ELK Stack — Dashboards

7 minute read

Dashboards

Dashboards bring multiple visualizations, saved searches, and controls together into a single interactive view. They are the primary way teams consume data in Kibana — operations teams monitor infrastructure health, security teams watch for threats, and developers track application performance, all through dashboards.

Creating a Dashboard

Step-by-Step: Create a New Dashboard

  1. Click the hamburger menu (☰) → Analytics → Dashboard.
  2. Click Create dashboard.
  3. An empty dashboard canvas opens with the editing toolbar at the top.
  4. The dashboard is now in edit mode — you can add panels, rearrange them, and configure settings.

Adding Visualizations and Saved Searches

Adding from the Visualize Library

  1. In the dashboard editor, click Add panel in the toolbar.
  2. Select Add from library.
  3. Browse or search for saved visualizations and saved searches.
  4. Click on a visualization to add it to the dashboard. It appears as a panel on the canvas.
  5. Repeat to add more panels.

Creating a New Visualization Inline

  1. Click Add panel → Create visualization.
  2. This opens the Lens editor (or the legacy visualization editor) directly within the dashboard context.
  3. Build your visualization and click Save and return to add it to the dashboard.

Adding a Saved Search Panel

  1. Click Add panel → Add from library.
  2. Search for a saved search (e.g., Production Errors - Last 24h).
  3. The saved search appears as a document table panel on the dashboard, showing matching log entries.

Dashboard Controls

Time Picker

The dashboard time picker (top-right) controls the time range for all panels simultaneously. Changing the time range updates every visualization and saved search on the dashboard.

Query Bar

The query bar at the top of the dashboard lets you apply a KQL or Lucene query across all panels. For example:

service.name: "payment-service"

This filters every panel to show only data from the payment service.

Filter Pills

Filter pills appear below the query bar. You can:

  1. Add a filter — Click + Add filter, select a field, operator, and value.
  2. Toggle a filter — Click a filter pill to temporarily disable it (it turns grey).
  3. Pin a filter — Click the pin icon on a filter pill. Pinned filters persist when you navigate to other dashboards or Discover.
  4. Invert a filter — Click the pencil icon on a filter and toggle Include/Exclude.
  5. Remove a filter — Click the × on the filter pill.

Dashboard-Level Filters

Dashboard-level filters are filters applied to the dashboard itself, affecting all panels. They are different from visualization-level filters, which only affect a single panel.

Adding Dashboard Controls

Kibana supports interactive Controls panels that let dashboard viewers filter data dynamically:

  1. Click Add panel → Controls.
  2. Choose Options List — creates a dropdown for selecting field values.
  3. Configure:
    • Data view: app-logs-*
    • Field: service.name
  4. Click Save and return.
  5. The control appears as a dropdown on the dashboard. Viewers can select a service to filter all panels.

You can add multiple controls — for example, a dropdown for service.name, another for log.level, and another for environment.

Drilldowns

Drilldowns let users click on a panel element (like a bar in a chart) and navigate to another dashboard, Discover, or a URL with context from the click.

Creating a Drilldown

  1. In the dashboard editor, click the gear icon on a panel.
  2. Select Create drilldown.
  3. Choose the drilldown type:
    • Go to Dashboard — Navigate to another dashboard with the clicked value as a filter.
    • Go to URL — Open an external URL with dynamic parameters.
  4. Configure the target and click Save.

Example: Drilldown from Service Overview to Service Detail

  1. On a “Top Services by Error Count” bar chart panel, create a drilldown.
  2. Type: Go to Dashboard.
  3. Target: “Service Detail Dashboard”.
  4. The drilldown passes the clicked service name as a filter to the target dashboard.
  5. Now, when a viewer clicks a bar for “payment-service”, they’re taken to the Service Detail Dashboard pre-filtered for that service.

Arranging Panels

Resizing

  1. Hover over the bottom-right corner of any panel until a resize handle appears.
  2. Click and drag to resize the panel.

Moving

  1. Hover over the panel header (the title area).
  2. Click and drag the panel to a new position on the canvas.
  3. Other panels automatically rearrange to accommodate the move.

Panel Options

Click the gear icon (⚙) on any panel to access:

  • Edit visualization — Open the visualization editor.
  • Clone panel — Duplicate the panel on the same dashboard.
  • Remove from dashboard — Delete the panel from this dashboard.
  • Edit panel title — Override the default title with a custom one.
  • More — Additional options like Inspect (view the raw Elasticsearch request/response).

Markdown Panel for Annotations

You can add text annotations to your dashboards using the Markdown panel.

