How to build Kibana dashboards with MCP and ES|QL

Observe, protect, and search your data with a single solution. From application monitoring to threat detection, Kibana is your versatile platform for critical use cases. Start your free 14-day trial now.

example-mcp-dashbuilder is an open source MCP application that turns a plain-English prompt into a live, interactive Kibana dashboard, all inside your editor's chat window. Describe the dashboard you want, and the AI discovers your index structure, writes correct ES|QL aggregations for each visualization, and renders a preview inline as it works. When you're done, one command exports a fully functional Kibana dashboard: real Lens visualizations, your exact grid layout, custom colors preserved. Six chart types are supported today, with the full Kibana Lens set on the roadmap.

What is a Kibana dashboard builder?

What if you could describe the dashboard you want in plain English and watch it appear, complete with interactive charts, a drag-and-drop layout, and one-click export to Kibana?

That's exactly what example-mcp-dashbuilder does. It's an open source (Model Context Protocol (MCP) application that connects AI assistants to Elasticsearch, letting you create full Kibana Dashboards through conversation. No clicking through menus. No manually writing visualization configs. Just describe what you need, and the AI explores your data, writes the Elasticsearch Query Language (ES|QL) queries, builds the charts, and delivers a live, interactive dashboard, all within your editor's chat window.

From prompt to dashboard in seconds

Here's what it looks like in practice. You type something like:

"Build me a web traffic dashboard from logstash-* with total requests, bytes transferred over time, top geographic sources, and a response code breakdown"

The AI then:

Discovers your data: Lists indices, inspects field mappings.
Writes ES|QL queries: Tailored to your schema, using the right aggregations.
Creates visualizations: Bar charts, line charts, metrics with sparklines, heatmaps, pie charts.
Organizes everything: Collapsible sections, meaningful titles, proper layout.
Renders an interactive preview: Right in the chat, with tooltips, a time picker, and drag-and-drop.

Each chart appears inline as it's created, so you can see progress in real time. Then view_dashboard shows the complete dashboard with all panels laid out in Kibana's 48-column grid.

Two charts displayed in the example‑mcp‑dashbuilder interface. The first is a vertical bar chart titled “Top geographic sources,” showing request counts by country code. The second is a pie chart titled “HTTP response code breakdown,” showing segments for 200, 404, and 503 responses.

Single chart preview inline.

Powered by ES|QL

All data retrieval uses ES|QL, Elasticsearch's piped query language. The AI doesn't just pass through raw queries, it also uses built-in knowledge of ES|QL syntax along with information on the structure of your data to write correct, efficient queries for each visualization type.

The server includes a comprehensive ES|QL reference as an MCP resource. Before writing any query, the AI reads this reference to understand the available commands, functions, and patterns. Combined with a dataviz best-practices guide (also served as a resource), the AI knows not just how to query, but what makes a good visualization:

Use BUCKET(@timestamp, 1 day) for time series; always SORT by the time field.
Limit pie charts to six slices with | SORT value DESC | LIMIT 6.
Choose bar charts for category comparisons, line charts for trends, metrics for key performance indicators (KPIs).

AI-driven data exploration with open-ended analysis

Building a dashboard you've already designed in your head is one thing. Asking "What's interesting in this index?" and getting a useful answer is harder; it requires the AI to know how to explore, not just how to draw.

example-mcp-dashbuilder ships an analysis://guidelines resource that defines a structured exploration flow: Profile the data, run targeted aggregations, surface patterns worth investigating, build charts for the most interesting findings, and propose drill-down queries the user might want next. Trigger phrases, like "analyze my logs" or "find patterns in this index," cause the AI to read the playbook before doing anything else, so an open-ended prompt produces a coherent investigation rather than a random pile of charts.

The result: You can hand the AI an unfamiliar index and get back a starting point: a dashboard plus a short list of "Here's what I noticed, want me to dig into any of these?" prompts.

Kibana dashboard export and import: the full round trip

The export/import round trip is where example-mcp-dashbuilder becomes genuinely useful for teams already working in Kibana.. example-mcp-dashbuilder is its own thing, a conversational dashboard surface that lives inside your editor, but it doesn't trap your work there. Dashboards built here can move into Kibana when you want them to, and existing Kibana dashboards can come the other way for AI-assisted editing.

