Each set of data loaded to Elasticsearch has an index pattern. In the previous section, the Shakespeare data set has an index named shakespeare, and the accounts data set has an index named bank. An index pattern is a string with optional wildcards that can match multiple indices. For example, in the common logging use case, a typical index name contains the date in MM-DD-YYYY format, and an index pattern for May would look something like logstash-2015.05*.

For this tutorial, any pattern that matches the name of an index we’ve loaded will work. Open a browser and navigate to localhost:5601. Click the Settings tab, then the Indices tab. Click Add New to define a new index pattern. Two of the sample data sets, the Shakespeare plays and the financial accounts, don’t contain time-series data. Make sure the Index contains time-based events box is unchecked when you create index patterns for these data sets. Specify shakes* as the index pattern for the Shakespeare data set and click Create to define the index pattern, then define a second index pattern named ba*.

The Logstash data set does contain time-series data, so after clicking Add New to define the index for this data set, make sure the Index contains time-based events box is checked and select the @timestamp field from the Time-field name drop-down.

Click the Discover tab to display Kibana’s data discovery functions:

Right under the tab itself, there is a search box where you can search your data. Searches take a specific {ref}/query-dsl-query-string-query.html#query-string-syntax[query syntax] that enable you to create custom searches, which you can save and load by clicking the buttons to the right of the search box.

Beneath the search box, the current index pattern is displayed in a drop-down. You can change the index pattern by selecting a different pattern from the drop-down selector.

You can construct searches by using the field names and the values you’re interested in. With numeric fields you can use comparison operators such as greater than (>), less than (<), or equals (=). You can link elements with the logical operators AND, OR, and NOT, all in uppercase.

Try selecting the ba* index pattern and putting the following search into the search box:

This search returns all account numbers between zero and 99 with balances in excess of 47,500.

If you’re using the linked sample data set, this search returns 5 results: Account numbers 8, 32, 78, 85, and 97.

To narrow the display to only the specific fields of interest, highlight each field in the list that displays under the index pattern and click the Add button. Note how, in this example, adding the account_number field changes the display from the full text of five records to a simple list of five account numbers:

The visualization tools available on the Visualize tab enable you to display aspects of your data sets in several different ways.

Click on the Visualize tab to start:

Click on Pie chart, then From a new search. Select the ba* index pattern.

Visualizations depend on Elasticsearch {ref}/search-aggregations.html[aggregations] in two different types: bucket aggregations and metric aggregations. A bucket aggregation sorts your data according to criteria you specify. For example, in our accounts data set, we can establish a range of account balances, then display what proportions of the total fall into which range of balances.

The whole pie displays, since we haven’t specified any buckets yet.

Select Split Slices from the Select buckets type list, then select Range from the Aggregation drop-down selector. Select the balance field from the Field drop-down, then click on Add Range four times to bring the total number of ranges to six. Enter the following ranges:

Click the Apply changes button to display the chart:

This shows you what proportion of the 1000 accounts fall in these balance ranges. To see another dimension of the data, we’re going to add another bucket aggregation. We can break down each of the balance ranges further by the account holder’s age.

Click Add sub-buckets at the bottom, then select Split Slices. Choose the Terms aggregation and the age field from the drop-downs. Click the Apply changes button to add an external ring with the new results.

Save this chart by clicking the Save Visualization button to the right of the search field. Name the visualization Pie Example.

Next, we’re going to make a bar chart. Click on New Visualization, then Vertical bar chart. Select From a new search and the shakes* index pattern. You’ll see a single big bar, since we haven’t defined any buckets yet:

For the Y-axis metrics aggregation, select Unique Count, with speaker as the field. For Shakespeare plays, it might be useful to know which plays have the lowest number of distinct speaking parts, if your theater company is short on actors. For the X-Axis buckets, select the Terms aggregation with the play_name field. For the Order, select Ascending, leaving the Size at 5. Write a description for the axes in the Custom Label fields.

Leave the other elements at their default values and click the Apply changes button . Your chart should now look like this:

Notice how the individual play names show up as whole phrases, instead of being broken down into individual words. This is the result of the mapping we did at the beginning of the tutorial, when we marked the play_name field as 'not analyzed'.

Hovering on each bar shows you the number of speaking parts for each play as a tooltip. You can turn this behavior off, as well as change many other options for your visualizations, by clicking the Options tab in the top left.

Now that you have a list of the smallest casts for Shakespeare plays, you might also be curious to see which of these plays makes the greatest demands on an individual actor by showing the maximum number of speeches for a given part. Add a Y-axis aggregation with the Add metrics button, then choose the Max aggregation for the speech_number field. In the Options tab, change the Bar Mode drop-down to grouped, then click the Apply changes button . Your chart should now look like this:

As you can see, Love’s Labours Lost has an unusually high maximum speech number, compared to the other plays, and might therefore make more demands on an actor’s memory.

Note how the Number of speaking parts Y-axis starts at zero, but the bars don’t begin to differentiate until 18. To make the differences stand out, starting the Y-axis at a value closer to the minimum, check the Scale Y-Axis to data bounds box in the Options tab.

Save this chart with the name Bar Example.

Next, we’re going to make a tile map chart to visualize some geographic data. Click on New Visualization, then Tile map. Select From a new search and the logstash- index pattern. Define the time window for the events we’re exploring by clicking the time selector at the top right of the Kibana interface. Click on *Absolute, then set the start time to May 18, 2015 and the end time for the range to May 20, 2015:

Once you’ve got the time range set up, click the Go button, then close the time picker by clicking the small up arrow at the bottom. You’ll see a map of the world, since we haven’t defined any buckets yet:

Select Geo Coordinates as the bucket, then click the Apply changes button . Your chart should now look like this:

You can navigate the map by clicking and dragging, zoom with the buttons, or hit the Fit Data Bounds button to zoom to the lowest level that includes all the points. You can also create a filter to define a rectangle on the map, either to include or exclude, by clicking the Latitude/Longitude Filter button and drawing a bounding box on the map. A green oval with the filter definition displays right under the query box:

Hover on the filter to display the controls to toggle, pin, invert, or delete the filter. Save this chart with the name Map Example.

Finally, we’re going to define a sample Markdown widget to display on our dashboard. Click on New Visualization, then Markdown widget, to display a very simple Markdown entry field:

Write the following text in the field:

A Kibana dashboard is a collection of visualizations that you can arrange and share. To get started, click the Dashboard tab, then the Add Visualization button at the far right of the search box to display the list of saved visualizations. Select Markdown Example, Pie Example, Bar Example, and Map Example, then close the list of visualizations by clicking the small up-arrow at the bottom of the list. You can move the containers for each visualization by clicking and dragging the title bar. Resize the containers by dragging the lower right corner of a visualization’s container. Your sample dashboard should end up looking roughly like this:

Click the Save Dashboard button, then name the dashboard Tutorial Dashboard. You can share a saved dashboard by clicking the Share button to display HTML embedding code as well as a direct link.

Now that you’ve handled the basic aspects of Kibana’s functionality, you’re ready to explore Kibana in further detail. Take a look at the rest of the documentation for more details!