1. Kibana Maps #
Visualising geography.
Geographic data #
Maps reads geo_point (a position) and geo_shape (a shape) fields. They come from the Logstash geoip filter, the geoip processor of an ingest pipeline, or directly from the application.
PUT _ingest/pipeline/geo-web
{ "processors": [ { "geoip": { "field": "source.ip", "target_field": "source.geo" } } ] }
PUT magasins
{ "mappings": { "properties": { "position": { "type": "geo_point" }, "zone": { "type": "geo_shape" } } } }Layers #
| Layer | Use |
|---|---|
| Documents | each event (incidents, vehicles, stores) |
| Clusters and grids | density on large volumes |
| Choropleth | indicator per country or region (join on an ISO code) |
| Tracks | paths of moving entities |
| ES|QL | an ES|QL query returning points |
Good practice: Beyond a few thousand points, switch to a cluster or grid layer: the map stays readable and fast.
Good to know: A map is added to a dashboard like any other panel and follows its filters and time range.
2. Canvas #
Live presentations.
Principle #
Canvas builds workpads (free-form, pixel-precise pages) from elements: metrics, charts, images, Markdown text. Each element queries live data, often in Elasticsearch SQL, and can be styled with CSS: ideal for a wall screen or a branded report.
filters
| essql query="SELECT \"geo.src\" AS pays, COUNT(*) AS requetes FROM \"kibana_sample_data_logs\" GROUP BY pays ORDER BY requetes DESC LIMIT 5"
| pointseries x="pays" y="requetes"
| plot defaultStyle={seriesStyle bars=0.75 horizontalBars=true}
| render| Dashboard | Canvas | |
|---|---|---|
| Layout | grid of panels | free-form, pixel-precise |
| Exploration | filters, clicks, Discover | limited |
| Typical use | day-to-day analysis | wall screen, presentation, report |
Depending on the version: Canvas evolves little compared with dashboards and Lens, which cover most needs; keep it for bespoke layouts.
3. Sharing and exporting #
Links, embedding, reports.
Options #
- Shared link (with a fixed or relative time range) and iframe embedding.
- CSV export from Discover and tables.
- PDF and PNG reports of dashboards and workpads, optionally scheduled.
Good to know: PDF and PNG reports depend on the licence (paid subscription or trial); CSV export is available with the Basic licence.
My progress
Sign in to track your progress and take notes. Sign in
💬 Questions about this lesson
No questions yet: be the first to ask for help or share your configuration.
Recommended Articles
Machine learning in Elastic: anomaly detection and AIOps
Automatically detect abnormal behaviour: anomaly detection jobs, datafeeds, detectors, influencer...
Elastic Security: SIEM, detection rules and investigation
Use Elastic Security as a SIEM: ECS data sources, detection rule types (query, EQL, ES|QL, thresh...
Elastic path project: centralising and using logs
The validation project of the "Elastic Stack mastery" path: Elastic Agent and Fleet, Logstash, El...
Visualizing in Kibana: Lens, dashboards and saved objects
Build visualizations with Lens, assemble interactive dashboards (filters, controls, links), and m...
Kibana and Elastic Observability best practices
Checklist for running Kibana in production: versions, security, spaces and roles, versioned dashb...
Alerts, connectors and SLOs in Kibana
Create alert rules in Kibana (Elasticsearch query, ES|QL, custom threshold, logs), configure conn...
Kibana: role, installation and first steps
What Kibana is in the Elastic suite, how to install it with Elasticsearch (start-local, Docker), ...
Transforms and enrich: summarising and enriching data in Elasticsearch
Build entity-centric indices with pivot and latest transforms, and enrich documents at ingest tim...
Exploring data in Discover: KQL, Lucene and ES|QL
Search and analyze logs in Kibana Discover: filters, KQL, Lucene syntax, and the ES|QL language t...