Export to Kibana

When you're happy with your dashboard, one command exports it:

"Export this dashboard to Kibana"

Every panel is translated to a real Kibana Lens visualization. The translation preserves:

ES|QL queries: Transferred directly as Lens ES|QL data sources.
Grid positions: The same 48-column system Kibana uses, so your layout looks identical.
Custom colors: Series palettes, metric backgrounds, heatmap color ramps.

The result is a fully functional Kibana dashboard. Not a screenshot. Not an embed. A real dashboard you can share and continue editing in Kibana.

Two dashboards are shown side by side. The left dashboard titled “Editing Web traffic — Logstash (Dashbuilder)” displays recent traffic metrics, along with a traffic volume panel, a geographic bar chart, and a response‑code pie chart. The right dashboard shows a similar layout with higher totals and includes a traffic volume panel, a geographic bar chart, and a response‑code pie chart.

Kibana dashboard and dashboard in Cursor chat side by side.

Import from Kibana

The round trip works in the other direction too:

"Import the Kibana dashboard with ID abc-123"

This fetches an existing Kibana dashboard, translates its Lens visualizations back to editable chart configs, preserves the grid layout and sections, and loads everything into example-mcp-dashbuilder. From there, you can modify it with natural language and re-export.

This makes the AI a collaborator in your existing Kibana workflow, not a replacement for it.

Custom themes and colors

Want a branded dashboard? Just ask:

"Create a pink-themed dashboard with custom colors"

Every visualization type supports custom color configuration:

Charts: palette accepts an array of hex colors for series and slices.
Metrics: color sets the background color.
Heatmaps: colorRamp defines the gradient, from low to high values.

The AI picks up on theme requests naturally. Say, "Ocean theme," and it'll choose blues and teals. Say, "Match our brand colors" and provide hex values, and they'll carry through to Kibana on export.

A themed ecommerce dashboard with custom pink colors. The layout shows revenue and order KPIs at the top, a collapsed trends section, and two category‑based charts below: a bar chart for revenue by category and a pie chart for orders by category.

A themed dashboard with custom colors.

How example-mcp-dashbuilder works: MCP architecture

example-mcp-dashbuilder is built on MCP, the open standard for connecting AI assistants to external tools and data. Here's the architecture at a high level:

An architecture diagram showing the MCP Host connected to the MCP Server, which contains tools, resources, and instructions. Below it, an MCP App box includes Elastic Charts and Kibana’s grid layout. Elasticsearch and Kibana appear at the bottom with arrows connecting them to the MCP App.

The MCP server exposes 25 tools that the AI can call directly, everything from running ES|QL queries to exporting dashboards, alongside a handful of internal "app-only" tools that the inline preview uses to fetch data, persist layout changes, and detect time fields. It serves three resources: a dataviz best-practices guide, an ES|QL reference, and a deep-analysis playbook that kicks in for open-ended prompts ("analyze my logs", "what's interesting in this index"). And it runs over either stdio or HTTP; the HTTP transport supports streamable responses and session management, so multiple clients can connect to one server.

The MCP App is the interactive preview. It's built with React, Elastic Charts, and Elastic UI, bundled into a single self-contained HTML file. When the AI calls view_dashboard or creates a chart, the host renders this HTML in a sandboxed iframe. The app communicates with the server entirely through the MCP Apps protocol, using callServerTool() over postMessage to fetch data, save layouts, and detect time fields. There's no localhost server, no port to configure, no external network dependency.

This means it works with any MCP-compatible client: Cursor, Claude Desktop, Claude.ai, VS Code with Copilot, and more.

What chart types does example-mcp-dashbuilder support?

At time of writing, six chart types that cover the most common dashboard scenarios are supported:

Type	Best for	Example
Bar	Comparing categories	Requests by geographic source
Line	Trends over time	Bytes transferred per hour
Area	Volume over time	Request volume over time
Pie	Part-of-whole (max six slices)	Response code distribution
Metric	Single KPI with sparkline	Total requests with hourly trend
Heatmap	Patterns across two dimensions	Requests by day of week and hour

Dashboards support collapsible sections for organization, a time picker with automatic time field detection,and the ability to save and switch between multiple dashboards; parallel chat sessions stay isolated from each other via a dashboardId threaded through every tool call.

