Exploring dashboards

Stack Serverless

Kibana supports several ways to explore the data displayed in a dashboard more in depth:

• The query bar, using KQL expressions by default.
• The time range, that allows you to display data only for the period that you want to focus on. You can set a global time range for the entire dashboard, or specify a custom time range for each panel.
• Controls, that dashboard creators can add to help viewers filter on specific values.
• Filter pills, that you can add and combine by clicking on specific parts of the dashboard visualizations, or by defining conditions manually from the filter editor. The filter editor is a good alternative if you’re not comfortable with using KQL expressions in the main query bar.
• View the data of a panel and the requests used to build it.

This section shows the most common ways for you to filter dashboard data. For more information about Kibana and Elasticsearch filtering capabilities, refer to Querying and filtering.

Use filter pills to focus in on the specific data you want.

×

You can interact with some panel visualizations to explore specific data more in depth. Upon clicking, filter pills are added and applied to the entire dashboard, so that surrounding panels and visualizations also reflect your browsing.

×

As an alternative to the main query bar, you can filter dashboard data by defining individual conditions on specific fields and values, and by combining these conditions together in a filter pill.

×

You can interact with filter pills to edit them, temporarily alter their behavior without having to delete them, or make them available in other contexts. The following options are available when selecting a filter pill:

Pin across all apps and Unpin

Adds this filter to available dashboards and to apps such as Discover, Lens, Maps, and Visualize. The filter is removed if you:

• Unpin it. In this case, the filter only remains on the currently open app, unpinned.
• Remove it from any place while it's still pinned.
• Refresh your session, for example by opening a dashboard in a new tab. Pinned filters are not saved along with the dashboard, visualization, or Discover session that you added them to.

Tip

When a pinned filter can't be applied, for example if a field specified in the filter doesn't exist in the current data view, the filter is ignored and shows in a different color.

Edit filter

Lets you edit and update the filter.

Exclude results and Include results

Reverses the filter behavior.

Temporarily disable and Re-enable

Lets you temporarily disable a filter instead of requiring you to delete it. This is particularly useful for testing different filter combinations.

Delete

Deletes the filter.

You can perform most of these actions at once for all filters in your current view using the Filter icon . From the menu that opens, select Apply to all, then choose the action you'd like to perform.

The query bar lets you build filters using Kibana Query Language (KQL). When typing, it dynamically suggests matching fields, operators, and values to help you get the exact results that you want.

×

The data visible in a dashboard highly depends on the time range that is applied. In a dashboard, you can select a time range that applies globally to all panels, or set a custom time range for specific panels.

The global time range menu is located right next to the query bar, in the dashboard’s header. With this menu, you can select the time range to apply, and set the frequency for refreshing the dashboard data. Setting the time range is a common action in Kibana. Refer to Set the time range for more details.

×

To apply a panel-level time range:

1. Hover over the panel and click . The Settings flyout appears.
2. Turn on Apply a custom time range.
3. Enter the time range you want to view, then click Apply.

To view and edit the time range applied to a specific panel:

When a custom time range is active for a single panel, it is indicated in the panel’s header.

To edit it, click the filter. You can then adjust and apply the updated Time range.

Dashboard authors can add various types of additional controls to help you filter the data that you want to visualize.

Filter the data with one or more options that you select.

1. Open the Options list dropdown.

2. Select the available options.

   Selecting Exists returns all documents that contain an indexed value for the field.

3. Select how to filter the options.

   • To display only the data for the options you selected, select Include.
   • To exclude the data for the options you selected, select Exclude.

4. To clear the selections, click .

5. To display only the options you selected in the dropdown, click .

×

Filter the data within a specified range of values.

1. On the Range slider, click a value.

2. Move the sliders to specify the values you want to display.

   The dashboard displays only the data for the range of values you specified.

3. To clear the specified values, click .

×

Filter the data within a specified range of time.

1. To view a different time range, click the time slider, then move the sliders to specify the time range you want to display.
2. To advance the time range forward, click .
3. To advance the time range backward, click .
4. To animate the data changes over time, click .
5. To clear the specified values, click .

×

Viewing the details of all requests used to build a visualization and the resulting data helps you confirm that the visualization is showing the right data and that the requests are performing as expected.

The available actions can vary depending on the panel you're inspecting.

This action is possible for all charts created using Lens or ES|QL. It is not available for other types of panels, such as Maps or Vega visualizations.

1. Open the panel menu and select Inspect.

2. Open the View dropdown, then select Data.

3. If you'd like to download the data, select Download CSV, then select the format type from the dropdown:

   • Formatted CSV: Contains human-readable dates and numbers.

   • Raw CSV: Formatted for computer use.

     When you download a visualization panel with multiple layers, each layer produces a CSV file, and the file names contain the visualization and layer data view names.

This action is possible for all visualization panels that are built based on a query, but the available information can differ based on the panel type.

1. Open the panel menu and select Inspect.
2. Open the View dropdown, then select Requests.
3. Some visualizations rely on several requests. From the dropdown, select the request you want to inspect. Several tabs with different information can appear, depending on the panel type:

   • Statistics: Provides general information and statistics about the request. For example, you can check if the number of hits and query time match your expectations. If not, this may indicate an issue with the request used to build the visualization.

   • Clusters and shards: Lists the Elasticsearch clusters and shards per cluster queried to fetch the data and shows the status of the request on each of them. With the information in this tab, you can check if the request is properly executed, especially in case of cross-cluster search.

     Note

     This tab is not available for ES|QL and Vega visualizations.

   • Request: Provides a full view of the visualization's request, which you can copy or Open in Console to refine, if needed.

   • Response: Provides a full view of the response returned by the request.

When a custom time range is active for a single panel, it is indicated in the panel’s header.

You can view it in more detail and edit it by clicking the filter.

Stack 9.1.0 Serverless

When viewing a dashboard with read-only permissions, certain visualization panels allow you to view how the visualization itself is configured, and to temporarily edit that configuration.

1. Hover over a visualization panel and select Show visualization configuration. The Configuration flyout appears.

   If this option isn't available, it means one of two things:

   • The visualization panel type doesn't support this option.
   • You have Edit permissions for this dashboard. In this case, switch the dashboard to Edit mode. You will then be able to edit the configuration of the visualization for all viewers of the dashboard.

2. View the configuration of the visualization. You can make edits, but these will be lost as soon as you exit the flyout.

3. Select Cancel to exit the Configuration flyout.

You can display dashboards in full screen mode to gain visual space and view or show visualizations without the rest of the Kibana interface.

×

If you need to focus on a particular panel, you can maximize it by opening the panel menu and selecting Maximize. You can minimize it again the same way.

×