RousselTMLEARNING

Observability

Kibana Maps and Canvas: geographic maps and presentations

Build maps with Kibana Maps (document, aggregation and choropleth layers, ES|QL) and dynamic presentations with Canvas (elements, Elasticsearch SQL, expressions), then share and export.

1. Kibana Maps #

Visualising geography.

Geographic data #

Maps reads geo_point (a position) and geo_shape (a shape) fields. They come from the Logstash geoip filter, the geoip processor of an ingest pipeline, or directly from the application.

PUT _ingest/pipeline/geo-web
{ "processors": [ { "geoip": { "field": "source.ip", "target_field": "source.geo" } } ] }

PUT magasins
{ "mappings": { "properties": { "position": { "type": "geo_point" }, "zone": { "type": "geo_shape" } } } }

Layers #

Documents, aggregations, choropleth and basemap.
LayerUse
Documentseach event (incidents, vehicles, stores)
Clusters and gridsdensity on large volumes
Choroplethindicator per country or region (join on an ISO code)
Trackspaths of moving entities
ES|QLan ES|QL query returning points
Good practice: Beyond a few thousand points, switch to a cluster or grid layer: the map stays readable and fast.
Good to know: A map is added to a dashboard like any other panel and follows its filters and time range.

2. Canvas #

Live presentations.

Principle #

Canvas builds workpads (free-form, pixel-precise pages) from elements: metrics, charts, images, Markdown text. Each element queries live data, often in Elasticsearch SQL, and can be styled with CSS: ideal for a wall screen or a branded report.

filters
| essql query="SELECT \"geo.src\" AS pays, COUNT(*) AS requetes FROM \"kibana_sample_data_logs\" GROUP BY pays ORDER BY requetes DESC LIMIT 5"
| pointseries x="pays" y="requetes"
| plot defaultStyle={seriesStyle bars=0.75 horizontalBars=true}
| render
DashboardCanvas
Layoutgrid of panelsfree-form, pixel-precise
Explorationfilters, clicks, Discoverlimited
Typical useday-to-day analysiswall screen, presentation, report
Depending on the version: Canvas evolves little compared with dashboards and Lens, which cover most needs; keep it for bespoke layouts.

3. Sharing and exporting #

Links, embedding, reports.

Options #

  • Shared link (with a fixed or relative time range) and iframe embedding.
  • CSV export from Discover and tables.
  • PDF and PNG reports of dashboards and workpads, optionally scheduled.
Good to know: PDF and PNG reports depend on the licence (paid subscription or trial); CSV export is available with the Basic licence.

Related articles

Machine learning in Elastic: anomaly detection and AIOps

Automatically detect abnormal behaviour: anomaly detection jobs, datafeeds, detectors, influencers, alerts, f…

Elastic Security: SIEM, detection rules and investigation

Use Elastic Security as a SIEM: ECS data sources, detection rule types (query, EQL, ES|QL, threshold, indicat…

Elastic path project: centralising and using logs

The validation project of the "Elastic Stack mastery" path: Elastic Agent and Fleet, Logstash, Elasticsearch …

Keep learning

Support us

♥ SUPPORT US

Support RousselTM Learning

Courses, articles, labs and certificates stay free with no intrusive ads. A voluntary contribution, of any amount you choose, pays for hosting, lab environments and new content.

Contribute with PayPal Any amount · card or PayPal accountLearn more
QR code PayPal
Or scan this QR code with your phone

Thank you, every contribution counts!