How to install and run example-mcp-dashbuilder

example-mcp-dashbuilder is open source and ready to use. You'll need Node.js 22+, an Elasticsearch instance (local or Elastic Cloud), and an MCP-compatible client.

Claude Desktop: Download the latest .mcpb from GitHub Releases, and double-click it. Claude Desktop will prompt you for your Elasticsearch credentials.

Cursor / Claude Code / VS Code Copilot: Point your MCP config at the released tarball; no clone, no npm install:

Set ES_NODE, ES_API_KEY (or ES_USERNAME / ES_PASSWORD) and KIBANA_URL as environment variables. If you'd rather work from source, clone the repo and run npm run setup for an interactive wizard that handles both local Elasticsearch and Elastic Cloud (Cloud ID + API key).

And start building:

"Explore the logs index and build me the most insightful dashboard you can"

The AI takes it from there. 😉

Roadmap: what's coming to example-mcp-dashbuilder

This is an early release, and we're actively developing it. Some areas we're focused on:

More chart types: Gauge, donut, treemap, data table, and tag cloud to match Lens's full capabilities.
Push dashboards to Git: Write dashboard configurations into a repository for version control and code-review workflows.
Better error UX: More detailed feedback when ES|QL queries fail, with suggestions for common fixes.
Richer analysis flows: Extending the deep-analysis playbook to cover more data shapes (logs, metrics, traces).

We'd love to hear what you build with it. Try it out, file issues, and let us know what visualizations and workflows would be most useful for your team.

GitHub: elastic/example-mcp-dashbuilder

Acknowledgments

Thanks to Walter Rafelsberger and Tim Schnell for their contributions to the implementation.

FAQ

What is example-mcp-dashbuilder? example-mcp-dashbuilder is an open source MCP (Model Context Protocol) application that connects AI assistants to Elasticsearch. It lets you describe a Kibana dashboard in plain English and automatically generates ES|QL queries, creates visualizations, and delivers a live interactive dashboard inside your editor's chat window.

What query language does example-mcp-dashbuilder use to retrieve data? All data retrieval uses ES|QL, Elasticsearch's piped query language. The MCP server includes a built-in ES|QL reference that the AI reads before writing any query, ensuring correct syntax and efficient aggregations for each visualization type.

Can I export dashboards built with example-mcp-dashbuilder to Kibana? Yes. Running "Export this dashboard to Kibana" translates every panel into a real Kibana Lens visualization, preserving ES|QL queries, the 48-column grid layout, custom colors and series palettes. The result is a fully functional Kibana dashboard, not a screenshot or embed.

Can I import an existing Kibana dashboard into example-mcp-dashbuilder for AI-assisted editing? Yes. Providing a Kibana dashboard ID fetches the existing dashboard, translates its Lens visualizations into editable chart configurations, and loads them into example-mcp-dashbuilder. You can then modify the dashboard using natural language and re-export to Kibana.

Which MCP clients are compatible with example-mcp-dashbuilder? example-mcp-dashbuilder works with any MCP-compatible client, including Cursor, Claude Desktop, Claude.ai, and VS Code with Copilot. It supports both stdio and HTTP transport, with no localhost server or port configuration required.

What chart types does example-mcp-dashbuilder support? The current release supports six chart types: bar, line, area, pie, metric (with sparkline), and heatmap. Planned additions include gauge, donut, treemap, data table, and tag cloud to match Kibana Lens's full capabilities.

What do I need to run example-mcp-dashbuilder? You need Node.js 22 or higher, an Elasticsearch instance (local or Elastic Cloud), and an MCP-compatible client. Set the environment variables ES_NODE, ES_API_KEY (or ES_USERNAME/ES_PASSWORD), and KIBANA_URL. For Claude Desktop, download the .mcpb file from GitHub Releases and double-click to install.