ELK Stack — Canvas and Maps

6 minute read

Introduction

While standard Kibana dashboards are great for interactive data exploration, two specialized apps unlock additional use cases:

  • Canvas — pixel-perfect, presentation-ready infographics powered by live Elasticsearch data. Think executive status boards on wall-mounted monitors.
  • Maps — geospatial visualizations with multiple layer types for tracking assets, plotting user locations, or mapping attack origins.

This section covers both tools in depth, from basic workpad creation to advanced Canvas expressions and multi-layer maps.

Canvas

What is Canvas?

Canvas is Kibana’s data-driven presentation tool. Unlike dashboards, Canvas gives you:

  • Pixel-level control over layout and styling
  • Custom expressions language for transforming data
  • Auto-refresh for live status boards
  • PDF export for executive reports

Canvas Concepts

Concept Description
Workpad The top-level container (like a slide deck)
Page A single slide within a workpad
Element A visual component on a page (chart, metric, image, text)
Expression A pipe-delimited data pipeline powering each element
Data source Where the element pulls data — Elasticsearch, Timelion, or static

Creating a Workpad

  1. Open Canvas from the Kibana side navigation
  2. Click Create workpad
  3. Set the workpad name — e.g., Platform Status Board
  4. Adjust the page size (default is 1080×720; use 1920×1080 for wall displays)
  5. Set the background color — dark themes work well on monitors

Adding Elements

  1. Click Add element on the toolbar
  2. Choose an element type:
    • Metric — single KPI number with label
    • Area chart / Line chart / Bar chart — standard visualizations
    • Data table — tabular data display
    • Image — logo or static graphic (URL or upload)
    • Shape — decorative rectangles, circles, progress bars
    • Markdown — rich text with live data interpolation
    • Progress bar / Gauge — visual indicators
  3. Position and resize the element by dragging
  4. Configure the data source in the right-hand panel

Canvas Data Sources

Source Use Case
Elasticsearch SQL Query with SQL syntax
Elasticsearch raw documents Pull specific documents
Timelion Time-series expressions
Static data (demo data) Prototyping and mockups

Example — Elasticsearch SQL data source:

  1. Select the metric element
  2. In the right panel, click Data → Elasticsearch SQL
  3. Enter the query:
SELECT COUNT(*) AS total_errors
FROM "logs-*"
WHERE log.level = 'ERROR'
  AND @timestamp > NOW() - INTERVAL 1 HOUR
  1. Map the result column to the element’s display value

Canvas Expressions

Every Canvas element is powered by an expression — a pipe-delimited chain of functions. You can view and edit the expression directly.

Example — Metric element expression:

filters
| essql query="SELECT COUNT(*) AS errors FROM \"logs-*\" WHERE log.level = 'ERROR' AND @timestamp > NOW() - INTERVAL 1 HOUR"
| math "errors"
| metric "Errors (Last Hour)"
  metricFont={font size=48 family="'Open Sans', Helvetica, Arial, sans-serif" color="#FF4136" align="center"}
  labelFont={font size=14 family="'Open Sans', Helvetica, Arial, sans-serif" color="#AAAAAA" align="center"}
| render

Common Canvas Functions

Function Purpose
filters Apply workpad-level time and dropdown filters
essql Query Elasticsearch with SQL
esdocs Fetch raw Elasticsearch documents
math Evaluate math expressions on data
metric Render a single metric value
plot Render charts (line, bar, area)
markdown Render markdown text
shape Draw a geometric shape
image Display an image from URL or asset
render Final rendering step
if Conditional logic
mapColumn Transform column values
formatnumber Format numbers with patterns

Auto-Refresh and Full Screen

For live status boards:

  1. Click the clock icon in the workpad toolbar
  2. Set the refresh interval (e.g., 30 seconds)
  3. Click Full screen (View → Full screen or F11)

The workpad will continuously refresh and display updated data.

