intentionally narrow. It filters documents; it does not aggregate, transform, or sort them. Elasticsearch executes those operations through the panel's search or aggregation request.
Turn an operational question into dashboard evidence
Begin in Discover before choosing chart types. A useful dashboard is the reusable end of an evidence workflow, not a canvas filled with every available metric.
1 Question
State the decision
Name the operator, action, and time sensitivity. “Which service is causing checkout errors in production now?” is testable; “show platform health” is not.
2 Discover
Inspect documents
Verify field mappings, timestamps, missing values, representative events, and the exact KQL or ES|QL result before summarizing anything.
3 Lens
Choose the evidence
Use a count, rate, distribution, or comparison that answers the question. Expose the denominator and time window, and avoid mixing incompatible units on one visual.
4 Dashboard
Preserve the path back
Add controls and drill-downs that let the operator narrow the same evidence. Keep panel queries, custom time ranges, and global filters visible enough to audit.
Document evidence
Discover
Use it to inspect source documents, field statistics, and ad-hoc filters. Save a Discover session when the query and displayed fields should be reused or embedded.
Visual evidence
Lens
Use it to build aggregations and formulas through a visual editor. Change the visualization only after the dimensions, metric, and denominator are correct.
Shared decision surface
Dashboard
Use it to combine panels around one operational job. Global queries, time ranges, controls, and filter pills can change the evidence shown across panels.
Use ES|QL when a pipeline of row-oriented transformations and statistics is the clearest expression of the analysis. In supported Kibana apps, ES|QL can query Elasticsearch without a saved data view. Do not rename KQL as ES|QL: they have different responsibilities and syntax.
Promote dashboards as governed saved content
A dashboard is a graph of saved objects, not one self-contained JSON document. Its references can include visualizations, data views, searches, maps, and other content. Use Kibana's saved-object import and export mechanisms so migrations and references remain intact.
The export is NDJSON and should be treated as opaque. Keep it as a release artifact, review the source and target versions, and import only in a supported forward direction. Current Kibana guidance supports imports into the same version, a newer minor of the same major, or the next major; exports are not backward compatible.
Authorize both the feature and its data
Kibana feature privileges and Elasticsearch index privileges solve different problems. Scope feature privileges to the required space, then grant only the index access that those panels need.
dashboard_v2andvisualize_v2allow read access to those Kibana features in theoperationsspace.readallows searches against matching source indices.view_index_metadatalets Kibana inspect the field and index metadata needed by analytical workflows.- Spaces organize content and feature visibility; they do not replace Elasticsearch data authorization.
Roles are additive. Assigning another role cannot subtract an existing privilege. Review the user's complete role union when a supposedly read-only user can still edit content or reach a wider index pattern.
Lab: trace access and alert-delivery failures
Switch scenarios and inspect the active path. The important distinction is whether the failure blocks the Kibana feature, the underlying data, the saved-object graph, the scheduled rule evaluation, or only the connector action.
A rule, an alert, and an action are not the same event
1 Rule
Schedule a rule check
The rule owns a condition, schedule, and rule-type-specific parameters. Kibana Task Manager runs the background check; the browser does not need to remain open.
2 Condition
Evaluate Elastic data
The rule queries Elasticsearch and compares the result with its condition. A delayed or failed check creates an evidence gap even if the source data remains available.
3 Alert
Track alert state
When occurrences meet the condition, Kibana creates or updates alert instances. One rule can track several alert instances independently.
4 Delivery
Run connector actions
Actions use connectors to send email, webhooks, tickets, or chat messages according to their action frequency. A connector failure does not prove the rule condition was healthy.
The example below creates an Elasticsearch query rule body with no actions. That is deliberate: first verify the evidence and alert state, then attach a tested connector and choose an action frequency that controls notification noise.
Operate Kibana as a stateful application
Production readiness includes more than keeping the HTTP endpoint available.
- Protect saved content
- Export critical dashboards and their references through supported APIs.
- Test imports in the target version and space before a release window.
- Use Elasticsearch snapshots for cluster-level recovery; saved-object export is not a replacement for a full system backup.
- Protect alert execution
- Monitor rule status, execution gaps, Task Manager health, and connector errors.
- Test recovery actions and action-frequency behavior instead of checking only the first firing notification.
- Configure
encryptionKeyunderxpack.encryptedSavedObjectsand back it up securely; losing it can make existing rules and actions fail decryption.
- Protect query evidence
- Keep dashboard refresh intervals proportional to the operator's real decision window.
- Inspect expensive panel requests and field mappings in Elasticsearch rather than guessing at Kibana memory formulas.
- Prefer indexed fields for frequent filters; runtime fields are useful for exploration but shift computation to query time.
- Protect access boundaries
- Review Kibana feature privileges, spaces, and Elasticsearch index privileges together.
- Test with representative roles, including missing-data and read-only cases.
- Grant Saved Objects Management carefully because it exposes management of saved object types beyond the applications a user may otherwise access.
Decide when Kibana is the right fit
Elastic data is already authoritative
Strong fit
Use Kibana when teams need to investigate Elasticsearch documents, create Elastic-backed dashboards, operate Elastic observability or security workflows, and manage rules close to the data and mappings that those rules query.
Another boundary dominates
Reconsider the fit
Use a different or complementary tool when the primary need is cross-database semantic modeling, transactional business reporting, long-lived public embedded analytics, or an alerting control plane that must remain independent of Kibana and Elasticsearch.