ELK Stack — Kibana Fundamentals Exercises

11 minute read

Kibana Fundamentals Exercises

These exercises reinforce the concepts covered in this chapter — Discover, KQL/Lucene queries, visualizations, dashboards, and Lens. Work through them sequentially, as each exercise builds on skills from the previous ones.

Prerequisites

Before starting, ensure you have:

  • Elasticsearch running with sample data. If you haven’t loaded sample data yet, go to Kibana Home and click Try sample data → Sample web logs.
  • Kibana accessible at http://localhost:5601.
  • Alternatively, if you have your own log data (from Filebeat or Logstash), you can adapt these exercises to your indices.

Exercise 1: Exploring Data with Discover

Difficulty: ⭐ Beginner

Scenario

You’re a new member of the operations team. Your first task is to familiarize yourself with the log data available in Kibana by creating data views and exploring data in Discover.

Requirements

  1. Create a data view named Web Logs that matches the kibana_sample_data_logs index, using timestamp as the time field.
  2. Open Discover with this data view and set the time range to Last 7 days.
  3. Add the following columns to the document table: clientip, response, request, machine.os.
  4. Find all documents where the response code is 404.
  5. Save the search as 404 Errors - Web Logs.
  6. Use the Field statistics tab to identify which machine.os value generates the most traffic.
  7. Find a 404 error document and view its surrounding documents.
Show Solution

Step 1: Create the data view

  1. Open Kibana → Menu (☰) → Analytics → Discover.
  2. Click the data view dropdown → Create a data view.
  3. Name: Web Logs.
  4. Index pattern: kibana_sample_data_logs.
  5. Timestamp field: timestamp.
  6. Click Save data view to Kibana.

Step 2: Set time range and add columns

  1. In Discover, make sure Web Logs is selected as the data view.
  2. Click the time picker (top-right) → select Last 7 days → click Apply.
  3. In the field browser (left sidebar), find clientip and click the + button to add it as a column.
  4. Repeat for response, request, and machine.os.
  5. You should now see a table with these four columns plus the timestamp.

Step 3: Filter for 404 errors

  1. In the query bar, type: response: 404
  2. Press Enter or click Update.
  3. The document table now shows only documents with a 404 response code.

Step 4: Save the search

  1. Click Save in the top toolbar.
  2. Name: 404 Errors - Web Logs.
  3. Click Save.

Step 5: Field statistics

  1. Clear the query bar (remove response: 404) and press Enter.
  2. Click the Field statistics tab.
  3. Find machine.os — it shows a distribution bar with the top values and their percentages.
  4. The OS with the highest percentage is the one generating the most traffic.

Step 6: Surrounding documents

  1. Go back to the Documents tab.
  2. Add the filter back: response: 404.
  3. Click the > expand arrow on any 404 document.
  4. Click View surrounding documents.
  5. You can see what requests happened before and after the 404, which helps understand the user’s journey.

Exercise 2: Writing KQL and Lucene Queries

Difficulty: ⭐⭐ Intermediate

Scenario

The security team has asked you to investigate suspicious traffic patterns. You need to write queries to find specific log entries in the web logs data.

Requirements

  1. Using KQL, find all requests from IP addresses starting with 176. that resulted in a 503 response.
  2. Using KQL, find all GET requests to URLs containing /kibana where the response time (bytes) is greater than 5000.
  3. Using KQL, find all documents where the geo.dest field is either CN or IN and the response is not 200.
  4. Switch to Lucene and find all documents where the url field contains a path with “elasticsearch” (use a fuzzy match to also catch typos like “elasticsarch”).
  5. Using Lucene, find documents where “error” and “memory” appear within 3 words of each other in the message field.
  6. Save a query named Suspicious 503s for the query from requirement 1.
Show Solution

Requirement 1: KQL — 503 responses from 176.* IPs

  1. Make sure the query language selector shows KQL.
  2. Enter the query:
clientip: 176.* and response: 503
  1. Press Enter. The results show all 503 errors from IP addresses starting with 176.

