« Create visualizations with Lens Alert panels »
Elastic Docs ›Kibana Guide [8.19] ›Dashboards ›Panels and visualizations

ES|QL visualizations

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

ES|QL visualizations

edit

You can add ES|QL visualizations to a dashboard directly from queries in Discover, or you can start from a dashboard.

Edit and add from Discover

edit

In Discover, typing ES|QL queries automatically shows a visualization. The visualization type depends on the content of the query: histogram, bar charts, etc. You can manually make changes to that visualization and edit its type and display options using the pencil button pencil button.

You can then Save and add it to an existing or a new dashboard using the save button of the visualization save button.

Create from dashboard

edit
  1. From your dashboard, select Add panel.

  2. Choose ES|QL under Visualizations. An ES|QL editor appears and lets you configure your query and its associated visualization. The Suggestions panel can help you find alternative ways to configure the visualization.

    Check the ES|QL reference to get familiar with the syntax and optimize your query.

  3. When editing your query or its configuration, run the query to update the preview of the visualization.

    Previewing an ESQL visualization

    When you edit the query and run it again, the visualization configuration persists as long as it is compatible with the query changes.

  4. You can bind controls to your ES|QL visualizations in dashboards by creating ES|QL controls.
  5. Select Apply and close to save the visualization to the dashboard.

Customize the appearance of your ES|QL visualization

edit

When editing an ES|QL visualization, you can customize the appearance of the chart. To do that:

  1. Click one of the fields representing an axis of the chart to open its details.

    Click on the axis field to open its details

  2. Define the appearance of your choice from the available options.

    Appearance customization options for ESQL charts
  3. Return to the previous menu, then Apply and close the configuration to save your changes.

Create an alert from your ES|QL visualization

edit

Once you’ve created an ES|QL panel, you can create an Elasticsearch threshold rule directly from the visualization panel based on the data it displays. When you do this, the rule query is automatically generated and either describes the data and sets a specific threshold, or describes the data without setting a specific threshold.

Elastic Security rule types are not supported.

To create a rule with the threshold pre-specified:

  • Right-click a data point in the visualization and click Add alert rule. This opens the Create rule flyout. The generated query will define a threshold that corresponds to the data point you selected.
  • {kib-ref}/rule-type-es-query.html[Configure] your Elasticsearch rule.

To create a rule without the threshold pre-specified:

  • Open the More actions (three dots) menu in the upper right of the panel and select Add alert rule. This opens the Create rule flyout. The generated query will define a threshold that corresponds to the data point you selected.
  • {kib-ref}/rule-type-es-query.html[Configure] your Elasticsearch rule.
« Create visualizations with Lens Alert panels »