Kibana Dashboards: Visualizations, Lens & Discover

In this tutorial, you'll learn about Kibana Dashboards: Visualizations, Lens & Discover. We cover key concepts, practical examples, and best practices to help you understand and apply this topic effectively.

Kibana is the visualization frontend of the ELK Stack, providing tools to explore log data in Discover, build charts with Lens, combine visualizations into dashboards, and create alerts based on search conditions.

What You'll Learn

In this tutorial, you will use Kibana Discover to search logs, create visualizations with Lens, build a multi-panel dashboard, and configure alerts for real-time monitoring.

Why It Matters

Elasticsearch stores your logs, but raw JSON documents are not useful for operations. Kibana transforms log data into actionable insights. A well-designed dashboard shows error rates, slow endpoints, geographic distribution of traffic, and infrastructure health at a glance, enabling faster incident detection and troubleshooting.

Real-World Use

Durga Antivirus Pro uses a Kibana dashboard to monitor scan operations across thousands of endpoints. The dashboard includes a line chart of scan throughput, a table of top threats by count, a map of scan origins, and a metric showing the percentage of scans that detected malware. The team uses this dashboard as their primary operational tool.

Step 1: Create an Index Pattern

Before using Kibana, create an index pattern that matches your Elasticsearch indices:

1. Go to Stack Management > Kibana > Index Patterns
2. Click Create Index Pattern
3. Enter logs-* as the pattern (matches indices like logs-2026.06.21)
4. Select @timestamp as the time field
5. Click Create Index Pattern

Now Kibana can discover and visualize data from all indices matching logs-*.

Step 2: Explore Logs with Discover

Navigate to the Discover section. You see a histogram of log events over time and a table of recent documents.

Use the search bar to filter logs. The Kibana Query Language (KQL) provides simple syntax:

level: "ERROR" AND status_code >= 500

Add filters using the field sidebar. Click a field value to filter by it. Save searches for reuse in dashboards.

Step 3: Create Visualizations with Lens

Lens is a drag-and-drop visualization Builder. Go to Visualize > Create Visualization > Lens.

Drag the status_code field to the workspace. Kibana suggests a bar chart. Customize it:

• Metrics: Count of records
• Buckets: Terms aggregation on status_code.keyword
• Breakdown: Date histogram on @timestamp

The chart shows how many logs each status code has over time. 500 errors on the rise indicate a problem.

Step 4: Build a Dashboard

Create a dashboard in the Dashboard app. Add visualizations:

• Error rate over time -- line chart of 5xx vs 2xx counts
• Top error messages -- table of most frequent error messages
• Request volume by service -- pie chart by service.keyword
• Response time -- metric showing average duration_ms

Arrange panels on a grid. Set a time range in the top right. Save the dashboard for daily use.

Step 5: Create Alerts

Kibana alerts watch Elasticsearch queries and trigger actions:

1. Go to Stack Management > Alerts and Insights > Rules
2. Click Create Rule
3. Select Elasticsearch Query
4. Define a query: level: "ERROR" AND status_code >= 500
5. Set a schedule: check every 5 minutes
6. Add an action: Slack Webhook or email

When the query returns results, Kibana sends a notification.

Common Mistakes

1. Forgetting to Set a Time Field

Without a time field configured in the index pattern, time-based features like date histograms and time filtering do not work.

2. Using Too Many Aggregations

Heavy aggregations on large datasets cause slow dashboard loads. Use filters to limit the time range and data volume.

3. Not Using Dashboard Filters

Global dashboard filters apply to all panels. Use them to filter by environment, service, or time instead of adding filters to each panel.

4. Ignoring Lens Suggestions

Lens auto-suggests visualization types based on your data. Try the suggestions before building manually.

5. No Alert Threshold Tuning

Alert thresholds that are too sensitive cause false alarms. Set appropriate thresholds and use a burn rate approach for meaningful alerts.

Practice Questions

1. What is an index pattern in Kibana? A pattern that matches one or more Elasticsearch indices, defining which data Kibana can search and visualize.

2. What is Lens in Kibana? A drag-and-drop visualization Builder that creates charts and graphs without requiring knowledge of the Elasticsearch Query DSL.

3. How do you filter logs in Kibana Discover? Use the KQL search bar with queries like level: "ERROR" or click field values to add filters.

4. What is the purpose of Kibana alerts? They watch Elasticsearch queries on a schedule and trigger actions (Slack, email) when conditions are met.

5. Challenge: Build a dashboard that shows request volume by status code, latency percentiles, top slow endpoints, and an alert for 5xx errors exceeding 1% of traffic, all filtered by a service dropdown.

What's Next

Deploy Filebeat as a lightweight log shipper to forward logs from your servers to Logstash or directly to Elasticsearch.

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro.