Skip to content

Latest commit

 

History

History
324 lines (253 loc) · 13.8 KB

settings.asciidoc

File metadata and controls

324 lines (253 loc) · 13.8 KB

Settings

To use Kibana, you have to tell it about the Elasticsearch indices that you want to explore by configuring one or more index patterns. You can also:

  • Create scripted fields that are computed on the fly from your data. You can browse and visualize scripted fields, but you cannot search them.

  • Set advanced options such as the number of rows to show in a table and how many of the most popular fields to show. Use caution when modifying advanced options, as it’s possible to set values that are incompatible with one another.

  • Configure Kibana for a production environment

Create an Index Pattern to Connect to Elasticsearch

An index pattern identifies one or more Elasticsearch indices that you want to explore with Kibana. Kibana looks for index names that match the specified pattern. An asterisk () in the pattern matches zero or more characters. For example, the pattern myindex- matches all indices whose names start with myindex-, such as myindex-1 and myindex-2.

If you use event times to create index names (for example, if you’re pushing data into Elasticsearch from Logstash), the index pattern can also contain a date format. In this case, the static text in the pattern must be enclosed in brackets, and you specify the date format using the tokens described in Date Format Tokens.

For example, [logstash-]YYYY.MM.DD matches all indices whose names have a timestamp of the form YYYY.MM.DD appended to the prefix logstash-, such as logstash-2015.01.31 and logstash-2015-02-01.

An index pattern can also simply be the name of a single index.

To create an index pattern to connect to Elasticsearch:

  1. Go to the Settings > Indices tab.

  2. Specify an index pattern that matches the name of one or more of your Elasticsearch indices. By default, Kibana guesses that you’re you’re working with log data being fed into Elasticsearch by Logstash.

    Note
    		 When you switch between top-level tabs, Kibana remembers where you were. For example, if you view a particular index pattern from the Settings tab, switch to the Discover tab, and then go back to the Settings tab, Kibana displays the index pattern you last looked at. To get to the create pattern form, click the Add button in the Index Patterns list.

  3. If your index contains a timestamp field that you want to use to perform time-based comparisons, select the Index contains time-based events option and select the index field that contains the timestamp. Kibana reads the index mapping to list all of the fields that contain a timestamp.

  4. If new indices are generated periodically and have a timestamp appended to the name, select the Use event times to create index names option and select the Index pattern interval. This enables Kibana to search only those indices that could possibly contain data in the time range you specify. This is primarily applicable if you are using Logstash to feed data into Elasticsearch.

  5. Click Create to add the index pattern.

  6. To designate the new pattern as the default pattern to load when you view the Discover tab, click the favorite button.

