ELK Stack — Visualizations

6 minute read

Visualizations

Visualizations are the building blocks of Kibana dashboards. Each visualization represents an Elasticsearch aggregation rendered as a chart, table, gauge, or other visual element. Understanding how to create and configure visualizations is essential for turning raw log data into meaningful insights.

Visualization Types

Kibana offers a wide range of visualization types, each suited to different data representation needs:

Type Best For
Line Trends over time (request rate, error rate)
Area Trends over time with volume emphasis
Bar (Vertical) Comparing categories (errors by service)
Bar (Horizontal) Comparing categories with long labels
Pie Proportional breakdown (traffic by country)
Donut Proportional breakdown (alternative to pie)
Metric Single key number (total errors, avg response time)
Gauge Current value against a threshold (CPU usage)
Data Table Tabular aggregation results
Tag Cloud Word frequency visualization
TSVB Advanced time series with multiple panels
Vega/Vega-Lite Fully custom visualizations
Heatmap Density distribution across two dimensions
Markdown Text annotations and notes on dashboards

Buckets and Metrics — Core Concepts

Every aggregation-based visualization in Kibana is built from two components:

Metrics

Metrics define what you measure — the numerical calculation applied to your data:

  • Count — Number of documents.
  • Sum — Sum of a numeric field.
  • Average — Average of a numeric field.
  • Min / Max — Minimum or maximum value.
  • Unique Count (Cardinality) — Number of distinct values.
  • Percentiles — Distribution percentiles (p50, p95, p99).
  • Top Hit — The most recent or relevant value.

Buckets

Buckets define how you group your data — they split documents into groups:

  • Date Histogram — Group by time intervals (per minute, per hour, per day).
  • Terms — Group by distinct values of a field (top 10 services, top 5 status codes).
  • Range — Group by custom numeric ranges.
  • Histogram — Group by fixed numeric intervals.
  • Filters — Group by custom filter queries.
  • Significant Terms — Statistically significant terms.

A visualization combines one or more metrics with zero or more buckets to produce the final chart.

Creating a Visualization — Step by Step

Step 1: Open the Visualize Library

  1. Click the hamburger menu (☰) → Analytics → Visualize Library.
  2. Click Create visualization.
  3. Choose the visualization type (e.g., Vertical Bar).

Step 2: Select a Data View

  1. Select the data view to query — for example, app-logs-*.
  2. The editor loads with a blank chart and the aggregation configuration panel.

Step 3: Configure Metrics

  1. Under Metrics, the default metric is Count (Y-axis).
  2. Click Count to change it. For example, select Average and choose the field event.duration.
  3. Add additional metrics by clicking Add under Metrics.

Step 4: Configure Buckets

  1. Under Buckets, click Add → X-axis.
  2. Choose an aggregation — for example, Date Histogram on @timestamp with Auto interval.
  3. To add a second grouping (split series), click Add → Split Series and choose Terms on service.name with size 5.

Step 5: Apply and Save

  1. Click the Update button (▶) to render the visualization.
  2. Adjust the time range using the time picker if needed.
  3. Click Save in the toolbar, enter a name, and save.

Creating Common Visualization Types

Line Chart — Request Rate Over Time

  1. Create a new visualization → select Line.
  2. Data view: app-logs-*.
  3. Metric: Count (Y-axis) — represents request volume.
  4. Bucket → X-axis: Date Histogram on @timestamp, interval Auto.
  5. Click Update. The chart shows request rate over time.
  6. To split by service, add Bucket → Split Series → Terms on service.name, size 5.

Bar Chart — Errors by Service

  1. Create a new visualization → select Vertical Bar.
  2. Metric: Count.
  3. Bucket → X-axis: Terms on service.name, size 10.
  4. Add a filter in the query bar: log.level: "ERROR".
  5. Click Update. The chart shows which services produce the most errors.

Pie Chart — Traffic Distribution by Status Code

  1. Create a new visualization → select Pie.
  2. Metric: Count (slice size).
  3. Bucket → Split Slices → Terms on http.response.status_code, size 10.
  4. Click Update. The chart shows the proportion of 200s, 301s, 404s, 500s, etc.

Metric — Total Error Count

  1. Create a new visualization → select Metric.
  2. Metric: Count.
  3. Add a filter in the query bar: log.level: "ERROR".
  4. Click Update. A single large number displays the total error count.
  5. Under Options, you can set a color range — for example, green below 100, red above 1000.

