Loading

Build line charts with Kibana

Line charts are ideal for visualizing how metrics evolve over time, spotting seasonal patterns, and detecting spikes or regressions at a glance. Use them for KPIs like response time, error rate, throughput, or utilization, and compare multiple series or previous periods on the same chart. You can create line charts from any numeric data using aggregations (for example, Average, Percentile, Counter rate) or with custom formulas.

You can create line charts in Kibana using Lens.

Example Lens line chart

To build a line chart:

  1. Access Lens

    Lens is Kibana's main visualization editor. You can access it:

    • From a dashboard: On the Dashboards page, open or create the dashboard where you want to add a line chart, then add a new visualization.
    • From the Visualize library page by creating a new visualization.

  2. Set the visualization to Line

    New visualizations default to Bar.

    Using the visualization type dropdown, select Line.

  3. Define the data to show

    1. Select the data view that contains your data.
    2. Drag a time field to the Horizontal axis and a numeric field to the Vertical axis. Kibana automatically selects an appropriate aggregation function compatible with the selected field.

    Optionally:

    • Add more numeric fields to create additional series, or drag a categorical field to Break down by to split the series.
    • You can click the Add layer icon to integrate additional visualizations, annotations, or a reference line.

  4. Customize the chart to follow best practices

    You can tweak the appearance of your chart by adjusting axes, legends, and series styles from the chart settings. Consider the following best practices:

    Use color wisely
    Assign colors that match your users' expectations and consider your specific context.
    Provide context
    Add a legend and descriptive axis titles, or remove them for obvious axes.

    For layout, hierarchy, and color guidance on dashboards, check EUI’s Dashboard good practices. For more chart configuration options, go to the Line chart settings section.

  5. Save the chart

    • If you accessed Lens from a dashboard, select Save and return to save the visualization and add it to that dashboard, or select Save to library to add the visualization to the Visualize library.
    • If you accessed Lens from the Visualize library, select Save. The Save menu also lets you add the visualization to a dashboard and the Visualize library.

In line charts, you can enable time shift to compare the current value with a prior time range and identify deltas.

Example Lens line chart current previous

  1. Create a line chart with a time-based Horizontal axis and your main metric on Vertical axis, for example: bytes.
  2. Duplicate the layer:
    • Select Duplicate layer from the visualization editor.
    • Open the contextual menu of the visualization editor and select Duplicate layer.
  3. From the duplicated layer settings, select the field defined as vertical axis to open its details. Expand its Advanced options and set Time shift to 1w or to the time value of your choice. Check Compare differences over time for more details.
  4. Optionally, customize the appearance of the layer to adjust how it looks on the chart. When you duplicate a layer, Kibana automatically assigns a different Series color to the new layer. You can for example change this color, or adjust the layer's name and axis position. This name is used for the chart's legend.
Tip

You can also compute the relative change by defining the axis data with a formula, for example:
(average(bytes) - average(bytes, shift='1w')) / average(bytes, shift='1w')

Use reference lines to indicate important thresholds, such as SLOs or alert limits.

Example Lens line chart reference lines

  1. In the chart settings, add a static value reference line to mark your target or threshold visually.
  2. Use the Text decoration setting to provide a name, for example, Target or SLO, choose a color, and optionally a band.

Customize your line chart to display exactly the information you need, formatted the way you want.

Data
  • Functions:
    • Date histogram: Group data points into time-based buckets (for example, hourly, daily, weekly).
    • Intervals: Determine the size of the time buckets in your date histogram. You can define the intervals granularity or specify custom ranges.
    • Filters: Allow you to segment your data based on specific conditions, creating separate lines for each filter.
    • Top values: Create separate lines for the most common values in a field.
Appearance
Name: By default, the chart uses the function or formula as title. It's a best practice to customize this with a meaningful title.
Data

To represent the metrics or values you want to visualize, you can use quick functions like Average, Count, Percentile, Counter rate, or create custom calculations with formulas. Refer to Lens > Use formulas to perform math for examples, or to the Formula reference available from Lens.

Advanced settings

Depending on the data you defined, several options allow you to apply additional filtering to the data taken into account to compute the metric's value:

  • Normalize by unit: Normalize the metric values to show per unit of time.
  • Filter by: Specify a query.
  • Reduced time range: Reduce the time range specified on the dashboard's time filter by the specified duration.
  • Time shift: Shift the time range by the specified duration. This is useful if the value should use a different time range than the one selected on the dashboard.
  • Hide zero values: Don't show values equal to zero. This option is on by default.

Appearance

  • Name: Customize the legend label with a descriptive name.
  • Value format: Control how numeric values are displayed on the vertical axis of your visualization.
  • Series color: Select a palette or specific color per series.
  • Axis side: Control where axis labels and tick marks appear.

Breakdown functions segment your data into multiple lines on the same chart, with each line representing a different value of a categorical field. You can specify the following options:

Data
  • Functions:
    • Date histogram: Group data points into time-based buckets (for example, hourly, daily, weekly).
    • Intervals: Determine the size of the time buckets in your date histogram. You can define the intervals granularity or specify custom ranges.
    • Filters: Allow you to segment your data based on specific conditions, creating separate lines for each filter.
    • Top values: Create separate lines for the most common values in a field.