Requirement 2: KQL — GET requests to /kibana with large responses

request: *kibana* and bytes > 5000

Note: The sample data uses bytes for response size. If your data has a method field, you can add method: "GET".

Requirement 3: KQL — Traffic from CN or IN with non-200 responses

(geo.dest: "CN" or geo.dest: "IN") and not response: 200

Requirement 4: Lucene — Fuzzy match for “elasticsearch”

  1. Click the KQL button in the query bar → select Lucene.
  2. Enter the query:
url:elasticsearch~2

This uses fuzzy matching with an edit distance of 2, catching variations like “elasticsarch” or “elasticserch”.

Requirement 5: Lucene — Proximity search

message:"error memory"~3

This finds documents where “error” and “memory” appear within 3 words of each other.

Note: The sample web logs may not have a message field with these terms. If you’re using your own application logs, this works well. With sample data, try:

url:"elasticsearch kibana"~5

Requirement 6: Save a query

  1. Switch back to KQL and enter: clientip: 176.* and response: 503
  2. Click the bookmark icon (💾) next to the query bar.
  3. Click Save current query.
  4. Name: Suspicious 503s.
  5. Check Include filters and Include time range if desired.
  6. Click Save.

Exercise 3: Building Visualizations

Difficulty: ⭐⭐ Intermediate

Scenario

The product team wants a set of visualizations to understand web traffic patterns. Create the following visualizations using the Visualize Library (aggregation-based editor).

Requirements

  1. Create a Line chart showing the total number of requests over time (Date Histogram on timestamp, 3-hour interval).
  2. Create a Vertical Bar chart showing the top 10 most requested URLs (request field).
  3. Create a Pie chart showing the distribution of HTTP response codes.
  4. Create a Data Table showing request count by country (geo.src), sorted by count descending, limited to top 15.
  5. Create a Gauge visualization showing the average bytes transferred. Set color ranges: Green (0–5000), Yellow (5000–10000), Red (10000–20000).
  6. Save all visualizations with the naming pattern: [Web Logs] Description — Chart Type.
Show Solution

Visualization 1: Line chart — Request Rate Over Time

  1. Menu → Visualize Library → Create visualization → Line.
  2. Data view: kibana_sample_data_logs.
  3. Metrics (Y-axis): Count (default).
  4. Buckets → Add → X-axis:
    • Aggregation: Date Histogram.
    • Field: timestamp.
    • Minimum interval: 3h.
  5. Click Update (▶).
  6. Save as: [Web Logs] Request Rate Over Time — Line.

Visualization 2: Bar chart — Top 10 URLs

  1. Create visualization → Vertical Bar.
  2. Metrics: Count.
  3. Buckets → Add → X-axis:
    • Aggregation: Terms.
    • Field: request.keyword.
    • Size: 10.
    • Order by: Count descending.
  4. Click Update.
  5. Save as: [Web Logs] Top 10 URLs — Bar.

Visualization 3: Pie chart — Response Code Distribution

  1. Create visualization → Pie.
  2. Metrics: Count (Slice size).
  3. Buckets → Add → Split Slices:
    • Aggregation: Terms.
    • Field: response.keyword.
    • Size: 10.
  4. Click Update.
  5. Save as: [Web Logs] Response Code Distribution — Pie.

Visualization 4: Data Table — Requests by Country

  1. Create visualization → Data Table.
  2. Metrics: Count.
  3. Buckets → Add → Split Rows:
    • Aggregation: Terms.
    • Field: geo.src.
    • Size: 15.
    • Order by: Count descending.
  4. Click Update.
  5. Save as: [Web Logs] Requests by Country — Table.

Visualization 5: Gauge — Avg Bytes

  1. Create visualization → Gauge.
  2. Metrics: Average on field bytes.
  3. Under Options → Ranges:
    • 0 to 5000 (Green).
    • 5000 to 10000 (Yellow).
    • 10000 to 20000 (Red).
  4. Click Update.
  5. Save as: [Web Logs] Avg Bytes Transferred — Gauge.

