Lens

Lens is Kibana's modern, drag‑and‑drop visualization editor designed to make data exploration fast and intuitive. It allows you to build charts and tables by dragging fields from a data view onto a workspace, while Kibana automatically suggests the most appropriate visualization types based on the data.

The Lens editor uses data views to define the available Elasticsearch indices and fields.

Data views are created automatically if you upload a file, or add sample data by using one of the Kibana ingest options. Otherwise, you must create a data view manually.

Once you select a data view, you can build many types of visualizations by choosing aggregations, splitting dimensions, and configuring chart styles, legends, and layers.

With Lens, you can create the following visualization types:

• Bar chart
• Line chart
• Area chart
• Metric chart
• Table
• Pie chart
• Gauge chart
• Heat map chart
• Waffle chart
• Region map chart
• Treemap chart
• Tag cloud chart
• Mosaic chart
• Legacy Metric chart (deprecated)

If you’re unsure about the visualization type you want to use, or how you want to display the data, drag the fields you want to visualize onto the workspace, then let Lens choose for you.

If you already know the visualization type you want to use, and how you want to display the data, use the following process.

Once you have created your visualization, you can edit it directly on the dashboard. Click the Edit visualization configuration icon on the panel.

When you can create a visualization, you can change the fields list to display a different data view, a different time range, or add your own fields. To do that, open the data view dropdown and select Add a field to this data view.

If the fields list is empty, change the time filter.

For more information about adding fields to data views and examples, refer to Explore your data with runtime fields.

You can assign specific colors to terms in your visualizations. This color mapping can be useful in several situations:

• Visual recognition and recall: Keep colors consistent for each term regardless of filters or sorting.
• Semantic meaning: Use colors to convey meaning or categorization.
• Consistency: Align with brand colors and improve overall aesthetic consistency.

Color mapping is available for the following Lens visualization types:

• Data tables: Assign colors to terms in Rows or Metrics fields. You can apply colors to cell backgrounds or text.
• XY charts (Area, Bar, Line): Assign colors to breakdown dimensions that split your data into multiple series.
• Partition charts (Donut, Pie, Treemap, Waffle): Assign colors to the main slice or group-by dimension that defines the chart segments.
• Tag clouds: Assign colors to the tags dimension that determines the terms displayed in the cloud.

To assign colors to terms in your visualization:

1. Create a visualization using one of the supported types.
2. Add a categorical field that contains the terms you want to color.
3. In the field configuration, look for the Color by value option:
   • For data tables: Select Cell or Text
   • For other chart types: This option appears when you have a categorical breakdown
4. Click the Edit colors icon. In the menu that opens, keep Use legacy palettes turned off to be able to assign colors to specific terms
5. Select a color palette from the available options:
   • Elastic: The default and most recent palette. It is intentionally built from a color spectrum designed for flexibility and consistency, while being suited for future accessibility improvements.
   • Kibana 7.0: A palette that matches the Kibana 7.0 color theme for visualizations
   • Kibana 4.0: A palette that matches the Kibana 4.0 color theme for visualizations
   • Elastic classic: A palette made of classic Elastic brand colors
6. Select the color mode you'd like to use with this palette:
   • Categorical: Assign a distinct color to each term
   • Gradient: Assign gradients of the same color to each term
7. Choose which terms to color. You can assign colors manually or select Add all unassigned terms for automatic assignment.
   Tip

   You can assign several terms to the same color.

8. Choose how to handle unassigned terms: Use the selected color palette or assign a single color.

Discrete colors and gradients

Choose from discrete color sets or generate sequential or divergent gradients. Gradients work well for Likert scales and other term scales.

Theme-aware neutral colors

Use neutral gray colors that adjust automatically between light and dark themes. These help de-emphasize less important data.

Accessibility warnings

The system warns you when colors don't have enough contrast for accessibility.

Maintain consistency

Use color mapping to create consistent color schemes when the same categorical data appears across multiple visualizations in your dashboards.