Real-World Canvas Use Case — Executive Status Board

A platform team creates a Canvas workpad displayed on a wall-mounted monitor in the operations center:

  • Page 1: System health — uptime metrics, error rates, P99 latency
  • Page 2: Deployment tracker — recent deployments with status indicators
  • Page 3: Business KPIs — orders per minute, revenue trend, active users

Each page auto-cycles every 30 seconds using Canvas page transitions.

Maps

What is Kibana Maps?

Kibana Maps is a geospatial visualization tool that supports multiple layer types, GeoJSON imports, and spatial queries. Use Maps when your data has geographic coordinates (latitude/longitude) or geo-shape fields.

Creating a Map

  1. Open Maps from the Kibana side navigation
  2. Click Create map
  3. Click Add layer to add your first data layer
  4. Choose a layer type (see below)
  5. Configure the layer settings
  6. Click Save to add the layer
  7. Repeat for additional layers

Map Layer Types

Documents Layer

Plots individual documents as points on the map.

  1. Click Add layer → Documents
  2. Select the data view — e.g., web-logs-*
  3. Choose the geo field — e.g., client.geo.location
  4. Configure tooltips to show on hover (add fields like client.ip, url.path)
  5. Set symbol size and color by a metric (e.g., color by http.response.status_code)

Clusters and Grid Layer

Aggregates documents into geo-tile clusters — ideal for large datasets.

  1. Click Add layer → Clusters and grid
  2. Select the data view and geo field
  3. Choose grid type: clusters (circles), grid (rectangles), or hex bins
  4. Configure the metric — count, sum, average, etc.
  5. Adjust grid resolution (coarse, fine, or exact)

Heat Map Layer

Visualizes density as a color gradient.

  1. Click Add layer → Heat map
  2. Select the data view and geo field
  3. Adjust radius and intensity settings
  4. Choose a color ramp (Yellows to Reds is common)

Tile Map Layer (EMS Basemaps)

Kibana includes Elastic Maps Service (EMS) basemaps — road maps, dark theme, and satellite imagery.

  1. By default, a basemap layer is included
  2. Click the basemap layer to switch between styles:
    • Road map — standard map with labels
    • Road map (dark) — dark theme for status boards
    • Auto — switches based on Kibana theme

Importing GeoJSON

You can upload custom geographic boundaries (country borders, sales territories, office zones):

  1. Open Maps → Add layer → Upload GeoJSON
  2. Drag and drop your .geojson file
  3. Kibana indexes the shapes into a new Elasticsearch index
  4. Name the index (e.g., sales-territories)
  5. The layer is added to your map automatically

Use case: Upload office building floor plans as GeoJSON polygons, then overlay IoT sensor data to show temperature or occupancy.

Spatial Joins

Spatial joins let you enrich point data with boundary data:

  1. Add a Choropleth layer
  2. Select the boundaries data view (e.g., sales-territories)
  3. Select the boundary field (the geo_shape field)
  4. Select the points data view (e.g., orders-*)
  5. Select the join field and metric

Kibana computes which points fall within which boundaries and displays the result as a shaded boundary map.

Real-World Maps Use Case — Security Operations

A security team uses Kibana Maps to:

  1. Documents layer — plot failed SSH login attempts with source IP geolocation
  2. Heat map layer — overlay to show attack density by region
  3. Choropleth layer — shade countries by total blocked requests
  4. Tooltip — show source IP, username, and timestamp on hover

The map refreshes every 60 seconds and is embedded in a security dashboard.

Quick Reference

Feature Location Key Capability
Canvas workpad Canvas → Create workpad Pixel-perfect live presentations
Canvas expression Element → Expression editor Pipe-delimited data pipeline
Canvas auto-refresh Workpad toolbar → clock icon Set interval for live boards
Maps Maps → Create map Geospatial visualization
Documents layer Maps → Add layer → Documents Plot individual geo points
Clusters layer Maps → Add layer → Clusters Aggregate into grid/hex bins
Heat map layer Maps → Add layer → Heat map Density visualization
GeoJSON upload Maps → Add layer → Upload GeoJSON Custom boundaries
Spatial join Maps → Add layer → Choropleth Enrich points with boundaries

Next: Alerting →

You may also enjoy