Visualize your dataedit

In the Visualize application, you can shape your data using a variety of charts, tables, and maps, and more. In this tutorial, you’ll create four visualizations:

Pie chartedit

You’ll use the pie chart to gain insight into the account balances in the bank account data.

  1. Open Visualize to show the overview page.
  2. Click Create new visualization. You’ll see all the visualization types in Kibana.

    images/tutorial-visualize-wizard-step-1.png
  3. Click Pie.
  4. In Choose a source, select the ba* index pattern.

    Initially, the pie contains a single "slice." That’s because the default search matched all documents.

    To specify which slices to display in the pie, you use an Elasticsearch bucket aggregation. This aggregation sorts the documents that match your search criteria into different categories. You’ll use a bucket aggregation to establish multiple ranges of account balances and find out how many accounts fall into each range.

  5. In the Buckets pane, click Add > Split slices.

    1. In the Aggregation dropdown, select Range.
    2. In the Field dropdown, select balance.
    3. Click Add range four times to bring the total number of ranges to six.
    4. Define the following ranges:

      0             999
      1000         2999
      3000         6999
      7000        14999
      15000       30999
      31000       50000
  6. Click Apply changes images/apply-changes-button.png.

    Now you can see what proportion of the 1000 accounts fall into each balance range.

    images/tutorial-visualize-pie-2.png
  7. Add another bucket aggregation that looks at the ages of the account holders.

    1. At the bottom of the Buckets pane, click Add.
    2. For sub-bucket type, select Split slices.
    3. In the Sub aggregation dropdown, select Terms.
    4. In the Field dropdown, select age.
  8. Click Apply changes images/apply-changes-button.png.

    Now you can see the break down of the ages of the account holders, displayed in a ring around the balance ranges.

    images/tutorial-visualize-pie-3.png
  9. To save this chart so you can use it later, click Save in the top menu bar and enter Pie Example.

Bar chartedit

You’ll use a bar chart to look at the Shakespeare data set and compare the number of speaking parts in the plays.

  1. Create a Vertical Bar chart and set the search source to shakes*.

    Initially, the chart is a single bar that shows the total count of documents that match the default wildcard query.

  2. Show the number of speaking parts per play along the Y-axis.

    1. In the Metrics pane, expand Y-axis.
    2. Set Aggregation to Unique Count.
    3. Set Field to speaker.
    4. In the Custom label box, enter Speaking Parts.
  3. Click Apply changes images/apply-changes-button.png.
  4. Show the plays along the X-axis.

    1. In the Buckets pane, click Add > X-axis.
    2. Set Aggregation to Terms.
    3. Set Field to play_name.
    4. To list plays alphabetically, in the Order dropdown, select Ascending.
    5. Give the axis a custom label, Play Name.
  5. Click Apply changes images/apply-changes-button.png.

    images/tutorial-visualize-bar-1.5.png
  6. Save this chart with the name Bar Example.

    Hovering over a bar shows a tooltip with the number of speaking parts for that play.

    Notice how the individual play names show up as whole phrases, instead of broken into individual words. This is the result of the mapping you did at the beginning of the tutorial, when you marked the play_name field as not analyzed.

Coordinate mapedit

Using a coordinate map, you can visualize geographic information in the log file sample data.

  1. Create a Coordinate map and set the search source to logstash*.

    You haven’t defined any buckets yet, so the visualization is a map of the world.

  2. Set the time.

    1. In the time filter, click Show dates.
    2. Click the start date, then Absolute.
    3. Set the Start date to May 18, 2015.
    4. In the time filter, click now, then Absolute.
    5. Set the End date to May 20, 2015.
  3. Map the geo coordinates from the log files.

    1. In the Buckets pane, click Add > Geo coordinates.
    2. Set Aggregation to Geohash.
    3. Set Field to geo.coordinates.
  4. Click Apply changes images/apply-changes-button.png.

    The map now looks like this:

    images/tutorial-visualize-map-2.png
  5. Navigate the map by clicking and dragging. Use the controls on the left to zoom the map and set filters.
  6. Save this map with the name Map Example.

Markdownedit

The final visualization is a Markdown widget that renders formatted text.

  1. Create a Markdown visualization.
  2. Copy the following text into the text box.

    # This is a tutorial dashboard!
    The Markdown widget uses **markdown** syntax.
    > Blockquotes in Markdown use the > character.
  3. Click Apply changes images/apply-changes-button.png.

    The Markdown renders in the preview pane.

    images/tutorial-visualize-md-2.png
  4. Save this visualization with the name Markdown Example.