Kibana is an open-source application tool used for log and time series analytics, application monitoring etc. On the latest Kibana, we can search and view the logs which logstash recorded. Kibana is a web interface software utilized for searching and visualizing logs as well as creating the charts, maps, bars etc of data. We use Kibana tool to view and communicate with the data stored in Elasticsearch. We can run Kibana on-premises, on Amazon EC2, or on Amazon Elasticsearch service. While we install Kibana software on on-premises or Amazon EC2 deployments, we can manage it by ourselves.

There are 4 sections for Kibana which are described below.

• Discover
• Visualize
• Dashboard
• Settings

KIBANA DISCOVER

On Discover default page, you can see all your ELK stack’s most recently received logs and you can search the logon “Search” sort the result to a specific time range with “time filter”

Elements in Kibana Discover

Search Bar: To search specific fields or entire messages
Time Filter: To filter logs based on specific time ranges
Field Selector: To modify the selected fields which are displayed in the Log View
Date Histogram:This Bar graph shows the count of all logs versus time (x-axis), matched by the search and time filter. You can narrow the time filter by click and drag.
Log View: Use to view individual log messages and it can be displayed by the fields. Also can view the entire message if no field is selected.

KIBANA VISUALISE

Kibana Visualize helps to create, modify and custom visualizations. There are 3 types of visualization: Vertical bar and Pie charts to Tile maps and Data tables. Note that if you have access to your Kibana instance it can be shared with the other users.
We have to reload the field list before we proceed with customer visualization if we are using this for the first time. This Reload Field Data subsection is under the Kibana Settings section.

Steps for creating a visualization

1. Click the Visualize menu item.
2. Select the type of visualization and select it.
3. Create a Vertical bar chart.
4. Now you must either select a search source or create a new search

To make a useful visualization, we need to add some new buckets.

Firstly you may need to add an X-axis bucket, then click the Aggregation drop-down menu and select “Date Histogram”. After that, click the Apply button and you can see that the single bar will split into several bars along with the X-axis. The Count will be displayed as multiple bars which contain intervals of time and what you would see on the Discover page.

To create a new graph, click the Add Sub Aggregation button >>Split Bars bucket type>> click the Sub Aggregation >> select “Significant Terms” >> click the Field drop-down menu >> select “clientip.raw” >> after that click the Size field and enter “10”. At last, click the Apply button to create the new graph.

Once the visualization is ready to save you can click the Save Visualization icon (Before that you have to name it and click the Save button.)

We need to create one more visualization before going to the Kibana Dashboard because in Kibana Dashboard we are going to combine multiple visualizations onto a single page.

KIBANA DASHBOARD

We can create, modify and view our custom dashboards in the Kibana dashboards. It is really helpful to get a detailed overview of the logs and make a connection between visualizations and the logs. By using Kibana dashboards the multiple visualizations can be combined into a single page and can be filtered by the search query and elements in the visualization.

Steps for creating a dashboard

Press the New Dashboard icon in the right of the search bar

1. Click on “Add Visualization icon”
2. Add pie chart and histogram
3. Collapse the Visualization
4. Rearrange and resize the visualizations on the dashboard
5. Click the Save Dashboard icon, you must give a name before saving the dashboard

As we mentioned earlier,  Dashboards can be filtered by entering a search query, changing the time filter, or the elements within the visualization.

We need to apply a filter to the dashboard as per our requirement to filter the segment in the histogram. After that,  click on “Apply now button”

KIBANA SETTINGS

It lets you change a variety of things like default values or index patterns.

Reload Field Data

If you need to add new fields to your Logstash data, you may need to reload the field list as this data is cached periodically and hence it is necessary to reload the field. You can refresh the field list by clicking the Settings menu >> click “logstash-* you can see the yellow button “Reload Field List” and click OK.

The Objects section allows you to edit, view, and delete any of your saved dashboards, searches, and visualizations. You can do this by following the below steps.

Settings menu >> click Objects >> Find the objects that you want to edit, view, or delete.

If you require help, contact SupportPRO Server Admin