ELK Stack — Lens

6 minute read

Lens

Lens is Kibana’s modern drag-and-drop visualization editor. It provides the fastest and most intuitive way to create visualizations without needing to understand the underlying aggregation mechanics. Lens automatically suggests chart types based on your data and lets you switch between visualization types instantly.

Why Lens?

Lens was introduced as a replacement for the legacy aggregation-based visualization editor. Here’s why it’s the recommended approach:

Feature Lens Legacy Visualizations
Interface Drag-and-drop Aggregation configuration forms
Chart type switching Instant — click to switch Must recreate from scratch
Suggestions Yes — recommends chart types No
Formulas Yes — write math expressions Limited (TSVB only)
Learning curve Low Medium to high
Customization depth Good for most use cases Deeper for specialized needs
Runtime fields Supported inline Not supported

When to use Lens: For the majority of visualizations — line charts, bar charts, pie charts, metrics, tables, heatmaps.

When to use legacy or Vega: For specialized visualizations (TSVB with annotations, Vega for custom chart types) or when you need features not yet available in Lens.

Opening Lens

From the Visualize Library

  1. Click the hamburger menu (☰) → Analytics → Visualize Library.
  2. Click Create visualization.
  3. Select Lens (it is usually the default option).

From a Dashboard

  1. Open a dashboard in edit mode.
  2. Click Add panel → Create visualization.
  3. The Lens editor opens directly within the dashboard context.

The Lens Interface

The Lens editor has four main areas:

1. Field List (Left Sidebar)

  • Shows all fields from the selected data view.
  • Fields are grouped by type — timestamps, numbers, keywords, text, geo, etc.
  • Each field shows a small preview icon indicating its type.
  • You can search for fields using the search box at the top.

2. Drag-and-Drop Zones (Center)

  • The chart configuration area where you drag fields to define axes and metrics.
  • Zones vary by chart type:
    • Bar/Line/Area: Horizontal axis, Vertical axis, Break down by.
    • Pie/Donut: Slice by, Size by.
    • Metric: Primary metric, Secondary metric.
    • Table: Columns.

3. Chart Preview (Center)

  • The live preview of your visualization updates as you configure it.
  • Changes are reflected immediately — no need to click “Update”.

4. Suggestions Panel (Right Sidebar)

  • Lens suggests alternative chart types based on your current configuration.
  • Click any suggestion to instantly switch to that chart type.
  • Suggestions help you discover the best way to represent your data.

Creating Visualizations with Lens

Line Chart — Error Rate Over Time

  1. Open Lens (from Visualize Library or a dashboard).
  2. Select the data view — app-logs-*.
  3. From the field list, drag @timestamp to the Horizontal axis zone.
    • Lens automatically applies a Date Histogram aggregation.
  4. The Vertical axis defaults to Count of documents.
  5. To filter to errors only, type in the query bar: log.level: "ERROR".
  6. To break down by service, drag service.name to the Break down by zone.
    • Lens applies a Terms aggregation automatically.
  7. The chart now shows error count over time, broken down by service.
  8. Click Save to save the visualization.

Bar Chart — Top 10 Error-Producing Services

  1. Open Lens and select your data view.
  2. Filter: log.level: "ERROR" in the query bar.
  3. Drag service.name to the Horizontal axis.
  4. The Vertical axis defaults to Count.
  5. Lens renders a vertical bar chart with services on the x-axis and error counts on the y-axis.
  6. Click the chart type selector in the toolbar and switch to Horizontal Bar if you prefer horizontal bars.

Pie Chart — Traffic by Status Code Group

  1. Open Lens and select your data view.
  2. Drag http.response.status_code to the Slice by zone.
  3. Lens creates a pie chart showing the distribution of status codes.
  4. To group by status code ranges (2xx, 3xx, 4xx, 5xx), click the field in the Slice by zone and change the aggregation to Ranges:
    • 200–299 → “2xx Success”
    • 300–399 → “3xx Redirect”
    • 400–499 → “4xx Client Error”
    • 500–599 → “5xx Server Error”

Metric — Average Response Time

  1. Open Lens.
  2. Click the chart type selector and choose Metric.
  3. Drag event.duration to the Primary metric zone.
  4. Click the field configuration and change the aggregation from Median to Average.
  5. The metric panel shows a single large number — the average response time.
  6. Optionally, add @timestamp as a Secondary metric to show the time range.

