Kibana in 10 minutes (Visualisation)

In the previous article (HOWTO: Installing Kibana) we looked at how to install and configure Elasticsearch and Kibana to work. Now, all ready to go and you can explore Kibana, a tool built on top of Elasticsearch, allowing you to create elaborate dashboards and explore the data sets.

Load Data

For further work we need to load the data. Take the dataset represented on the official site of kibana. We will be using the entire collected works of Shakespeare.

Create a the index shakespeare and import the data:

curl -XPUT http://localhost:9200/shakespeare -d '
{
 "mappings" : {
  "_default_" : {
   "properties" : {
    "speaker" : {"type": "string", "index" : "not_analyzed" },
    "play_name" : {"type": "string", "index" : "not_analyzed" },
    "line_id" : { "type" : "integer" },
    "speech_number" : { "type" : "integer" }
   }
  }
 }
}
';
curl -XPUT localhost:9200/_bulk --data-binary @shakespeare.json

To get the file with the data, go shakespeare.json

To access the interface Kiba enter into your browser http://localhost: 5601/. In the beginning we will redirect to the page setup of the index, where we can indicate the index our data: shakespeare.

kibana_in_10_minutes

Kibana allows you to search Elasticsearch data via the Lucene Query String syntax. Queries can be run via the query input at the top of the page.Type this in the query bar. Then check out the first few rows of the table. Type this in the query bar. Then check out the first few rows of the table.

friends, romans, countrymen


kibana_in_10_minutes

Visualization

We consider the following visualization tools: Pie chart, Bar chart, Line chartand the Area chart.

Pie Chart

Here we will find out which character has the five plays with the most lines.

  1. Click on visualize in the tabs, select pie chart.
  2. Create a new search, and select split chart.
  3. Select "Terms" as the aggregation, with the field set to "play_name".
  4. Click "Add Sub Aggregation". Select pie chart.
  5. For the sub aggregation, select terms, and for the field select "speaker".
  6. The default aggregation is limited to 5, change for order to select the top 3.

kibana

More visually the diagram can be drawn if the step 4 to select instead of a "pie chart", "split slices".

kibana

Then see how to build a bar chart

Then see how to build a bar chart. For this purpose we search for the most common words of Shakespeare used in his plays.

  1. Create another visualization, but this time select vertical bar chart.
  2. Select x-axis for the bucket, and "Terms" for the aggregation
  3. Choose "text_entry" as the field and return the top 50 results.
  4. We are only interested in meaningful words, so choose words from 5 to 10 letters:
    • Click on advanced, and you’ll see the include pattern. Include pattern allows you to use Java’s Regex class to specify what should be in the string.
    • Select case-insensitive. this will ignore cases.
    • For the pattern use ([a-z]){5,10}. This says return any grouping of letters that are between five and ten characters long.

kibana

Now we can see that the most common word between 5 and 10 Shakespeare used in his plays, is shall.

Line chart and Area chart

These types of graphs are not well suited for the analysis of the available data, but we can see how they are created.

Create Line chart and an Area chart is almost the same as creating a Bar chart. You need only to select the desired types when creating visualization. Choose the aggregation of Terms and field speaker and as a result we obtain the following graphs.

kibana kibana

Any visualization you can save by clicking the Save button in the upper right corner above the visualization. Then you can show its on the dashboard with the help of a proposal that appears on a blank dashboard.

kibana

Or by clicking the button Add visualization on the dashboard in the upper right corner.

The dashboard also saved.

Thank you devote the time to read the article. I hope this information will help you to learn a powerful instrument such as Kibana.

Comments 0

Add a new comment: