Kibana Discover und Lens

Welcome to an advanced exploration of Kibana! Beyond basic dashboards, Kibana offers powerful features to truly dissect your data and uncover hidden patterns.

In this lesson, we'll dive into Discover for raw data exploration and Lens for intuitive, drag-and-drop visualizations, empowering you with deeper analytical capabilities.

Kibana's Discover interface is your window into the raw, unaggregated data stored in Elasticsearch. It's essential for debugging, incident response, and understanding individual events.

Instead of just seeing charts, Discover lets you inspect every document, apply complex filters, and analyze specific time ranges, providing the granular detail you need.

For advanced data exploration in Discover, you'll master the Kibana Query Language (KQL). KQL is more intuitive and powerful than basic text searches, allowing precise queries across your data.

You can combine field-specific searches with logical operators (AND, OR, NOT) and wildcards to pinpoint exactly what you're looking for.

• response_code:200 AND NOT user_agent:bot*
• error.message:"timeout" OR status:500
• client_ip:(192.168.1.1 OR 10.0.0.5)

Once you've crafted a complex KQL query or applied a set of filters to isolate specific data, you don't have to start over every time. Discover allows you to save your searches.

Saved searches retain your query, filters, and even the selected columns. This is incredibly useful for frequently revisited investigations or for sharing specific data views with teammates.

In Discover, the left sidebar provides valuable field statistics. Clicking on any field reveals its top values, unique count, and a distribution chart.

This feature helps you quickly understand the cardinality of a field, identify common values, and spot anomalies without building a full visualization. It's perfect for quick data profiling and validation.

While Discover helps you explore raw data, Kibana Lens is a modern, drag-and-drop interface designed for rapid and intuitive visualization creation. It simplifies the process of turning data into insights.

Lens automatically suggests chart types based on the fields you select, making it much faster to build complex, interactive charts compared to traditional visualization editors.

Building a visualization in Lens is incredibly straightforward. You simply drag fields from your index pattern onto the canvas. Lens does the heavy lifting, suggesting appropriate chart types and aggregations.

For example, dragging a numeric field (like bytes) to the Y-axis and a categorical field (like client_ip) to the X-axis might automatically create a bar chart showing total bytes per client IP.

Lens isn't just for simple charts; it handles advanced aggregations with ease. You can easily switch between metrics like sum, average, unique count, and percentiles.

It also allows you to break down data by multiple dimensions, create stacked charts, and apply advanced functions, providing a powerful yet accessible way to summarize complex datasets visually.

Understanding when to use Discover versus Lens is key to effective analysis:

• Discover: Use for deep-dive investigation into raw events, debugging, ad-hoc queries, and understanding individual document details. It's your forensic tool.
• Lens: Use for quickly building interactive visualizations, summarizing data trends, comparing metrics, and creating dashboard components. It's your visual storytelling tool.

You've now explored advanced features within Kibana's Discover and Lens!

• Discover empowers you with granular raw data inspection, powerful KQL, saved searches, and field statistics.
• Lens provides a modern, intuitive drag-and-drop experience for rapidly building diverse and insightful visualizations.

By mastering these tools, you can move beyond basic monitoring to conduct deeper investigations and create more compelling visual summaries of your data.