Use semantic colors

Leverage color associations that users already understand (such as red for errors, green for success) to make your visualizations more intuitive.

Consider performance

Color mapping works best with fields that have a reasonable number of distinct values. Fields with hundreds or thousands of unique terms may impact visualization performance.

Plan for themes

When choosing colors, consider how they appear in both light and dark themes. Use theme-aware neutral colors when you want to de-emphasize data.

To use a keyboard instead of a mouse, use the Lens fully accessible and continuously improved drag system.

1. Select the field in the fields list or layer pane. Most fields have an inner and outer select state. The inner state opens a panel with detailed information or options. The outer state allows you to drag the field. Tab through the fields until you get the outer state on the field.

   
   ×

2. Complete the following actions:

   • To select a field, press Space bar.

   • To select where you want to drop the field, use the Left and Right arrows.

   • To reorder the fields on the layer pane, use the Up and Down arrows.

   • To duplicate an action, use the Left and Right arrows, then select the Drop a field or click to add field you want to use.

     
     ×

3. To confirm the action, press Space bar. To cancel, press Esc.

Lens formulas let you do math using a combination of Elasticsearch aggregations and math functions. For example, you can use formulas to divide two values and produce a percent value.

When you add a categorical field to your visualization, select the field to open its appearance settings, choose Formula, and set Appearance > Value format to Percent for a more accurate display.

For more details on how it works, click the Formula reference icon on the Formula panel.

These are examples of common formulas:

Filter ratio

To filter a document set, use kql='', then compare to other documents within the same grouping:

count(kql='response.status_code > 400') / count()
		

Week over week

To get the value for each grouping from the previous week, use shift='1w'.

percentile(system.network.in.bytes, percentile=99) /
percentile(system.network.in.bytes, percentile=99, shift='1w')
		

You are unable to combine different time shifts, such as count(shift="1w") - count() and count(shift="1w") - count(shift="1m"), with the Top values function.

Percent of total

To convert each grouping into a percent of the total, formulas calculate overall_sum for all groupings:

sum(products.base_price) / overall_sum(sum(products.base_price))
		

Compare your real-time data to the results that are offset by a time increment. For example, you can compare the real-time percentage of a user CPU time spent to the results offset by one hour.

1. In the layer pane, click the field you want to offset.
2. Click Advanced.
3. In the Time shift field, enter the time offset increment.

For a time shift example, refer to Compare time ranges.

To create partition charts, such as pie charts, configure one or more Slice by dimensions to define the partitions, and a Metric dimension to define the size. To create partition charts with multiple metrics, use the layer settings. Multiple metrics are unsupported for mosaic visualizations.

1. In the layer pane, click , then select Layer settings.
2. Select Multiple metrics.
3. Click X.

Data sampling allows you to improve the visualization loading time. When you can create your visualization, click the Layer settings icon and use the slider to adjust the Sampling percentage. For example, on large datasets, you can decrease the loading time by using a lower sampling percentage. This increases performance but lowers the accuracy.

Annotations allow you to call out specific points in your visualizations that are important, such as significant changes in the data. You can add annotations for any data view, add text and icons, specify the line format and color, and more. Click the Add layer icon , select Annotations and select the annotation method you want to use:

×

With reference lines, you can identify specific values in your visualizations with icons, colors, and other display options. You can add reference lines to any visualization type that displays axes.

For example, to track the number of bytes in the 75th percentile, add a shaded Percentile reference line to your time series visualization.

×

From your visualization, click Add layer > Reference lines. Click the vertical axis value, and specify the reference line you want to use by choosing one fhe following placement methods:

Static

To add a static reference line.

Quick functions

To add a dynamic reference line.

Formula

To calculate the reference line value with math.

You can also customize the display by adjusting the Appearance settings.

You can use the query bar to create queries that filter all the data in a visualization, or use the layer pane and legend filters to apply filters based on field values.

With the Filters function, you can apply more than one KQL filter, and apply a KQL filter to a single layer so you can visualize filtered and unfiltered data at the same time.

1. In the layer pane, click a field.

2. Click the Filters function.

3. Click Add a filter, then enter the KQL filter you want to apply.

   To try the Filters function on your own, refer to Compare a subset of documents to all documents.

With the Filter by advanced option, you can assign a color to each filter group in Bar and Line and area visualizations, and build complex tables. For example, to display failure rate and the overall data.

1. In the layer pane, click a field.
2. Click Add advanced options, then select Filter by.
3. Enter the KQL filter you want to apply.

Apply filters to visualizations directly from the values in the legend. Bar, Line and area, and Proportion visualizations support legend filters.

In the legend, click the field, then choose one of the following options:

• Filter for value — Applies a filter that displays only the field data in the visualization.
• Filter out value — Applies a filter that removes the field data from the visualization.

You can interact with filter pills to edit them, temporarily alter their behavior without having to remove them, or make them available in other contexts. The following options are available when selecting a filter pill:

Pin across all apps and Unpin

Adds this filter to available dashboards and to apps such as Discover, Lens, Maps, and Visualize. You remove the filter if you:

• Unpin it. In this case, the filter only remains on the currently open app, unpinned.
• Remove it from any place while it's still pinned.
• Refresh your session, for example by opening a dashboard in a new tab. Pinned filters are not saved along with the dashboard, visualization, or Discover session that you added them to.

Tip

When a pinned filter can't be applied, for example if a field specified in the filter doesn't exist in the current data view, the filter is ignored and shows in a different color.

Edit filter

Lets you edit and update the filter.

Exclude results and Include results

Reverses the filter behavior.

Temporarily disable and Re-enable

Lets you temporarily deactivate a filter instead of requiring you to remove it. This is particularly useful for testing different filter combinations.

Delete

Removes the filter.

You can perform most of these actions at once for all filters in your current view using the Filter icon . From the menu that opens, select Apply to all, then choose the action you'd like to perform.

Each visualization offers various options that you can use to customize its appearance:

• Style — Specifies how to display area, line, and bar chart options. For example, you can specify how to display the labels in bar charts.
• Labels — Specifies how to display the labels for donut charts, pie charts, and treemaps.
• Legend — Specifies how to display the legend. You can choose to display the legend inside or outside the visualization, truncate the legend values when they’re too long, and select additional statistics to show.
• Left axis, Bottom axis, and Right axis — Specify how you want to display the chart axes. For example, add axis labels and change the orientation and bounds.

You can customize the appearance of your visualizations with several options. To do that, look for the Style button.

These options can vary depending on the type of chart.

Area fill opacity

For Area charts. Opacity of the area fill. Defaults to 0.3.

Bar orientation

For Bar charts. Choose between Horizontal and Vertical.

Line interpolation

For Line charts. Choose how to interpolate the line between data points from the available options: Straight (default), Smooth, and Step.

Missing values

For Area and Line charts. Choose between Hide, Zero, Linear, Last, and Next. This option controls how gaps in data appear on the chart. By default, gaps are hidden.

Missing values include empty buckets and metrics: Buckets without documents or metrics that returned null due to their operation and data content.

Note

You can only use this option when the Include empty rows option of the chart is enabled or when a metric produces a null bucket. For example, if a moving average finds empty buckets.

• Hide: Don't show gaps in data.

  

• Zero: Fill gaps by connecting starting and ending data points to zero.

  

• Linear: Fill gaps by connecting related starting and ending data points together with a direct line.

  

• Last: Fill gaps between data points with a horizontal or vertical line that uses the last ending point value, when available, to determine its position.

  

• Next: Fill gaps between data points with a horizontal or vertical line that uses the next starting point value, when available, to determine its position.

  

End values

If you've chosen to show missing values, you can also decide to extend data series to the edge of the chart. By default, end values are hidden.

• Hide: Don't extend series to the edge of the chart.
• Zero: Extend series as zero to the edge of the chart.
• Nearest: Extend series with their first or last value to the edge of the chart.

