Kibana highlights
editKibana highlights
editThis list summarizes the most important enhancements in Kibana 8.2.
Discover
editDocument Explorer on by default
editDocument Explorer, the powerful new way to analyze and explore your data with Discover, is now on by default. Document Explorer helps you quickly sort, select, and compare data, resize columns, and view documents in fullscreen. For more information, check Explore your documents.
Visualization editors
editAuto-apply your changes in Lens
editBy default, Lens has always automatically applied the changes you make to visualizations. Now you can control when Lens applies your changes and generates suggestions with the new ability to turn on and off auto-apply. To start manually applying your changes, click Settings in the toolbar, then deselect Auto-apply visualization changes. For more information, check Create visualizations.
Add annotations to Lens visualizations (technical preview)
editTo call out significant changes and trends in your data, you can now add annotations to Lens visualizations. Customize the appearance of annotations with text, icons, colors, and more. For more information, check Add annotations.
Open TSVB visualizations in Lens
editOpen and edit your Time Series TSVB visualizations in Lens, the drag-and-drop visualization editor that provides you with additional visualization types, reference lines, and more. For more information, check Edit visualizations in Lens.
Explore Lens visualization data in Discover
editFor further exploration of your data, you can now open Lens visualization data in Discover. With Discover you can view the documents in the fields you used to create the visualization, then navigate back to Lens to finish creating your visualization. For more information, check Explore the data in Discover.
Enhancements to visualization editors
editKibana now offers even more ways to create visualizations:
- Metric visualization. Use the new Metric visualization type in Lens to show the latest or earliest data, or the last value.
- Group by multiple fields in TSVB. When you select Terms from the Group by dropdown in TSVB, you can calculate the top values for multiple fields.
- Customize the legend size. In all visualization editors, you can now increase or decrease the visibility of your legend by changing the size.
Maps
editDisplay clusters as hexagons
editIn Maps, you can now display your clusters as hexagons instead of rectangles. This feature adds another beautiful, and more precise way, to visualize your geo_point fields.
Create region maps from Lens
editYou can now create region maps (also called choropleth maps) from Lens.
Add custom icons
editUpload an SVG image and use it as icons in your maps. Edit your maps layer, and then select Layer Style> Symbol style > Icon > Add custom icon.
Alerting
editSnooze rules
editAlerting introduces the ability to snooze rules to suppress notifications and actions for a user-defined duration. You’ll never miss an action because you forgot to unmute a rule while handling problems that arose unexpectedly or during known downtimes. For more information, check Snooze and disable rules.
View rule history
editFor better observability and monitoring of your rules, Kibana now displays the execution history of your rules and actions. You can customize the history view to include granular information with an array of impactful data points, including the underlying alerting query durations, the number of actions that were triggered or errored, alert context, rule execution timeouts, and more.
Configure rules
editAlerting introduces configurable guardrails so that as an admin, you can apply your policies on a level deeper than role-based access control (RBAC) and fully stay on top of the stress that the alerting system may put on your instance, in case your users misconfigured rules. This way you have peace of mind that your instance remains performant.
Specifically, in the kibana.yml
file:
-
Configure your rule queries to timeout after a custom time expires without the
query returning. You can also do this on a per rule type basis with the
xpack.alerting.run.timeout
setting. -
Configure a minimum value for the interval with which your rules run with the
xpack.alerting.rules.minimumScheduleInterval.value
setting. Strictly enforce the minimum interval or just display warnings on the UI with thexpack.alerting.rules.minimumScheduleInterval.enforce
setting. -
Configure the maximum number of actions that a rule can generate with the
xpack.alerting.rules.run.actions.max
setting. Specify a different cap for your different rule types with thexpack.alerting.rules.run.ruleTypeOverrides
setting, depending on your needs.
For more information, refer to Action settings.
New xMatters connector
editWith the new xMatters connector, you can configure the severity of a rule and assign it tags, so the right resources are notified to take action on the corresponding incidents. With the xMatters action, you can leverage schedules and escalations to engage with the right resources. The xMatters connector supports Basic and URL authentication.
Cases now in the Stack (technical preview)
editThis release brings Cases into the Stack, so that you can open and track issues outside Elastic Solutions. Access Cases in Stack Management under Alerts and Insights. For more information, check Cases.
Machine learning
editTesting trained models in Kibana
editFrom 8.2, users are able to test certain trained models in Kibana. The new action
is introduced under Machine learning > Trained Models and it accepts
user-specified input to test models. Initially supported models are
lang_ident_model_1
(language identification) and third party named entity
recognition (NER) models.
Machine learning trained models are now space-aware
editMachine learning trained models are space-aware starting in 8.2. Spaces enable you to organize your Kibana saved objects into meaningful categories. Once a trained model is limited to a Kibana space, users only see it if they are assigned to the same space. A warning is shown if any trained models are missing their saved objects; automatic synchronization also occurs periodically to address any missing objects.