Kibana

Kibana is a data visualisation tool that provides charts and graphs for data visualisation. It also provides functionality for managing the broader Elastic stack.

Concepts

• Index Patterns select data and properties to be used from a given Elasticsearch index.
• Panels are individual visualisations built on data in an Index Pattern.
• Dashboards allow visualising data with sets of Panels.
• Timelion syntax is designed for advanced visualisations and offers a quicker build/test cycle vs using the graphical interface.
• Alerts allow declaration of alarms based on metrics exceeding defined thresholds. These can be sent to connectors such as chat or incident management systems.

Installation

The Kibana configuration file is usually located at /etc/kibana/kibana.yml.

Querying

Kibana can be queried using two different syntaxes:

• The original Lucene query syntax.
• KQL is the preferred interface.

The two syntaxes are fairly similar, but:

• Only KQL gets suggestions as you type.
• KQL uses size:>=42 for greater and less than queries vs Lucene's size:[42 TO *].
• KQL doesn't support ranges, which can be expressed in Lucene as size:[42 TO 113].
• Field presence is tested in KQL using field:* and _exists_:field in Lucene.
• Lucene allows regular expressions and fuzzy matching.

The syntax is field:value for equality.