Gauge — Average Response Time

  1. Create a new visualization → select Gauge.
  2. Metric: Average on event.duration.
  3. Under Options, set ranges:
    • Green: 0–500 ms
    • Yellow: 500–2000 ms
    • Red: 2000–10000 ms
  4. Click Update. The gauge shows the current average response time with color coding.

Data Table — Top Error Messages

  1. Create a new visualization → select Data Table.
  2. Metric: Count.
  3. Bucket → Split Rows → Terms on error.message, size 20.
  4. Add a filter: log.level: "ERROR".
  5. Click Update. A table lists the most common error messages with their counts.

Time Series Visual Builder (TSVB)

TSVB is an advanced time-series visualization tool that offers more flexibility than standard line or area charts.

Key Features of TSVB

  • Multiple metrics on the same panel with different aggregations.
  • Math expressions to compute derived metrics (e.g., error rate = errors / total × 100).
  • Annotations to overlay events on the timeline.
  • Multiple panel types — Time Series, Metric, Top N, Gauge, Table, Markdown.

Creating a TSVB Visualization

  1. Create a new visualization → select TSVB.
  2. The TSVB editor opens with a default time-series panel.
  3. Under Data, configure:
    • Index pattern: app-logs-*
    • Time field: @timestamp
  4. Under Panel options, set the data view.
  5. In the Series section:
    • Series 1: Aggregation Count, Group by Everything — total request count.
    • Click + to add Series 2: Aggregation Count, filter log.level: "ERROR" — error count.
  6. Click the Options tab to customize colors, line styles, and fill.

TSVB Math Expression — Error Rate Percentage

  1. Add Series 1: Count of all documents. Set label to Total.
  2. Add Series 2: Count with filter log.level: "ERROR". Set label to Errors.
  3. Add Series 3: Choose Math aggregation. Enter the expression: params.Errors / params.Total * 100.
  4. This creates a derived error rate percentage line.

Vega and Vega-Lite

For fully custom visualizations that go beyond Kibana’s built-in options, you can use Vega or Vega-Lite — declarative visualization grammars.

When to Use Vega

  • You need a visualization type not available in Kibana (e.g., Sankey diagram, network graph).
  • You want complete control over every visual aspect.
  • You need to combine data from multiple Elasticsearch queries.

Simple Vega-Lite Example

  1. Create a new visualization → select Vega.
  2. Replace the default spec with:
{
  "$schema": "https://vega.github.io/schema/vega-lite/v5.json",
  "title": "Error Count by Service",
  "data": {
    "url": {
      "index": "app-logs-*",
      "body": {
        "size": 0,
        "query": {
          "bool": {
            "filter": [
              { "term": { "log.level": "ERROR" } },
              { "range": { "@timestamp": { "gte": "now-24h" } } }
            ]
          }
        },
        "aggs": {
          "services": {
            "terms": { "field": "service.name", "size": 10 }
          }
        }
      }
    },
    "format": { "property": "aggregations.services.buckets" }
  },
  "mark": "bar",
  "encoding": {
    "x": { "field": "key", "type": "nominal", "title": "Service" },
    "y": { "field": "doc_count", "type": "quantitative", "title": "Error Count" },
    "color": { "field": "key", "type": "nominal" }
  }
}
  1. Click Update to render the custom bar chart.

Saving and Embedding Visualizations

Saving

  1. Click Save in the visualization editor toolbar.
  2. Enter a descriptive name following a naming convention — for example: [Logs] Error Count by Service — Bar.
  3. The visualization is saved to the Visualize Library and can be added to any dashboard.

Naming Convention Best Practices

Use a consistent pattern:

[Category] Description — Chart Type

Examples:

  • [Logs] Request Rate Over Time — Line
  • [Metrics] CPU Usage — Gauge
  • [Security] Failed Logins by IP — Data Table

Embedding in Dashboards

Saved visualizations can be added to dashboards by clicking Add panel → Add from library and selecting the visualization. We’ll cover this in detail in the Dashboards section.

Quick Reference

Task Steps
Create visualization Menu → Visualize Library → Create visualization
Set metric Click the metric aggregation → choose type and field
Set bucket Click Add → choose bucket type and aggregation
Add filter Type a query in the visualization query bar
Split series Add bucket → Split Series → Terms
Update chart Click the ▶ Update button
Save visualization Click Save → enter name → Save
Use TSVB Create visualization → select TSVB
Use Vega Create visualization → select Vega

Next: Dashboards — Combine visualizations into interactive monitoring dashboards.

You may also enjoy