This Week in Kibana

Histogram zero filling

The histogram panel received a makeover that brought proper light weight zero filling. This means that at intervals where a query should have 0 results, it will properly appear as such, instead of drawing a sloped line to the next point. The zero filling also means that histogram stacked bars will always appear in the same order top to bottom.

In addition, the stacked tooltip now allows you to choose between cumulative and individual modes.


Micro analysis of array fields

Array fields can now be handled as singles or groups in the micro analysis panel. For example, if I have an array of tags I could see either the 10 most common tags, or the 10 most common ways that tags appear together


_source as the default table field

If you don't select any fields for your table, Kibana will now show you the json source of your even by default until you select some fields to show


Configurable field trimming

Noticed the '...' at the end of the _source in the above screenshot? Table fields can be trimmed by a configurable "factor". The factor is essentially the maximum length of a field, divided by the number of columns in the table, after which the field will be trimmed to nicely fit. For example, if my trim factor was 300, and I had 3 columns in the table, fields would be trimmed to a max of 100 character, after which '...' would be added. Of course the entirety of the field is still available in the expanded details view


About that details view

You may know that you can see a table of event fields by click on a table row. Now you have a choice of how you'd like to see the details of an event, including syntax highlighted JSON, as well as the raw unhighlighted JSON.


Lighter, faster, smaller, better

Kibana has an all new build system! This new system allows us to build an optimized, minified, awesomulated distribution of Kibana. It also has the benefit of cleanly clearing old caches when you upgrade. Regular builds of Kibana are being published at for your convenience. That zipball can be extracted right to your webserver.

You can still run it right out of the Github repository if you want. However instead of copying the entire repo, you need only upload the src/ directory to your webserver. We recommend grabbing the built version however as its much faster.

  • We're hiring

    Work for a global, distributed team where finding someone like you is just a Zoom meeting away. Flexible work with impact? Development opportunities from the start?