Show as dotted line

If you've chosen to show missing values, you can turn on this option to show gaps as a dotted line.

Point visibility

For Area and Line charts. Use this option to show or hide data points. Set to Auto by default: Points are visible unless the distance between them is too short.

When creating or editing a visualization, you can customize several appearance options. To do that, look for the Style button.

Primary metric

Define the formatting of the primary metric in terms of Position, Alignment, and Font size.

Title and subtitle

Enter a subtitle and define the relevant Alignment and Font weight.

Secondary metric

Define the Alignment.

Other

Choose the Icon position.

Density

Make the table more or less compact. Choose between Compact, Normal (default), and Expanded.

Max header cell lines

The maximum number of lines that header cells can span over. If the content exceeds this limit and is truncated, an ellipsis indicates it.

Body cell lines

The fixed number of lines that body cells span over. If the content exceeds this limit and is truncated, an ellipsis indicates it.

Paginate table

Turn on this option to paginate the table. Pagination shows when the table contains at least 10 items, and lets you define how many items to display per page. When turned off, you can scroll through all items.

Donut hole

Display a Small, Medium, or Large hole at the center of the pie chart. Defaults to None.

Gauge shape

Define the shape of the gauge. Choose between Linear, Minor arc, Major arc, and Circle. When set to Linear, you can choose to display the chart horizontally or vertically.

Font size

Define the range of font sizes used in the tag cloud. The font size is based on the number of times a tag appears in the data.

Orientation

Define the orientation of the tags. Choose Single, Right angled, and Multiple.

Show label

Turn on this option to show a label for the tag cloud. You can define this label when defining the tags to show for the visualization, by customizing the Name field.

To customize the legend of your visualization, click the Legend icon in the layer pane.

×

Change the legend’s display

With the Visibility, Position, and Width options, you can adjust the way the legend appears in or next to the visualization.

Truncate long labels

With the Label truncation option, you can keep your legend minimal in case of long labels that span over multiple lines.

Show additional statistics for time series charts

To make your legends as informative as possible, you can show some additional Statistics for charts with a timestamp on one of the axes, and add a Series header.

Bar, Line and Area charts can show the following values:

• Average: Average value considering all data points in the chart
• Median: Median value considering all data points in the chart
• Minimum: Minimum value considering all data points in the chart
• Maximum: Maximum value considering all data points in the chart
• Range: Difference between min and max values
• Last value: Last value considering all data points in the chart
• Last non-null value: Last non-null value
• First value: First value considering all data points in the chart
• First non-null value: First non-null value
• Difference: Difference between first and last values
• Difference %: % difference between first and last values
• Sum: Sum of al values plotted in the chart
• Count: number of data points plotted in the chart
• Distinct Count: number of data points with different values plotted in the chart
• Variance: Variance of all data points plotted in the chart
• Std Deviation: Standard deviation of all data points plotted in the chart
• Current or last value: The exact value of the current or last data point moused over

All statistics are computed based on the selected time range and the aggregated data points shown in the chart, rather than the original data coming from Elasticsearch.

For example, if the metric plotted in the chart is Median(system.memory) and the time range is last 24 hours, when you show the Max statistic in the Legend, the value that shows corresponds to the Max[Median(system.memory)] for the last 24 hours.

×

When your visualization includes one data view, you can open and explore the visualization data in Discover.

To get started, click Explore data in Discover in the toolbar.

For more information about exploring your data with Discover, check out Discover.

To view the data included in the visualization and the requests that collected the data, use the Inspector.

1. In the toolbar, click Inspect.

2. Open the View dropdown, then click Data.

   1. From the dropdown, select the table that contains the data you want to view.
   2. To download the data, click Download CSV, then select the format type.

3. Open the View dropdown, then click Requests.

   1. From the dropdown, select the requests you want to view.
   2. To view the requests in Console, click Request, then click Open in Console.

For answers to common Lens questions, review the following.