Exercise 4: Creating a Dashboard

Difficulty: ⭐⭐⭐ Advanced

Scenario

Build a comprehensive web traffic monitoring dashboard using the visualizations created in Exercise 3 and the saved search from Exercise 1.

Requirements

  1. Create a new dashboard named Web Traffic Monitoring.
  2. Add a Markdown panel at the top with the dashboard title, description, and last updated date.
  3. Add Controls — an Options List dropdown for geo.src (source country) and another for response (status code).
  4. Add all five visualizations from Exercise 3.
  5. Add the saved search 404 Errors - Web Logs from Exercise 1.
  6. Arrange the panels in a logical layout:
    • Row 1: Markdown header (full width).
    • Row 2: Controls (full width).
    • Row 3: Request Rate (line) and Response Code Distribution (pie) — side by side.
    • Row 4: Top URLs (bar) and Requests by Country (table) — side by side.
    • Row 5: Avg Bytes gauge (1/3 width) — centered.
    • Row 6: 404 Errors saved search (full width).
  7. Set the dashboard time range to Last 7 days and enable auto-refresh every 30 seconds.
  8. Save the dashboard.
Show Solution

Step 1: Create the dashboard

  1. Menu → Analytics → Dashboard → Create dashboard.

Step 2: Add Markdown header

  1. Click Add panel → Create visualization.
  2. Choose Markdown (legacy) or Text.
  3. Enter:
## Web Traffic Monitoring Dashboard

**Data Source:** Kibana Sample Web Logs
**Owner:** Operations Team
**Updated:** 2026-04-01

---
  1. Click Save and return.
  2. Drag the panel to the top and stretch it to full width.

Step 3: Add Controls

  1. Click Add panel → Controls.
  2. Click Add control:
    • Data view: Web Logs (or kibana_sample_data_logs).
    • Field: geo.src.
    • Type: Options List.
  3. Click Add control again:
    • Field: response.
    • Type: Options List.
  4. Click Save and return.
  5. Position the controls panel below the header.

Step 4: Add visualizations

  1. Click Add panel → Add from library.
  2. Search for [Web Logs] to find all five visualizations.
  3. Click each one to add it:
    • [Web Logs] Request Rate Over Time — Line
    • [Web Logs] Response Code Distribution — Pie
    • [Web Logs] Top 10 URLs — Bar
    • [Web Logs] Requests by Country — Table
    • [Web Logs] Avg Bytes Transferred — Gauge

Step 5: Add saved search

  1. Click Add panel → Add from library.
  2. Search for 404 Errors - Web Logs.
  3. Click to add it.

Step 6: Arrange panels

  1. Drag and resize panels:
    • Line chart and Pie chart side by side (each ~50% width).
    • Bar chart and Table side by side (each ~50% width).
    • Gauge centered, smaller width (~33%).
    • Saved search panel full width at the bottom.

Step 7: Set time range and auto-refresh

  1. Click the time picker → select Last 7 days.
  2. Click the auto-refresh clock icon → set interval to 30 seconds → click Start.

Step 8: Save the dashboard

  1. Click Save.
  2. Name: Web Traffic Monitoring.
  3. Click Save.

Exercise 5: Building a Lens Visualization

Difficulty: ⭐⭐⭐ Advanced

Scenario

The engineering manager wants a single Lens visualization that shows the error rate percentage over time, broken down by operating system. The error rate is defined as: (count of responses >= 400) / (total count) × 100.

