WARNING: Version 5.4 of the Elastic Stack has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Graphing Connections in Your Data Configuring Graph »
Elastic Docs ›X-Pack for the Elastic Stack [5.4] ›Graphing Connections in Your Data

Getting Started

edit

Getting Started

edit

Graph is automatically enabled when you install X-Pack into Elasticsearch and Kibana.

To start exploring connections in your data:

  1. Open Kibana in your web browser and log in. If you are running Kibana locally, go to http://localhost:5601/.

  2. Click Graph in the side navigation to open the graph explorer.

    Accessing Graph
  3. Select an index pattern to specify what indices you want to explore. For example, if you are indexing log data with Logstash, you could select the logstash-* index pattern to visualize connections within the log entries.
  4. Select one or more multi-value fields that contain the terms you want to graph. The vertices in the graph are selected from these terms. If you’re visualizing connections between Apache log entries, you could select the url.raw field and the geo.src field so you can look at which pages are being accessed from different locations.

  5. Enter a search query to discover relationships between terms in the selected fields. For example, to generate a graph of the successful requests to particular pages from different locations, you could search for the 200 response code:

    URL connections

The weight of the connection between two vertices indicates how strongly they are related. You can click any connection to view more information about the relationship:

Link summary

Once you have your initial graph, you can use the toolbar buttons to explore additional connections. Click the Expand button Expand Selection to display additional vertices that connect to your graph. Click the Link button Add links to existing terms to display additional connections between the displayed vertices. To explore a particular area of the graph, select the vertices you are interested in and click the Expand or Link button. To step back through your changes to the graph, click the Undo button Undo.

To see more relationships within your data, you can submit additional queries.

Adding networks

By default, when you submit a search query Graph searches all available fields. You can constrain your search to a particular field using the Lucene query syntax. For example, machine.os: osx.

« Graphing Connections in Your Data Configuring Graph »