Master Kibana: Install, Configure, and Visualize Elasticsearch Data

1. Install Kibana

Kibana is an open‑source analytics and visualization platform designed to work with Elasticsearch. Install it following the official documentation.

2. Kibana Configuration

Configure Kibana by editing kibana.yml and setting the Elasticsearch URL. Detailed settings are available at the Elastic guide.

Access Kibana via http://localhost:5601 (or your domain). The default Discover page shows the last 15 minutes of data with a match‑all query.

2.1 Check Kibana Status

Visit http://localhost:5601/status or http://<em>host</em>:5601/api/status for JSON status information.

3. Connect Elasticsearch to Kibana

When first accessing Kibana, you’ll be prompted to define an index pattern that matches one or more Elasticsearch indices.

Steps:

Open Kibana UI (e.g., http://localhost:5601).

Specify an index pattern.

Choose a time‑field if your data is time‑based, or select “I don’t want to use the Time Filter”.

Click “Create index pattern”.

4. Discover

Use the Discover page to interactively explore your data, submit queries, filter results, and view document statistics. If a time field is configured, a histogram shows document distribution over time.

4.1 Set Time Filter

4.2 Search Data

Enter queries using Kibana’s Lucene‑based syntax or the Elasticsearch DSL. Autocomplete and simplified syntax are available via the “Options” menu.

Results update histograms, document tables, and field lists. The table shows the first 500 hits, sorted by time descending by default.

4.2.1 Lucene Query Syntax

Simple text search: safari Field‑specific search: status:200 Range search: status:[400 TO 499] Boolean operators: AND, OR, NOT (e.g., status:[400 TO 499] AND (extension:php OR extension:html))

4.2.2 Enhanced Kibana Query Syntax

New syntax simplifies queries: response:200, phrase search with quotes, explicit boolean operators, and operator precedence (AND > OR). Example: response:200 AND (extension:php OR extension:css).

5. Visualize

Visualize lets you create charts based on Elasticsearch aggregations and add them to dashboards.

Steps:

Click “Visualize” in the left navigation.

Select “Create new visualization” or the plus (+) button.

Choose a visualization type.

Define a search query.

Select Y‑axis aggregation (e.g., sum, average, count).

Configure the X‑axis.

6. Dashboard

Dashboards combine visualizations and saved searches. Build a dashboard by clicking “Dashboard”, creating a new one, adding visualizations or saved searches, and saving the layout.

7. Monitoring

Monitor Kibana and Elasticsearch health via logs and the monitoring UI.

Elasticsearch console log:
[2018-08-15T14:48:26,874][INFO ][o.e.c.m.MetaDataCreateIndexService] [Px524Ts] [.monitoring-kibana-6-2018.08.15] creating index, cause [auto(bulk api)], templates [.monitoring-kibana], shards [1]/[0], mappings [doc]

Kibana console log:
[03:26:53.605] [info][license][xpack] Imported license information from Elasticsearch for the [monitoring] cluster: mode: basic | status: active