Requirements

  1. Open Lens from the Visualize Library.
  2. Select the kibana_sample_data_logs data view (or your Web Logs data view).
  3. Set the time range to Last 7 days.
  4. Create a Line chart with:
    • Horizontal axis: timestamp with an auto interval.
    • Vertical axis: a formula that calculates error rate percentage.
    • Break down by: machine.os.keyword (top 5).
  5. The formula should be: count(kql='response >= 400') / count() * 100.
  6. Format the vertical axis as a percentage (or include “%” in the label).
  7. Save the visualization as [Web Logs] Error Rate by OS Over Time — Lens Line.
  8. Add this visualization to the Web Traffic Monitoring dashboard.
  9. Create a runtime field called response_category that categorizes responses:
    • 200–299 → “2xx Success”
    • 300–399 → “3xx Redirect”
    • 400–499 → “4xx Client Error”
    • 500–599 → “5xx Server Error”
  10. Create a Donut chart using the runtime field showing the distribution of response categories. Save it as [Web Logs] Response Categories — Lens Donut.
Show Solution

Steps 1–2: Open Lens

  1. Menu → Visualize Library → Create visualization → Lens.
  2. Data view: kibana_sample_data_logs (or Web Logs).
  3. Time picker: Last 7 days.

Steps 3–6: Create the error rate line chart

  1. The chart type selector should show Line (click it to switch if needed).
  2. Drag timestamp to the Horizontal axis zone.
  3. Click the Vertical axis zone.
  4. In the configuration panel, switch from a simple aggregation to Formula.
  5. Enter the formula:
count(kql='response >= 400') / count() * 100
  1. Set the label to: Error Rate (%).
  2. Under format, choose Number and set decimal places to 2.
  3. Close the metric config.
  4. Drag machine.os.keyword to the Break down by zone.
    • Set the number of values to 5.
  5. The chart now shows error rate percentage over time, with a separate line for each OS.

Step 7: Save the visualization

  1. Click Save → name: [Web Logs] Error Rate by OS Over Time — Lens Line.
  2. Click Save.

Step 8: Add to dashboard

  1. Open the Web Traffic Monitoring dashboard.
  2. Click Edit to enter edit mode.
  3. Click Add panel → Add from library.
  4. Search for [Web Logs] Error Rate by OS Over Time — Lens Line.
  5. Click to add it. Position it in the layout.
  6. Click Save to save the dashboard.

Step 9: Create a runtime field

  1. Go back to Lens → Create visualization.
  2. In the field list (left sidebar), click Create field.
  3. Name: response_category.
  4. Type: Keyword.
  5. Script:
def code = doc['response.keyword'].value;
if (code == '200' || code == '201' || code == '204') {
  emit('2xx Success');
} else if (code == '301' || code == '302' || code == '304') {
  emit('3xx Redirect');
} else if (code == '404' || code == '403' || code == '400') {
  emit('4xx Client Error');
} else if (code == '500' || code == '502' || code == '503') {
  emit('5xx Server Error');
} else {
  emit('Other');
}

Note: Depending on your data, you may need to handle the field as a number rather than a keyword. If response is a numeric field:

def code = (int)doc['response'].value;
if (code >= 200 && code < 300) {
  emit('2xx Success');
} else if (code >= 300 && code < 400) {
  emit('3xx Redirect');
} else if (code >= 400 && code < 500) {
  emit('4xx Client Error');
} else if (code >= 500 && code < 600) {
  emit('5xx Server Error');
} else {
  emit('Other');
}
  1. Click Save.

Step 10: Create the donut chart

  1. Click the chart type selector → choose Donut.
  2. Drag the new response_category field to the Slice by zone.
  3. The donut chart shows the distribution of 2xx, 3xx, 4xx, and 5xx responses.
  4. Save as: [Web Logs] Response Categories — Lens Donut.

Summary

After completing these exercises, you can:

  • Create data views and explore data interactively in Discover.
  • Write KQL and Lucene queries for precise filtering.
  • Build various visualization types — line, bar, pie, table, gauge, metric.
  • Assemble visualizations into interactive dashboards with controls and filters.
  • Use Lens to quickly build visualizations with formulas and runtime fields.

Back to: Kibana Fundamentals — Chapter overview and navigation.

You may also enjoy