ELK Stack — Kibana Fundamentals

2 minute read

Kibana Fundamentals

Kibana is the visualization and management layer of the Elastic Stack. It provides a browser-based interface for searching, viewing, and interacting with data stored in Elasticsearch. From real-time log exploration to building executive dashboards, Kibana transforms raw indexed data into actionable insights.

Kibana serves multiple roles in the Elastic Stack:

  • Data Exploration — Search and filter documents interactively with Discover.
  • Visualization — Build charts, gauges, maps, and tables from Elasticsearch aggregations.
  • Dashboarding — Combine visualizations into unified monitoring screens.
  • Management — Configure index lifecycle policies, security roles, and cluster settings.
  • Observability — Correlate logs, metrics, and traces in one interface.

This chapter focuses on the core Kibana skills every ELK Stack practitioner needs — exploring data, writing queries, building visualizations, and assembling dashboards.

What You’ll Learn

  • Navigate the Discover page to explore and filter log data interactively.
  • Write queries using KQL (Kibana Query Language) and Lucene syntax.
  • Create aggregation-based visualizations — bar charts, line graphs, pie charts, data tables, and more.
  • Build and share dashboards that combine multiple visualizations into a single view.
  • Use Lens, Kibana’s drag-and-drop visualization editor, for rapid chart creation.
  • Apply best practices for organizing saved objects, naming conventions, and dashboard design.

Chapter Contents

  1. Discover — Explore indexed data, create data views, filter documents, and save searches.
  2. KQL and Lucene — Master Kibana’s two query languages for precise data filtering.
  3. Visualizations — Create charts, tables, gauges, and time-series panels from Elasticsearch aggregations.
  4. Dashboards — Assemble visualizations into interactive monitoring dashboards.
  5. Lens — Build visualizations quickly with Kibana’s drag-and-drop editor.
  6. Practice Exercises — Hands-on exercises covering Discover, queries, visualizations, dashboards, and Lens.

Prerequisites

Before starting this chapter, make sure you have:

  • A running Elasticsearch cluster with sample data or ingested logs (see earlier chapters).
  • Kibana installed and accessible at http://localhost:5601.
  • Basic familiarity with Elasticsearch indices and documents.

How Kibana Connects to Elasticsearch

Kibana communicates with Elasticsearch through its REST API. Every search, visualization, and dashboard ultimately translates into one or more Elasticsearch queries. When you type a KQL query in Discover or build a bar chart, Kibana constructs the appropriate _search request behind the scenes.

The connection is configured in kibana.yml:

elasticsearch.hosts: ["http://localhost:9200"]
elasticsearch.username: "kibana_system"
elasticsearch.password: "changeme"

Understanding this relationship is important — Kibana’s performance and capabilities are directly tied to the data and aggregations available in Elasticsearch.

Kibana Spaces

Kibana supports Spaces, which let you organize saved objects (dashboards, visualizations, saved searches) into separate working areas. For example, you might create:

  • A Logs space for operations teams.
  • A Security space for the SOC team.
  • A Business space for analytics dashboards.

Each space has its own set of saved objects and can be access-controlled with Kibana’s role-based security.

Let’s begin with Discover to learn how to explore your data interactively.

You may also enjoy