Date Format Tokens
M

Month - cardinal: 1 2 3 …​ 12
Mo

Month - ordinal: 1st 2nd 3rd …​ 12th
MM

Month - two digit: 01 02 03 …​ 12
MMM

Month - abbreviation: Jan Feb Mar …​ Dec
MMMM

Month - full: January February March …​ December
Q

Quarter: 1 2 3 4
D

Day of Month - cardinal: 1 2 3 …​ 31
Do

Day of Month - ordinal: 1st 2nd 3rd …​ 31st
DD

Day of Month - two digit: 01 02 03 …​ 31
DDD

Day of Year - cardinal: 1 2 3 …​ 365
DDDo

Day of Year - ordinal: 1st 2nd 3rd …​ 365th
DDDD

Day of Year - three digit: 001 002 …​ 364 365
d

Day of Week - cardinal: 0 1 3 …​ 6
do

Day of Week - ordinal: 0th 1st 2nd …​ 6th
dd

Day of Week - 2-letter abbreviation: Su Mo Tu …​ Sa
ddd

Day of Week - 3-letter abbreviation: Sun Mon Tue …​ Sat
dddd

Day of Week - full: Sunday Monday Tuesday …​ Saturday
e

Day of Week (locale): 0 1 2 …​ 6
E

Day of Week (ISO): 1 2 3 …​ 7
w

Week of Year - cardinal (locale): 1 2 3 …​ 53
wo

Week of Year - ordinal (locale): 1st 2nd 3rd …​ 53rd
ww

Week of Year - 2-digit (locale): 01 02 03 …​ 53
W

Week of Year - cardinal (ISO): 1 2 3 …​ 53
Wo

Week of Year - ordinal (ISO): 1st 2nd 3rd …​ 53rd
WW

Week of Year - two-digit (ISO): 01 02 03 …​ 53
YY

Year - two digit: 70 71 72 …​ 30
YYYY

Year - four digit: 1970 1971 1972 …​ 2030
gg

Week Year - two digit (locale): 70 71 72 …​ 30
gggg

Week Year - four digit (locale): 1970 1971 1972 …​ 2030
GG

Week Year - two digit (ISO): 70 71 72 …​ 30
GGGG

Week Year - four digit (ISO): 1970 1971 1972 …​ 2030
A

AM/PM: AM PM
a

am/pm: am pm
H

Hour: 0 1 2 …​ 23
HH

Hour - two digit: 00 01 02 …​ 23
h

Hour - 12-hour clock: 1 2 3 …​ 12
hh

Hour - 12-hour clock, 2 digit: 01 02 03 …​ 12
m

Minute: 0 1 2 …​ 59
mm

Minute - two-digit: 00 01 02 …​ 59
s

Second: 0 1 2 …​ 59
ss

Second - two-digit: 00 01 02 …​ 59
S

Fractional Second - 10ths: 0 1 2 …​ 9
SS

Fractional Second - 100ths: 0 1 …​ 98 99
SSS

Fractional Seconds - 1000ths: 0 1 …​ 998 999
Z

Timezone - zero UTC offset (hh:mm format): -07:00 -06:00 -05:00 .. +07:00
ZZ

Timezone - zero UTC offset (hhmm format): -0700 -0600 -0500 …​ +0700
X

Unix Timestamp: 1360013296
x

Unix Millisecond Timestamp: 1360013296123

Set the Default Index Pattern

The default index pattern is loaded by automatically when you view the Discover tab. Kibana displays a star to the left of the name of the default pattern in the Index Patterns list on the Settings > Indices tab. The first pattern you create is automatically designated as the default pattern.

To set a different pattern as the default index pattern:

  1. Go to the Settings > Indices tab.

  2. Select the pattern you want to set as the default in the Index Patterns list.

  3. Click the pattern’s Favorite button.

Note
 You can also manually set the default index pattern in Advanced > Settings.

Reload the Index Fields List

When you add an index mapping, Kibana automatically scans the index(es) that match the pattern to display a list of the index fields. You can reload the index fields list to pick up any newly-added fields.

Reloading the index fields list also resets Kibana’s popularity counters for the fields. The popularity counters keep track of the fields you’ve used most often within Kibana and are used to sort fields within lists.

To reload the index fields list:

  1. Go to the Settings > Indices tab.

  2. Select an index pattern from the Index Patterns list.

  3. Click the pattern’s Reload button.

Delete an Index Pattern

To delete an index pattern:

  1. Go to the Settings > Indices tab.

  2. Select the pattern you want to remove in the Index Patterns list.

  3. Click the pattern’s Delete button.

  4. Confirm that you want to remove the index pattern.

Create a Scripted Field

Scripted fields compute data on the fly from the data in your Elasticsearch indices. Scripted field data is shown on the Discover tab as part of the document data, and you can use scripted fields in your visualizations. (Scripted field values are computed at query time so they aren’t indexed and cannot be searched.)

Warning
 Computing data on the fly with scripted fields can be very resource intensive and can have a direct impact on Kibana’s performance. Keep in mind that there’s no built-in validation of a scripted field. If your scripts are buggy, you’ll get exceptions whenever you try to view the dynamically generated data.

Scripted fields use the Lucene expression syntax. For more information, see Lucene Expressions Scripts.

You can reference any single value numeric field in your expressions, for example:

doc['field_name'].value

To create a scripted field:

  1. Go to Settings > Indices

  2. Select the index pattern you want to add a scripted field to.

  3. Go to the pattern’s Scripted Fields tab.

  4. Click Add Scripted Field.

    Tip
    		 If you are just getting started with scripted fields, you can click create a few examples from your date fields to add some scripted fields you can use as a starting point.

  5. Enter a name for the scripted field.

  6. Enter the expression that you want to use to compute a value on the fly from your index data.

  7. Click Save Scripted Field.

For more information about scripted fields in Elasticsearch, see Scripting.

