Create visualizations with Lensedit

To create a visualization, drag the data fields you want to visualize to the workspace, then Lens uses visualization best practices to apply the fields and create a visualization that best displays the data.

With Lens, you can:

  • Create area, line, and bar charts with layers to display multiple indices and chart types.
  • Change the aggregation function to change the data in the visualization.
  • Perform math on aggregations using Formula.
  • Use time shifts to compare the data in two time intervals, such as month over month.
  • Create custom tables.

Create visualizationsedit

If you’re unsure about the visualization type you want to use, or how you want to display the data, drag the fields you want to visualize onto the workspace, then let Lens choose for you.

If you already know the visualization type you want to use, and how you want to display the data, use the following process:

Choose the visualization type.

  1. Before you drag fields to the workspace, open the Chart type dropdown, then select the visualization type.
  2. To view more visualizations that Lens automatically created for the fields, click Suggestions. If one of the Suggestions meets your visualization needs, click Save and return to add it to the dashboard.

Choose the data you want to visualize.

  1. Drag the fields directly to the layer pane. Lens automatically selects the aggregation function.
  2. If you want to learn more about the data a field contains, click the field.

Edit and delete.

  1. To change the aggregation Quick function and display options, click the field in the layer pane.
  2. To delete a field, close the configuration options, then click X next to the field.

Change the fields listedit

Change the fields list to display a different index pattern, different time range, or add your own fields.

  • To create a visualization with fields in a different index pattern, open the Change index pattern dropdown, then select the index pattern.
  • If the fields list is empty, change the time filter.
  • To add fields, open the action menu (…​) next to the Change index pattern dropdown, then select Add field to index pattern.

    Dropdown menu located next to index pattern field with items for adding and managing fields

    For more information about adding fields to index patterns and examples, refer to Explore your data with runtime fields.

Create custom tablesedit

Tables are highly customizable, and provide you with text alignment, value formatting, coloring options, and more.

  1. From the Chart type dropdown, select Table.
  2. Drag the fields you want to visualize to the workspace.
  3. To sort or hide the columns, click the arrow next to the column heading, then select an option.

    All columns that belong to the same layer pane group are sorted in the table.

  4. To change the display options, click a Metrics field, then configure the following options:

    • Display name — Specifies the field display name.
    • Value format — Specifies how the field value displays in the table.
    • Text alignment — Aligns the values in the cell to the Left, Center, or Right.
    • Hide column — Hides the column for the field.
    • Summary row — Adds a row that displays the summary value. When specified, allows you to enter a Summary label.
    • Color by value — Applies color to the cell or text values. To change the color, click Edit.

Create visualizations with keyboard navigationedit

To use a keyboard instead of a mouse, use the Lens fully accessible and continuously improved drag system.

Presented Lens drag and drop
  1. Select the field in the fields list or layer pane. Most fields have an inner and outer select state. The inner state opens a panel with detailed information or options. The outer state allows you to drag the field. Tab through the fields until you get the outer state on the field.

    Lens drag and drop focus state
  2. Complete the following actions:

    • To select a field, press Space bar.
    • To select where you want to drop the field, use the Left and Right arrows.
    • To reorder the fields on the layer pane, use the Up and Down arrows.
    • To duplicate an action, use the Left and Right arrows, then select the Drop a field or click to add field you want to use.

      Using drag and drop to reorder
  3. To confirm the action, press Space bar. To cancel, press Esc.

Use formulas to perform mathedit

Formulas allow you to perform math on aggregated data. The most common formulas divide two values to produce a percent.

  1. In the layer pane, click a field.
  2. Click Formula, then enter the formula.

    Filter ratio example

    To filter a document set, use kql='', then compare to other documents within the same grouping:

    count(kql='response.status_code > 400') / count()
    Week over week example

    To get the value for each grouping from the previous week, use shift='1w'.

    percentile(system.network.in.bytes, percentile=99) /
    percentile(system.network.in.bytes, percentile=99, shift='1w')

    You are unable to combine different time shifts, such as count(shift="1w") - count() and count(shift="1w") - count(shift="1m"), with the Top values function.

    Percent of total example

    To convert each grouping into a percent of the total, formulas calculate overall_sum for all groupings:

    sum(products.base_price) / overall_sum(sum(products.base_price))

    For detailed information on formulas, click Formula reference icon.

  3. To accurately display the formula, select Percent from the Value format dropdown.

Compare differences over timeedit

Compare your real-time data set to the results that are offset by a time increment. For example, you can compare the real-time percentage of a user CPU time spent to the results offset by one hour.

  1. In the layer pane, click the field you want to offset.
  2. From the Add advanced options dropdown, select Time shift.
  3. Select the time offset increment.

For a time shift example, refer to Compare time ranges.

Apply filtersedit

You can use the KQL query bar to focus on a known set of data for the entire visualization, or use the filter options from the layer pane or legend.

Apply multiple KQL filtersedit

With the Filters function, you can apply more than one KQL filter, and apply a KQL filter to a single layer so you can visualize filtered and unfiltered data at the same time.

  1. In the layer pane, click a field.
  2. Click the Filters function.
  3. Click Add a filter, then enter the KQL filter you want to apply.

    To try the Filters function on your own, refer to Compare a subset of documents to all documents.

Apply a single KQL filteredit

With the Filter by advanced option, you can assign a color to each filter group in Bar and Line and area visualizations, and build complex tables. For example, to display failure rate and the overall data.