Adding a Markdown Panel

  1. Click Add panel → Create visualization.
  2. Choose Markdown (in legacy visualizations) or use a Text panel.
  3. Enter your markdown content:
## Log Monitoring Dashboard

**Team:** Platform Engineering
**Data Source:** Application logs from all production services
**Refresh:** Auto-refresh every 30 seconds

### Alert Thresholds
- 🟢 Normal: Error rate < 1%
- 🟡 Warning: Error rate 1–5%
- 🔴 Critical: Error rate > 5%
  1. Click Save and return.
  2. Position the markdown panel at the top of the dashboard as a header.

Building a Complete Log Monitoring Dashboard

Here’s a step-by-step guide to building a production-ready log monitoring dashboard:

Panel Layout Plan

Row Panel Type Width
1 Dashboard Header (Markdown) Markdown Full width
1 Controls (service, level) Controls Full width
2 Total Requests (Metric) Metric 1/4
2 Total Errors (Metric) Metric 1/4
2 Avg Response Time (Metric) Metric 1/4
2 Error Rate % (Metric) Metric 1/4
3 Request Rate Over Time (Line) Line Chart 1/2
3 Error Rate Over Time (Line) Line Chart 1/2
4 Errors by Service (Bar) Bar Chart 1/2
4 Status Code Distribution (Pie) Pie Chart 1/2
5 Top Error Messages (Table) Data Table Full width
6 Recent Error Logs (Saved Search) Saved Search Full width

Step-by-Step Build

  1. Create the dashboard — Menu → Dashboard → Create dashboard.
  2. Add the markdown header — Add panel → Markdown. Enter dashboard title and description.
  3. Add controls — Add panel → Controls → Options List for service.name and log.level.
  4. Add metric panels — For each metric (Total Requests, Total Errors, Avg Response Time), add a metric visualization from the library or create inline with Lens.
  5. Add the request rate line chart — Add from library or create: Count over Date Histogram on @timestamp.
  6. Add the error rate line chart — Same as above but with filter log.level: "ERROR".
  7. Add errors by service bar chart — Count with Terms bucket on service.name, filtered to errors.
  8. Add status code pie chart — Count with Terms bucket on http.response.status_code.
  9. Add error messages data table — Count with Terms bucket on error.message.
  10. Add recent error logs — Add from library → select your “Production Errors” saved search.
  11. Arrange panels — Drag and resize panels to match the layout plan.
  12. Save the dashboard — Click Save, enter the name “Log Monitoring Dashboard”.

Cloning Dashboards

To create a copy of an existing dashboard:

  1. Open the dashboard you want to clone.
  2. Click the Save button in the toolbar.
  3. Enter a new name (e.g., “Log Monitoring Dashboard — Staging”).
  4. Check Save as new dashboard.
  5. Click Save.

The cloned dashboard is independent — changes to one don’t affect the other.

Sharing Dashboards

  1. Click Share in the dashboard toolbar.
  2. Click Copy link → the URL is copied to your clipboard.
  3. Anyone with Kibana access can use this link to view the dashboard.

Embed as Iframe

  1. Click Share → Embed code.
  2. Copy the generated <iframe> HTML snippet.
  3. Paste it into a wiki page, internal portal, or web application.

PDF/PNG Reports

  1. Click Share → PDF Reports or PNG Reports.
  2. Click Generate report.
  3. Kibana generates a downloadable PDF or PNG of the dashboard.
  4. This is useful for sending to stakeholders who don’t have Kibana access.

Note: PDF/PNG reports require a Platinum or Enterprise license.

Dashboard-Only Mode

For viewing dashboards without the full Kibana navigation:

  1. Navigate to Stack Management → Kibana → Spaces.
  2. Edit a space and set Disabled features to hide everything except Dashboards.
  3. Users in this space see only the dashboard interface — no Discover, Visualize Library, or management tools.

This is ideal for creating a read-only monitoring view for operations teams.

Quick Reference

Task How To
Create dashboard Menu → Dashboard → Create dashboard
Add a panel Click Add panel → Add from library or Create visualization
Add controls Add panel → Controls → Options List
Apply dashboard query Type in the query bar at the top
Add a filter Click + Add filter below the query bar
Create drilldown Panel gear icon → Create drilldown
Clone dashboard Save → new name → check Save as new dashboard
Share link Click Share → Copy link
Export PDF Click Share → PDF Reports → Generate
Add markdown Add panel → Create visualization → Markdown

Next: Lens — Build visualizations quickly with Kibana’s drag-and-drop editor.

You may also enjoy