Kibana Dashboard: Create Elasticsearch Visualizations

Introduction

A Kibana dashboard is a collection of visualizations, charts, tables, and maps built on top of data stored in Elasticsearch.

It allows users to monitor, analyze, and explore data interactively. Kibana is part of the Elastic Stack and is commonly used for log analysis, application monitoring, and data analysis.

A dashboard can combine multiple visualizations into a single view, making it easier to identify trends, monitor application behavior, and investigate potential issues.

What Is a Kibana Dashboard?

A Kibana dashboard brings multiple visualizations together on one screen.

For example, an application-monitoring dashboard could contain:

+---------------------------------------------+
|          Website Monitoring Dashboard       |
+---------------------------------------------+
| Requests Over Time | HTTP Status Codes      |
|                    |                         |
+---------------------------------------------+
| Top Requested URLs                          |
|                                             |
+---------------------------------------------+
| Geographic Distribution                     |
|                                             |
+---------------------------------------------+

Each visualization is based on data available in Elasticsearch.

Steps to Create a Kibana Dashboard

Step 1: Log in to Kibana

Open the Kibana interface.

For a local installation, Kibana is commonly available at:

http://localhost:5601

The exact URL depends on your Kibana deployment and configuration.

After logging in, open the Kibana interface and navigate to the dashboard and visualization features.

Step 2: Prepare Data in Elasticsearch

Before creating visualizations, the required data must be available in Elasticsearch.

For a website-monitoring scenario, the data might contain fields such as:

{
  "timestamp": "2026-09-09T10:30:00Z",
  "url": "/products",
  "status_code": 200,
  "response_time": 125,
  "country": "India"
}

Possible fields include:

timestamp — when the request occurred
url — requested URL
status_code — HTTP response status
response_time — response time in milliseconds
country — visitor location

The actual field names and mappings depend on the application's Elasticsearch index.

Step 3: Create Visualizations

Kibana provides different visualization options for analyzing Elasticsearch data.

Depending on the Kibana version and enabled features, visualization functionality can be accessed through areas such as Visualize Library.

Common visualization types include:

Bar charts
Line charts
Pie or donut charts
Data tables
Maps

When creating a visualization, select the relevant Elasticsearch data source and configure the dimensions, metrics, filters, and time range required for the analysis.

Step 4: Create a Requests Over Time Visualization

For website monitoring, a line chart can be used to show request activity over time.

Configure the visualization using the timestamp field and an appropriate request-count metric.

The resulting chart can provide a view similar to:

Requests
  |
  |        /\       /\
  |       /  \     /  \
  |  /\  /    \___/    \
  |_/  \/               \__
  +----------------------------> Time

This can help identify traffic patterns and periods of increased activity.

Step 5: Create an HTTP Status Visualization

HTTP status codes can be visualized to understand the distribution of successful and unsuccessful requests.

For example:

200 -> Successful requests
404 -> Resource not found
500 -> Server error

A chart can group requests by status_code.

This can make changes in error rates easier to identify.

Step 6: Create a Top URLs Table

A table can be used to identify the most frequently requested URLs.

For example:

URL	Requests
`/products`	12,450
`/home`	9,820
`/orders`	7,340
`/login`	5,210

The exact values depend on the underlying Elasticsearch data.

This visualization can help identify which application endpoints receive the most traffic.

Step 7: Add Geographic Information

If the Elasticsearch documents contain suitable geographic information, a map visualization can be used to display visitor or event locations.

For example:

Country       Requests
India         12,400
USA            8,300
UK             4,100
Germany        2,900

The exact map configuration depends on how geographic data is stored and mapped in Elasticsearch.

Step 8: Create the Dashboard

Once the required visualizations have been created, navigate to:

Dashboard
    |
    +-- Create new dashboard

Use the Add option to add the visualizations to the dashboard.

A website-monitoring dashboard could contain:

+------------------------------------------------+
|              Website Monitoring                |
+------------------------------------------------+
| Requests Over Time | HTTP Status Distribution  |
|                    |                           |
+------------------------------------------------+
| Top Requested URLs                             |
|                                                |
+------------------------------------------------+
| Geographic Visitor Distribution                |
|                                                |
+------------------------------------------------+

The individual panels can be resized and arranged according to the monitoring requirements.

Step 9: Add Filters and Time Ranges

Dashboards become more useful when users can restrict the displayed data.

For example, a dashboard can be configured with a time range such as:

Last 15 minutes
Last 1 hour
Last 24 hours
Last 7 days

Filters can also be applied to specific fields.

For example:

status_code: 500

can be used to focus the analysis on server errors.

Step 10: Use KQL for Filtering

Kibana Query Language (KQL) can be used to filter Elasticsearch data in Kibana.

For example:

status_code: 500

can return documents where the status code is 500.

Another example is:

url: "/products"

which can be used to focus on requests for the /products URL.

KQL filters can be combined with dashboard visualizations to investigate specific conditions.

Step 11: Configure Auto-Refresh

For monitoring scenarios, Kibana can be configured to periodically refresh the displayed data.

For example:

Refresh every:
5 seconds
10 seconds
30 seconds
1 minute

The available options depend on the Kibana version and configuration.

Auto-refresh is useful when monitoring incoming logs or metrics, but the dashboard's freshness also depends on how quickly data is ingested and indexed in Elasticsearch.

Step 12: Save the Dashboard

After arranging the visualizations and configuring the required filters, save the dashboard.

Give it a meaningful name such as:

Website Monitoring Dashboard

The saved dashboard can then be reopened and used for future analysis, subject to the permissions and sharing configuration of the Kibana environment.

Example: Website Monitoring Dashboard

Consider a website that generates application logs containing request information.

A Kibana dashboard can combine several views:

Requests Over Time

Shows how request activity changes during the selected time period.

HTTP Status Codes

Shows the distribution of responses such as:

200
404
500

This can help identify increases in unsuccessful requests.

Top Requested URLs

Shows which endpoints receive the highest number of requests.

Geographic Distribution

Shows where requests originate when suitable geographic information is available.

Together, these visualizations provide a consolidated view of website activity.

Benefits of Kibana Dashboards

Kibana dashboards provide several practical benefits:

Interactive monitoring of logs and metrics
Faster troubleshooting for developers and DevOps teams
Customizable visualizations for different requirements
Centralized analysis of Elasticsearch data
Filtering and time-based analysis using Kibana features
Integration with alerting capabilities for proactive monitoring

Important Considerations

A Kibana dashboard is only as useful as the data behind it.

Before creating dashboards, make sure that:

Required Elasticsearch fields are available.
Timestamp fields are mapped appropriately.
Numeric fields use appropriate mappings.
Geographic fields use suitable geographic mappings when maps are required.
Users have the necessary Kibana permissions.
The selected time range matches the available data.

It is also important to distinguish dashboard refresh from true real-time processing. Refreshing a dashboard does not guarantee that newly generated application data is immediately available if ingestion or indexing is delayed.

Conclusion

A Kibana dashboard provides a centralized way to visualize and analyze data stored in Elasticsearch.

The basic workflow is:

Elasticsearch Data
       |
       v
Create Visualizations
       |
       v
Add Visualizations to Dashboard
       |
       v
Configure Filters and Time Range
       |
       v
Save and Monitor

For website monitoring, a dashboard can combine request trends, HTTP status codes, top URLs, and geographic information into a single interface.

With appropriate Elasticsearch data and carefully designed visualizations, Kibana can make log and application analysis easier for developers, DevOps teams, and other users who need to understand system activity.