11 October 2018 Engineering

Getting Started with Canvas in Kibana

By Ethan Groves

Manually updating scoreboards and presentations is a thing of the past

Canvas is a presentation tool — built into Kibana — that allows users to create pixel-perfect presentations and slide decks that pull live data directly from Elasticsearch. This means no manual updates for presentations, resulting in up-to-the-minute visuals, chart elements, and graphics. However, Canvas can be many things and has the flexibility to be used for more than just the primary use case presented in this article. 

Below is a video of Rashid Khan, the creator of Canvas, presenting his vision for Canvas at Elastic{ON} 2018.

Why use Canvas

Creating a presentation can be a time consuming process, especially when the data being presented requires manipulation in order to make it more palatable to the audience than pure JSON. Even something as simple as taking a screenshot of a bar graph and then dropping the image into a presentation can be tedious if the data in the bar graph needs to be updated regularly. Unfortunately, it's not uncommon to need to export your data, clean it up, paste it into your presentation, add images, and more. This can quickly become a very painful and arduous process.

These concerns don't even begin to address the possibility of adjusting things on the fly (i.e. live during a presentation). Imagine a presentation which contains a slide displaying the company earnings report broken down by quarter. What would happen if, during the presentation, the CEO asked to see the earnings report broken down by month? Either, someone prepared that slide ahead of time, or the presenter is simply forced to say, "Umm, let me get back to you with that information later."

Canvas not only removes the tedium of constantly updating visualizations in a presentation, it also gives its users powerful tools and filters to adjust data on the fly, allowing for very flexible, dynamic, and compelling presentations.

Prerequisites and Installing Canvas


To get started with Canvas, you will need the following:

  • Elasticsearch for storing and indexing data
  • Kibana for the UI

If you don't already have these installed and running, see Getting started with the Elastic Stack for more information. Also check out this Quick Deploy repo, which provides an easy way to get Elasticsearch and Kibana up and running on an Ubuntu machine within minutes.

Installing Canvas

Note: You will need the latest version of Kibana in order to install Canvas.

Soon, Canvas will be included with Kibana by default, but to get started immediately, we will need to install the Canvas plugin ourselves. By following these simple installation instructions, you'll have Canvas up and running in no time.  

Once you've kicked off the installation, grab a coffee, since the installation process can take several minutes (up to 10 mins) to work through the Optimizing and caching browser bundles… step. Note: At the time of writing this tutorial, the version of Canvas used was kibana-canvas-0.1.2199.zip, which is compatible with version 6.4.1 of Kibana.

TIP: If your Kibana is running in a docker container, simply run docker exec -it your-kibana-container bash and then run the NODE_OPTIONS=... command (provided in the link above) to install canvas. The Kibana container will need to be restarted before Canvas will show up.

Data Sources

For the purposes of this tutorial, we're going to use Metricbeat as a quick, easy, and relatively predictable source of live data.

1. Download and Unzip Metricbeat

Visit the Metricbeat download page to download the correct binary for your OS. Once you have downloaded it, go ahead and unpack it. Once unpacked, you will find several files in the Metricbeat directory.

2. Configuring Metricbeat

Next we need to configure Metricbeat to send data to your Elasticsearch instance. Open metricbeat.yml with your favorite code editor. If your Elasticsearch instance is...

  1. Local: The default configuration is already setup to send data to Elasticsearch (running at http://localhost:9200), so you shouldn't have to change anything. If you do need to change something, the process is the same as in the next step.
  2. Remote: Go to the Elasticsearch output section and modify it to point to your instance:
      host: "url-to-my-kibana-instance:5601"
      hosts: ["url-to-my-elasticsearch-instance:9200"]

3. Run Metricbeat

Save the metricbeat.yml file. Then run metricbeat with the -setup option, which will tell the system to load the default metrics dashboards to Kibana.

./metricbeat -c metricbeat.yml -setup -e

TIP: if you add the -e option when running Metricbeat you can see the logs while running.

How to create your first Canvas workpad

Canvas projects are called "workpads". Workpads are analogous to presentations and can have multiple pages.

  1. Once you have Canvas installed and Metricbeat set up, navigate to your Kibana instance, and select Canvas from the sidebar (as shown below)
  2. Click "Create workpad"
  3. Give your workpad a unique name


Anatomy of the Canvas Interface

  1. Buttons
    • Data Refresh Interval - Set the interval that Canvas checks for updates from Elasticsearch
    • Toggle Fullscreen - Toggles "Presentation mode"
    • Export Workpad - Exports the workpad as a PDF file
    • Toggle Editing Sidebar - Hides section 6 in the diagram above
  2. Add Element - This brings up the element picker, so you can add charts, graphs, images, and more to your canvas workpad
  3. Element Layer Control - Choose which elements are on top, allowing for compositing and hiding
  4. Duplicate an Element - Note: an element must be selected for this to work
  5. Canvas Workpad - The main work area
  6. Editing Controls - Context-aware panel that presents property editing for selected elements, including fonts, colors, custom style sheets, etc.
  7. Opens Canvas Main Menu - Navigate between workpads, clone, import, export, or delete workpads
  8. Page Control - Add new pages or switch between existing ones
  9. Element Code Editor - When in doubt, code it out. Complete flexibility on your queries, formatting, and pipelines (more on this in a later post)

Creating your first elements in Canvas

Element Types

  1. Click "Add element"
  2. Canvas comes with many built-in element which we can leverage immediately. Select the "Horizontal Bar Chart" element.
    TIP: When an element is first created, it is populated with demo data so you can start playing right away!
  3. In the panel on the right, select the "Data" tab
  4. Click "Change your data source"
  5. Select "Elasticsearch Raw Documents"

    image5_small.png Datasources Explained:

    • Demo Data: This is a small sample dataset that is used when you first create a new canvas element. Mostly used for testing purposes.
    • Elasticsearch Raw Documents: This is allows you to access your raw data in Elasticsearch.
    • Timelion: Timelion provides a specialized way for handling your time series data in Elasticsearch.
    • Elasticsearch SQL: Similar to Raw Documents, this allows you to access your data in Elasticsearch using SQL syntax feature.
  6. Select the metricbeat-* index from the drop down list
  7. Go to the bottom of the sidebar and click "Save"
  8. Go back to the top of the sidebar, and select the "Display" tab
  9. We will plot the round-trip time against the name of the metricset, so we set the axes for the bar graph as follows:
    • X-Axis:
      • Measurement: Value
      • Field: metricset.rtt
    • Y-Axis
      • Measurement: Value
      • Field: metricset.name
    • Color
      • Measurement: Value
      • Field: metricset.name

Let's add one more element…

  1. Click "Add element"
  2. Select the "Metric" element
  3. Drag it over to somewhere you can see it better
  4. In the panel on the right, select the "Data" tab
  5. This time, select "Elasticsearch SQL"
  6. Type the following into the SQL query editor:
    SELECT COUNT(*) FROM metricbeat*
  7. Click "Save"
  8. Notice that the element now shows a warning. This is because the element is no longer pulling any data.
  9. At the top of the sidebar, select the "Display" tab
  10. In the "Numbers" section, set the following:
    • Measurement: Value
    • Field: COUNT_1
  11. Change the label for this element to be "Entries", since this is showing the number of entries in Elasticsearch
  12. As long as Metricbeat is still running, we will see this number update live. In the top left-hand side of the screen, click on "Refresh"
  13. Set the refresh rate to be 5 seconds
  14. Watch your presentation update with live data!


No more manually updating your presentation!

Links to other helpful resources

That's it! You've just created your first canvas workpad with live data being piped in via Metricbeat. Try adding some other elements to your workpad and experimenting with the capabilities of Canvas!

Also, check out some other Canvas tutorials here:

Banner Image: "By hand" by Eric Kilby, used under CC BY / Cropped from original