Depending on the function and type of field that you select, you can specify more advanced settings.

Appearance

Allow you to customize how your breakdown data is displayed in line charts, including:

  • Name: It's a best practice to customize this with a meaningful title.
  • Value format: Control how numeric values are displayed in your visualization.
  • Color mapping: Determine how colors are assigned to your breakdown series.

When creating or editing a visualization, you can adjust the following settings.

Style

Adjust the visual appearance of your line chart to control how the data series are labeled and displayed alongside your chart. Click to open the Style panel.

Appearance
Allow you to customize to overall chart appearance:

  • Point visibility: Use this option to show or hide data points. Set to Auto by default: Points are visible unless the distance between them is too short.

    • Line interpolation: Choose how to interpolate the line between data points from the available options: Straight (default), Smooth, and Step.

    • Missing values: Choose between Hide, Zero, Linear, Last, and Next. This option controls how gaps in data appear on the chart. By default, gaps are hidden. Missing values include empty buckets and metrics: Buckets without documents or metrics that returned null due to their operation and data content.

      Note

      You can only use this option when the Include empty rows option of the chart is enabled or when a metric produces a null bucket. For example, if a moving average finds empty buckets.

      • Hide: Don't show gaps in data.

      • Zero: Fill gaps by connecting starting and ending data points to zero.

      • Linear: Fill gaps by connecting related starting and ending data points together with a direct line.

      • Last: Fill gaps between data points with a horizontal or vertical line that uses the last ending point value, when available, to determine its position.

      • Next: Fill gaps between data points with a horizontal or vertical line that uses the next starting point value, when available, to determine its position.

      • End values
        If you've chosen to show missing values, you can also decide to extend data series to the edge of the chart. By default, end values are hidden.
        • Hide: Don't extend series to the edge of the chart.
          • Zero: Extend series as zero to the edge of the chart.
          • Nearest: Extend series with their first or last value to the edge of the chart.
      • Show as dotted line

        If you've chosen to show missing values, you can turn on this option to show gaps as a dotted line.

Left axis
Allow you to customize the Y-axis appearance.
  • Axis Title. Show, hide or add a custom title.
    • Gridlines. Show or hide gridlines.
    • Tick labels. Show or hide tick labels.
    • Orientation. Choose the tick labels orientation.
    • Axis scale. Choose an axis scale type. Options include: Linear (default), Logarithmic, and Square root.
    • Bounds. Use Bounds to set the minimum and maximum values for the Y-axis. Options include: Full, Data, and Custom
    • Round to nice value. Axis labels can be rounded to more readable numbers.
Bottom axis
Allow you to customize the bottom axis appearance:
  • Axis Title. Show, hide or add a custom title.
    • Gridlines. Show/hide gridlines.
    • Tick labels. Show/hide tick labels.
    • Show partial data markers: indicate data points where Data collection is incomplete (the time bucket is still open and actively collecting events), or data may change (the values represented might increase as more data arrives).
    • Show current time marker: Add a vertical line on your chart that represents the current time.
Legend

You can customize the way the legend is displayed and the data it shows. Click Legend icon to open the Legend panel.

With the Visibility, Position, and Width options, you can adjust the way the legend appears in or next to the visualization.

Statistics
To make your legends as informative as possible, you can show some additional statistics. All statistics are computed based on the selected time range and the aggregated data points shown in the chart, rather than the original data coming from Elasticsearch. For example, if the metric plotted in the chart is Median(system.memory) and the time range is last 24 hours, when you show the Max statistic in the Legend, the value that shows corresponds to the Max[Median(system.memory)] for the last 24 hours.
  • Average: Average value considering all data points in the chart.
    • Median: Median value considering all data points in the chart.
    • Minimum: Minimum value considering all data points in the chart.
    • Maximum: Maximum value considering all data points in the chart.
    • Range: Difference between min and max values.
    • Last value: Last value considering all data points in the chart.
    • Last non-null value: Last non-null value.
Label truncation
Keep your legend minimal in case of long labels that span over multiple lines. You can adjust the line limit.
Average RAM per host
Monitoring the average of RAM over time for the first four hosts:

  1. Drag @timestamp to the Horizontal axis and set the following settings:

    • Functions: Date histogram
    • Minimum interval: Hour

  2. Drag machine.ram to the Vertical axis and set the following settings:

    • Functions: : Moving average
    • Value format: Bytes

  3. In the Breakdwon panel, set the following settings:

    • Functions: Top values
    • Fields: host.keyword
    • Number of values: 4

  4. Save your chart.

    Average RAM per host

Unique IPs over time
Visualizing unique IP sessions throughout the day:

  1. Drag @timestamp to the Horizontal axis and set the following settings:

    • Functions: Date histogram
    • Minimum interval: Hour

  2. Drag host.keyword to the Vertical axis and set the following settings:

    • Functions: : Unique count
    • Value format: Bytes (1024)
    • Decimals: 0

  3. Save your chart.

    Unique IPs throughout the day