Kibana concepts

Learn the shared concepts for analyzing and visualizing your data

As an analyst, you will use a combination of Kibana apps to analyze and visualize your data. Kibana contains both general-purpose apps and apps for the Enterprise Search, Elastic Observability, and Elastic Security solutions. These apps share a common set of concepts.

You don’t need to know everything about Elasticsearch to use Kibana, but the most important concepts follow:

Kibana offers a global search bar on every page that you can use to find any app or saved object. Open the search bar using the keyboard shortcut Ctrl+/ on Windows and Linux, Command+/ on MacOS.

Kibana requires an index pattern to tell it which Elasticsearch data you want to access, and whether the data is time-based. An index pattern can point to one or more Elasticsearch data streams, indices, or index aliases by name. For example, logs-elasticsearch-prod-* is an index pattern, and it is time-based with a time field of @timestamp. The time field is not editable.

Index patterns are typically created by an administrator when sending data to Elasticsearch. You can create or update index patterns in Stack Management, or by using a script that accesses the Kibana API.

Kibana uses the index pattern to show you a list of fields, such as event.duration. You can customize the display name and format for each field. For example, you can tell Kibana to display event.duration in seconds. Kibana has field formatters for strings, dates, geopoints, and numbers.

Kibana provides you several ways to build search queries, which will reduce the number of document matches that you get from Elasticsearch. Each app in Kibana provides a time filter, and most apps also include semi-structured search and extra filters.

If you frequently use any of the search options, you can click the save query icon next to the semi-structured search to save or load a previously saved query. The saved query will always contain the semi-structured search query, and can optionally contain the time filter and extra filters.

The global time filter limits the time range of data displayed. In most cases, the time filter applies to the time field in the index pattern, but some apps allow you to use a different time field.

Using the time filter, you can configure a refresh rate to periodically resubmit your searches. You can also click Refresh to resubmit the search. This might be useful if you use Kibana to monitor the underlying data.

Combine free text search with field-based search using the Kibana Query Language (KQL). Type a search term to match across all fields, or start typing a field name to get suggestions for field names and operators that you can use to build a structured query. The semi-structured search will filter documents for matches, and only return matching documents.

Following are some example KQL queries. For more detailed examples, refer to Kibana Query Language.

Beginning in 7.14, Kibana uses the terms enum API for autocomplete. Kibana returns results faster, but suggestions are approximate, sorted alphabetically, and can be outside the selected time range, even if autocomplete:useTimeFilter is enabled (as the terms enum API applies time filtering on an index-level, rather than document-level).

Previously, Kibana used the terms aggregation API, which is slower, but suggestions included all values that matched your query, and optionally, your time range, and were sorted by popularity. To revert to using the terms aggregation API, go to Advanced Settings, and set autocomplete:valueSuggestionMethod to terms_agg.

Structured filters are a more interactive way to create Elasticsearch queries, and are commonly used when building dashboards that are shared by multiple analysts. Each filter can be disabled, inverted, or pinned across all apps. The structured filters are the only way to use the Elasticsearch Query DSL in JSON form, or to target a specific index pattern for filtering. Each of the structured filters is combined with AND logic on the rest of the query.

Kibana lets you save objects for your own future use or for sharing with others. Each saved object type has different abilities. For example, you can save your search queries made with Discover, which lets you:

For organization, every saved object can have a name, tags, and type. Use the global search to quickly open a saved object.