Update a Scripted Field

To modify a scripted field:

  1. Go to Settings > Indices

  2. Click the Edit button for the scripted field you want to change.

  3. Make your changes and then click Save Scripted Field to update the field.

Warning
 Keep in mind that there’s no built-in validation of a scripted field. If your scripts are buggy, you’ll get exceptions whenever you try to view the dynamically generated data.

Delete a Scripted Field

To delete a scripted field:

  1. Go to Settings > Indices

  2. Click the Delete button for the scripted field you want to remove.

  3. Confirm that you really want to delete the field.

Set Advanced Options

The Advanced Settings page enables you to directly edit settings that control the behavior of the Kibana application. For example, you can change the format used to display dates, specify the default index pattern, and set the precision for displayed decimal values.

Warning
 Changing advanced settings can have unintended consequences. If you aren’t sure what you’re doing, it’s best to leave these settings as-is.

To set advanced options:

  1. Go to Settings > Advanced.

  2. Click the Edit button for the option you want to modify.

  3. Enter a new value for the option.

  4. Click the Save button.

Managing Saved Searches, Visualizations, and Dashboards

You can view, edit, and delete saved searches, visualizations, and dashboards from Settings > Objects.

Viewing a saved object displays the selected item in the Discover, Visualize, or Dashboard page. To view a saved object:

  1. Go to Settings > Objects.

  2. Select the object you want to view.

  3. Click the View button.

Editing a saved object enables you to directly modify the object definition. You can change the name of the object, add a description, and modify the JSON that defines the object’s properties.

If you attempt to access an object whose index has been deleted, Kibana displays its Edit Object page. You can:

  • Recreate the index so you can continue using the object.

  • Delete the object and recreate it using a different index.

  • Change the index name referenced in the object’s kibanaSavedObjectMeta.searchSourceJSON to point to an existing index pattern. This is useful if the index you were working with has been renamed.

Warning
 No validation is performed for object properties. Submitting invalid changes will render the object unusable. Generally, you should use the Discover, Visualize, or Dashboard pages to create new objects instead of directly editing existing ones.

To edit a saved object:

  1. Go to Settings > Objects.

  2. Select the object you want to edit.

  3. Click the Edit button.

  4. Make your changes to the object definition.

  5. Click the Save Object button.

To delete a saved object:

  1. Go to Settings > Objects.

  2. Select the object you want to delete.

  3. Click the Delete button.

  4. Confirm that you really want to delete the object.

=== Setting Kibana Server Properties

The Kibana server reads properties from the kibana.yml file on startup. The default settings configure Kibana to run on localhost:5601. To change the host or port number, or connect to Elasticsearch running on a different machine, you’ll need to update your kibana.yml file. You can also enable SSL and set a variety of other options.

Table 1. Kibana Server Properties
Property Description

port

The port that the Kibana server runs on. Default: port: 5601.

host

The host to bind the Kibana server to. Default: host: "0.0.0.0".

elasticsearch_url

The Elasticsearch instance where the indexes you want to query reside. Default: elasticsearch_url: "http://localhost:9200".

elasticsearch_preserve_host

By default, the hostname specified in elasticsearch_url is sent to xxx. To use the hostname of the Kibana server instead, set this option to false. Default: elasticsearch_preserve_host: true.

kibana_index

The name of the index where saved searched, visualizations, and dashboards will be stored. Default: kibana_index: .kibana.

default_app_id

The page that will be displayed when you launch Kibana: discover, visualize, dashboard, or settings. Default: default_app_id: "discover".

request_timeout

How long to wait for responses from the Kibana backend or Elasticsearch, in milliseconds. Default: request_timeout: 500000

shard_timeout

How long Elasticsearch should wait for responses from shards. Set to 0 to disable. Default: shard_timeout: 0.

verify_ssl

Indicates whether or not to validate the Elasticsearch SSL certificate. Set to false to disable SSL verification. Default: verify_ssl: true.

ca

The path to the CA certificate for your Elasticsearch instance. Specify if you are using a self-signed certificate so the certificate can be verified. (Otherwise, you have to disable verify_ssl.) Default: none.

ssl_key_file

The path to your Kibana server’s key file. Must be set to encrypt communications between the browser and Kibana. Default: none.

ssl_cert_file

The path to your Kibana server’s certificate file. Must be set to encrypt communications between the browser and Kibana. Default: none.

pid_file

The location where you want to store the process ID file. If not specified, the PID file is stored in /var/run/kibana.pid. Default: none.