-
Notifications
You must be signed in to change notification settings - Fork 8.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[DOCS] Revises doc on adding data #68038
Changes from 9 commits
93ae7f3
9a07e35
e31923d
75a6fe5
c35dbfe
1559153
aedb099
04f5c91
9886264
eab8f31
a64a7a4
927b175
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change | ||||
---|---|---|---|---|---|---|
@@ -1,44 +1,99 @@ | ||||||
[[connect-to-elasticsearch]] | ||||||
== Connect Kibana with Elasticsearch | ||||||
== Adding data | ||||||
|
||||||
Before you can start using Kibana, you need to tell it which Elasticsearch indices you want to explore. | ||||||
The first time you access Kibana, you are prompted to define an _index pattern_ that matches the name of | ||||||
one or more of your indices. That's it. That's all you need to configure to start using Kibana. You can | ||||||
add index patterns at any time from the <<settings-create-pattern,Management tab>>. | ||||||
To start working with your data in {kib}, you can: | ||||||
|
||||||
TIP: By default, Kibana connects to the Elasticsearch instance running on `localhost`. To connect to a | ||||||
different Elasticsearch instance, modify the Elasticsearch URL in the `kibana.yml` configuration file and | ||||||
restart Kibana. For information about using Kibana with your production nodes, see <<production>>. | ||||||
* Use the File Data Visualizer or GeoJSON Upload feature to quickly load | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Do we really want to say
Then get into the nitty gritty in the sections below. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
It might be worth mentioning CSV files here also as they are a very common use case. |
||||||
data into {es}. | ||||||
|
||||||
To configure the Elasticsearch indices you want to access with Kibana: | ||||||
* Follow one of the Add Data tutorials to set up a Beats module to index logs, | ||||||
metrics, events, or application data. | ||||||
|
||||||
. Point your browser at port 5601 to access the Kibana UI. For example, `localhost:5601` or | ||||||
`http://YOURDOMAIN.com:5601`. | ||||||
+ | ||||||
image:images/Start-Page.png[Kibana start page] | ||||||
+ | ||||||
. Specify an index pattern that matches the name of one or more of your Elasticsearch indices. The pattern | ||||||
can include an asterisk (*) to matches zero or more characters in an index's name. When filling out your | ||||||
index pattern, any matched indices will be displayed. | ||||||
. Click *Next Step* to select the index field that contains the timestamp you want to use to perform time-based | ||||||
comparisons. Kibana reads the index mapping to list all of the fields that contain a timestamp. If your | ||||||
index doesn't have time-based data, choose *I don't want to use the Time Filter* option. | ||||||
+ | ||||||
. Click *Create index pattern* to add the index pattern. This first pattern is automatically configured as the default. | ||||||
When you have more than one index pattern, you can designate which one to use as the default by clicking | ||||||
on the star icon above the index pattern title from *Management > Index Patterns*. | ||||||
* Connect {kib} with existing {es} indices. | ||||||
|
||||||
All done! Kibana is now connected to your Elasticsearch data. Kibana displays a read-only list of fields | ||||||
configured for the matching index. | ||||||
{kib} also provides <<get-data-in, sample data sets>> for you to use. | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. How about: If you're not ready to use your own data, use the <<get-data-in, sample data sets>> to see all that you can do in {kib}. |
||||||
|
||||||
[float] | ||||||
[[explore]] | ||||||
=== Start Exploring your Data! | ||||||
You're ready to dive in to your data: | ||||||
[[upload-data-kibana]] | ||||||
=== Use the File Data Visualizer | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. How about: Load your data from a log file |
||||||
|
||||||
To visualize data in a CSV, JSON, or log file, you can | ||||||
upload it using the File Data Visualizer. On the home page, | ||||||
click *Import a CSV, NDSON, or log file*, and then drag your file into the | ||||||
File Data Visualizer. You can upload a file up to 100 MB. | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This value is configurable up to 1GB in kibana's advanced settings. It might be worth mentioning in these docs. |
||||||
|
||||||
[role="screenshot"] | ||||||
image::images/add-data-fv.png[File Data Visualizer] | ||||||
|
||||||
The File Data Visualizer uses the {ref}/ml-find-file-structure.html[find_file_structure API] to analyze | ||||||
the uploaded file and to suggest ingest pipelines and mappings for your data. | ||||||
|
||||||
NOTE: This feature is not intended for use as part of a | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I'm not sure what this note means. Why wouldn't I be able to use this feature repeatedly? The second part, |