  1. In the layer pane, click a field.
  2. Click Add advanced options, then select Filter by.
  3. Enter the KQL filter you want to apply.
Apply legend filtersedit

Apply filters to visualizations directly from the values in the legend. Bar, Line and area, and Proportion visualizations support legend filters.

In the legend, click the field, then choose one of the following options:

  • Filter for value — Applies a filter that displays only the field data in the visualization.
  • Filter out value — Applies a filter that removes the field data from the visualization.

Configure the visualization componentsedit

Each visualiztion type comes with a set of components that you access from the editor toolbar.

The following component menus are available:

  • Visual options — Specifies how to display area, line, and bar chart options. For example, you can specify how to display the labels in bar charts.
  • Labels — Specifies how to display the labels for donut charts, pie charts, and treemaps.
  • Legend — Specifies how to display the legend. For example, you can display the legend inside the visualization and truncate the legend values.
  • Left axis, Bottom axis, and Right axis — Specify how you want to display the chart axes. For example, add axis labels and change the orientation and bounds.
Save and add the paneledit

Save the panel to the Visualize Library and add it to the dashboard, or add it to the dashboard without saving.

To save the panel to the Visualize Library:

  1. Click Save to library.
  2. Enter the Title and add any applicable Tags.
  3. Make sure that Add to Dashboard after saving is selected.
  4. Click Save and return.

To save the panel to the dashboard:

  1. Click Save and return.
  2. Add an optional title to the panel.

    1. In the panel header, click No Title.
    2. On the Customize panel window, select Show panel title.
    3. Enter the Panel title, then click Save.

Frequently asked questionsedit

For answers to common Lens questions, review the following.

When should I normalize the data by unit or use a custom interval?
  • Normalize by unit — Calculates the average for the interval. When you normalize the data by unit, the data appears less granular, but Lens is able to calculate the data faster.
  • Customize time interval — Creates a bucket for each interval. When you customize the time interval, you can use a large time range, but Lens calculates the data slower.

To normalize the interval:

  1. In the layer pane, click a field.
  2. Click Add advanced options > Normalize by unit.
  3. From the Normalize by unit dropdown, select an option, then click Close.

To create a custom interval:

  1. In the layer pane, click a field.
  2. Select Customize time interval.
  3. Change the Minimum interval, then click Close.
What data is categorized as Other?

The Other category contains all of the documents that do not match the specified criteria or filters. Use Other when you want to compare a value, or multiple values, to a whole.

By default, Group other values as "Other" is enabled when you use the Top values function.

To disable Group other values as "Other", click a field in the layer pane, click Advanced, then deselect Group other values as "Other".

How do I add documents without a field?

By default, Lens retrieves only the documents from the fields. For bucket aggregations, such as Top values, you can add documents that do not contain the fields, which is helpful when you want to make a comparison to the whole documentation set.

  1. In the layer pane, click a field.
  2. Click Advanced, then select Include documents without this field.
When do I use runtime fields vs. formula?

Use runtime fields to format, concatenate, and extract document-level fields. Runtime fields work across all of Kibana and are best used for smaller computations without compromising performance.

Use formulas to compare multiple Elasticsearch aggregations that can be filtered or shifted in time. Formulas apply only to Lens panels and are computationally intensive.

Can I add more than one y-axis scale?

For each y-axis, you can select Left and Right, and configure a different scale.

Why is my value the incorrect color when I use value-based coloring?

Here’s a short list of few different aspects to check:

  • Make sure the value falls within the desired color stop value defined in the panel. Color stop values are "inclusive".
  • Make sure you have the correct value precision setup. Value formatters could round the numeric values up or down.
  • Make sure the correct color continuity option is selected. If the number is below the first color stop value, a continuity of type Below or Above and below range is required.
  • The default values set by the Value type are based on the current data range displayed in the data table.

    • If a custom Number configuration is used, check that the color stop values are covering the current data range.
    • If a Percent configuration is used, and the data range changes, the colors displayed are affected.
How do I sort by multiple columns?

Multiple column sorting is unsupported, but is supported in Discover. For information on how to sort multiple columns in Discover, refer to Explore the fields in your data.

Why is my field missing from the fields list?

The following field types do not appear in the Available fields list:

  • Full-text
  • geo_point
  • flattened
  • object

Verify if the field appears in the Empty fields list. Lens uses heuristics to determine if the fields contain values. For sparse data sets, the heuristics are less precise.

What do I do with gaps in time series visualizations?

When you create Area and Line charts with sparse time series data, open Visual options in the editor toolbar, then select a Missing values option.

Can I statically define the y-axis scale?

You can set the scale, or bounds, for area, bar, and line charts. You can configure the bounds for all functions, except Percentile. Logarithmic scales are unsupported.

To configure the bounds, use the menus in the editor toolbar. Bar and area charts required 0 in the scale between Lower bound and Upper bound.

Is it possible to display icons in data tables?

You can display icons with field formatter in data tables.

How do I visualize saved searches?

Visualizing saved searches in unsupported.

How do I change the number of suggestions?

Configuring the Suggestions is unsupported.

Is it possible to have pagination in a data table?

Pagination in a data table is unsupported. To use pagination in data tables, create an aggregation-based data table.

How do I change the color for a single data point?

Specifying the color for a single data point, such as a single bar or line, is unsupported.

How do I inspect Elasticsearch queries in visualizations?

You can inspect the requests sent by the visualization to Elasticsearch using the Inspector. It can be accessed within the editor or in the dashboard.

How do I isolate a single series in a chart?

For area, line, and bar charts, press Shift, then click the series in the legend. All other series are automatically unselected.