Data Table — Top Error Messages with Count

  1. Open Lens.
  2. Click the chart type selector and choose Table.
  3. Drag error.message to the Columns zone — Lens adds it as a Terms aggregation.
  4. Drag Count (from Metrics) as another column.
  5. Filter: log.level: "ERROR".
  6. The table shows error messages ranked by occurrence count.

Heatmap — Requests by Hour and Day of Week

  1. Open Lens.
  2. Click the chart type selector and choose Heatmap.
  3. Drag @timestamp to the Horizontal axis. Configure the interval to 1 hour.
  4. For the vertical axis, you’ll need a runtime field or a pre-computed day_of_week field.
  5. The Vertical axis shows the grouping, and cell color intensity represents request volume.

Formulas in Lens

Lens supports formulas — mathematical expressions that combine aggregations. This is one of Lens’s most powerful features.

Accessing Formulas

  1. Click on a metric in the Vertical axis zone.
  2. In the configuration panel, switch from a simple aggregation to Formula.
  3. Enter your expression.

Common Formula Examples

Error Rate Percentage:

count(kql='log.level: "ERROR"') / count() * 100

Average Response Time in Seconds (from milliseconds):

average(event.duration) / 1000

Requests Per Second:

count() / 60

(Assuming 1-minute Date Histogram buckets.)

95th Percentile Response Time:

percentile(event.duration, percentile=95)

Ratio of 5xx to Total Requests:

count(kql='http.response.status_code >= 500') / count()

Formula Functions

Lens formulas support these aggregation functions:

Function Description
count() Document count
sum(field) Sum of a numeric field
average(field) Average value
min(field) Minimum value
max(field) Maximum value
median(field) Median value
percentile(field, percentile=N) Nth percentile
unique_count(field) Cardinality (distinct values)
last_value(field) Most recent value
counter_rate(field) Rate of change for counters
differences(metric) Difference between consecutive buckets
moving_average(metric, window=N) Moving average
cumulative_sum(metric) Running total

You can combine these with standard math operators: +, -, *, /, and parentheses.

Runtime Fields in Lens

Runtime fields let you create computed fields on the fly without re-indexing your data.

Creating a Runtime Field in Lens

  1. In the Lens field list, click Create field at the top.
  2. Enter a name — for example, response_time_seconds.
  3. Choose the type — double.
  4. Enter the Painless script:
emit(doc['event.duration'].value / 1000.0)
  1. Click Save.
  2. The new field appears in the field list and can be used like any other field.

Use Cases for Runtime Fields

  • Converting units (milliseconds to seconds, bytes to megabytes).
  • Extracting parts of a field (domain from a URL, hour from a timestamp).
  • Categorizing data (status code groups from raw codes).

Lens Chart Type Selector

You can switch between chart types instantly in Lens. Click the chart type icon in the toolbar to see all available options:

  • Bar (vertical and horizontal)
  • Stacked bar
  • Line
  • Area
  • Stacked area
  • Pie / Donut
  • Treemap
  • Metric
  • Table
  • Heatmap
  • Gauge
  • Mosaic

When you switch types, Lens preserves your field assignments as much as possible. For example, switching from a bar chart to a line chart keeps the same axes and data.

Best Practices

Use Descriptive Titles

When saving Lens visualizations, use names that describe:

  • What is being measured — “Error Count”, “Avg Response Time”.
  • How it’s grouped — “by Service”, “Over Time”.
  • Chart type — “Line”, “Bar”, “Table”.

Example: [Logs] Error Count by Service Over Time — Line

Start with Suggestions

Drag a field to the workspace and look at Lens suggestions. They often reveal insights you wouldn’t have thought to visualize.

Use Formulas for Derived Metrics

Rather than building separate visualizations for numerator and denominator, use formulas to compute rates and percentages directly.

Limit Terms Aggregations

Keep the “Top values” count reasonable (5–20). Too many terms create cluttered, unreadable charts.

Leverage Runtime Fields

Instead of re-indexing data to add computed fields, use runtime fields in Lens for quick transformations.

Quick Reference

Task How To
Open Lens Visualize Library → Create visualization → Lens
Set data view Click the data view dropdown at the top
Add a field to chart Drag from field list to a drop zone
Change chart type Click chart type selector in the toolbar
Add a filter Type a KQL query in the query bar
Use a formula Click a metric zone → switch to Formula
Create runtime field Field list → Create field
Break down by Drag a keyword field to “Break down by” zone
Switch axes Drag fields between horizontal and vertical zones
Save visualization Click Save → enter name → Save

Next: Practice Exercises — Hands-on exercises to reinforce your Kibana skills.

You may also enjoy