||||||
repeated production process, but rather for the initial exploration of your data. | ||||||
|
||||||
[float] | ||||||
[[upload-geoipdata-kibana]] | ||||||
=== Use GeoJSON Upload | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. How about: Load your GeoJSON data There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I see |
||||||
|
||||||
To visualize geo data in a point or shape file, you can upload it using the <<geojson-upload, GeoJSON Upload>> | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. At this point, do users know what point or shape files are? |
||||||
feature in *Elastic Maps*, and then use that data as a layer in a map. | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Elastic Maps now appears as Maps in the new nav structure There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. If users have to go into Maps to use this feature, then does it really belong here? Or does it belong in the Maps section? The other options are available from the home page, right? |
||||||
The data is also available for use in the broader Kibana ecosystem, for example, | ||||||
in visualizations and Canvas workpads. | ||||||
With GeoJSON Upload, you can upload a file up to 50 MB. | ||||||
|
||||||
[role="screenshot"] | ||||||
image::images/add-data-geo-upload.png[GeoJSON Upload] | ||||||
|
||||||
[float] | ||||||
[[add-data-tutorial-kibana]] | ||||||
=== Add data tutorials | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Your'e not really adding data tutorials, you're using them. |
||||||
|
||||||
The built-in data tutorials can help you quickly get up and running with | ||||||
metrics data, log analytics, and security events. | ||||||
These tutorials walk you through installing and configuring a | ||||||
Beats data shipper to periodically collect and send data to {es}. | ||||||
You can then use the pre-built dashboards to explore and analyze the data. | ||||||
|
||||||
You access the tutorials from the {kib} home page. | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
If a tutorial doesn’t exist for your data, go to the {beats-ref}/beats-reference.html[Beats overview] | ||||||
to learn about other data shippers in the Beats family. | ||||||
|
||||||
* Search and browse your data interactively from the <<discover, Discover>> page. | ||||||
* Chart and map your data from the <<visualize, Visualize>> page. | ||||||
* Create and view custom dashboards from the <<dashboard, Dashboard>> page. | ||||||
[role="screenshot"] | ||||||
image::images/add-data-tutorials.png[Add Data tutorials] | ||||||
|
||||||
For a step-by-step introduction to these core Kibana concepts, see the <<getting-started, | ||||||
Getting Started>> tutorial. | ||||||
|
||||||
[float] | ||||||
[[connect-to-es]] | ||||||
=== Connect with {es} indices | ||||||
|
||||||
To visualize data in existing {es} indices, you | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
create index patterns that match the names of the indices you want to explore. When you add data with the File Visualizer, GeoJSON Upload, | ||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more.
Suggested change
|
||||||
or an Add Data tutorial, an index pattern is created for you. | ||||||
|
||||||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. To create an index pattern: |
||||||
. Go to *Stack Management*, and then click *Index Patterns*. | ||||||
|
||||||
. Click *Create index pattern*. | ||||||
|
||||||
. Specify an index pattern that matches the name of one or more of your Elasticsearch indices. | ||||||
+ | ||||||
For example, an index pattern can point to your Apache data from yesterday, | ||||||
`filebeat-apache-4-3-2022`, or any index that matches the pattern, `filebeat-*`. | ||||||
Using a wildcard is the more popular approach. | ||||||
|
||||||
|
||||||
. Click *Next Step*, and then select the index field that contains the timestamp you want to use to perform time-based | ||||||
comparisons. | ||||||
+ | ||||||
Kibana reads the index mapping and lists all fields that contain a timestamp. If your | ||||||
index doesn't have time-based data, choose *I don't want to use the Time Filter*. | ||||||
+ | ||||||
You must select a time field to use global time filters on your dashboards. | ||||||
|
||||||
. Click *Create index pattern*. | ||||||
+ | ||||||
{kib} is now configured to access your {es} indices. | ||||||
You’ll see a list of fields configured for the matching index. | ||||||
You can designate your index pattern as the default by clicking the star icon on this page. | ||||||
+ | ||||||
When searching in *Discover* and creating visualizations, you choose a pattern | ||||||
from the index pattern menu to specify the {es} indices that contain the data you want to work with. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll make that change when I change the other titles in the section.