Lensedit
To create visualizations with Lens, you drag and drop data fields onto the visualization builder, then Lens uses heuristics to apply each field.
Open and set up Lensedit
Open Lens, then explore the fields in your data. The list of fields are determined by the index pattern and time filter.
- On the dashboard, click Create panel.
- On the New visualization window, click Lens.
- Set the time filter.
- To view the fields in the a different index pattern, click the index pattern, then select a different index pattern from the dropdown.
-
Scan through the list of fields to see what’s in your data.
For sparse datasets, Empty fields can contain data, which you can use to create visualizations.
-
To filter the data fields, use the following options:
- Enter the field name in the Search field names field.
- Click Field by type, then select the filter. To show all fields in the index pattern, deselect Only show fields with data.
View the data summariesedit
For each field, Lens displays a summary depending on the type of data. To analyze the fields, Lens uses a sample of 5,000 documents. Each summary displays the percentage of sampled documents over all available documents.
To view a data summary, click i next to the field.
Each data type display the following summaries:
- Date — Displays the time distribution.
- String — Displays the top 10 values.
- Numeric — Displays the top 10 values and a value distribution. When Lens displays the top 10 values distribution, the percentage of Other values is also displayed. For array value fields, the percentage distribution considers each value in the array as separate.
Other can equal more than 100% by a small amount.
Create the visualization paneledit
Drag and drop the fields on to the visualization builder, then
- Drag and drop the fields to the visualization builder.
-
To change the visualization type, use the following options:
- Click the Suggestions.
- From the Chart Type dropdown, click the visualization.
- To configure the data, use the editor, then click Close.
-
To configure the visualization, use the dropdown menus.
Create visualization panels with keyboard navigationedit
Lens has a fully accessible, continuously improved drag and drop system, which allows you to use a keyboard instead of a mouse.
-
Set a focus on the chosen item. Most of the draggable elements have two focus states. The inner focus state opens a panel with detailed information or options. The outer focus state allows you to drag an item. Tab through the page until you get the outer focus state on the chosen item:
-
Complete the following actions:
- To start dragging an item, press Space bar.
- To select where you want to drop the item, use the Left and Right arrows.
- To reorder the fields in the group, use Up and Down arrows.
-
To duplicate an operation, use the Left and Right arrows to select the
Drop a field or click to addin the same group.
- Press Space bar to confirm, or to cancel, press Esc.
Frequently asked questionsedit
For the answers to common Lens questions, review the following.
When should I use the Filter function instead of KQL filters?edit
The easiest way to apply KQL filters is to use Semi-structured search, but you can also use the Filters function in the following scenarios:
- When you want to apply more than one KQL filter to the visualization.
- When you want to apply the KQL filter to a single layer, which allows you to visualize filtered and unfiltered data.
When should I normalize the data by unit or use a custom interval?edit
- Normalize by unit — Calculates the average for the specified interval. When you normalize the data by unit, the data appears less granular, but Lens is able to calculate the data faster.
- Customize time interval — Creates a bucket for each specified interval. When you customize the time interval, you can use a large time range, but Lens calculates the data slower.
To normalize the interval:
- In the editor, click a field.
- Click Add advanced options > Normalize by unit.
- From the Normalize by unit dropdown, select an option, then click Close.
To create a custom interval:
- In the editor, click a field.
- Select Customize time interval.
- Change the Minimum interval, then click Close.
How do I display value labels?edit
A subset of Lens visualizations support value labels.
-
Bar and Horizontal Bar
-
Pie, Donut, and Treemap
What data is categorized as Other?edit
The Other category contains all of the documents that do not match the specified criteria or filters. Use Other when you want to compare a value, or multiple values, to a whole. By default, Group other values as "Other" is enabled when you select the Top values function.
To disable Group other values as "Other":
- In the editor, click Advanced.
- Deselect Group other values as "Other".
How can I include documents without the field?edit
By default, Lens retrieves only the documents from the specified field. For bucket aggregations, such as Top values, you can choose to include documents that do not contain the specified field, which is helpful when you want to compare to the whole documentation set.
- In the editor, click Advanced.
-
Select Include documents without this field.
How do I change the color for a single data point?edit
Lens provides you with color pallettes that you can apply to the entire visualization, but you are unable to change the color for a single data point, such as a bar or line.
How do I sort by multiple columns?edit
Multiple column sorting is unsupported in Lens, but is supported in Discover. For information on how to sort multiple columns in Discover, refer to Explore the fields in your data.
How do I sort the dimensions in a chart?edit
Sorting dimensions in visualizations is unsupported in Lens.
How do I visualize saved searches?edit
Visualizing saved searches in unsupported in Lens.
How do I change the number of suggestions?edit
Configuring the Suggestions that Lens automatically populates is unsupported.