Kibana — Data Visualization and Exploration for Elasticsearch

Introduction

Kibana is the window into the Elastic Stack. It lets you search, visualize, and build dashboards over data indexed in Elasticsearch—logs, metrics, APM traces, and security events—without writing code.

What Kibana Does

• Provides Discover for ad-hoc search and filtering of Elasticsearch indices
• Offers a drag-and-drop dashboard builder with 20+ visualization types
• Includes Canvas for pixel-perfect, presentation-ready live reports
• Ships with Lens, an AI-assisted chart builder that suggests visualizations
• Manages Elastic Stack settings, index lifecycle policies, and user roles

Architecture Overview

Kibana is a Node.js server that communicates with Elasticsearch via its REST API. The browser-based frontend renders visualizations client-side using EUI components. Saved objects (dashboards, visualizations, index patterns) are stored in a dedicated Elasticsearch system index. Plugins extend the core with modules like APM, SIEM, Maps, and Alerting.

Self-Hosting & Configuration

• Edit kibana.yml to set elasticsearch.hosts and server.port
• Secure access with Elastic's built-in RBAC or an external IdP via SAML/OIDC
• Set server.basePath when running behind a reverse proxy
• Use Kibana Spaces to separate dashboards by team or environment
• Scale horizontally by running multiple Kibana instances behind a load balancer

Key Features

• Lens: intelligent chart suggestions based on the data fields you select
• Alerting: define threshold or anomaly-based rules with actions (email, Slack, webhook)
• Maps: geo-spatial analysis with custom layers, region maps, and heatmaps
• Security app: timeline investigation, detection rules, and case management
• Dev Tools console: execute Elasticsearch queries and API calls directly

Comparison with Similar Tools

• Grafana — multi-datasource; Kibana is deeply integrated with Elasticsearch only
• Apache Superset — SQL-first BI tool; Kibana excels at full-text log exploration
• Datadog — SaaS observability; Kibana is self-hosted and open-source
• Splunk — enterprise log analytics; Kibana offers a free tier with Elastic license

FAQ

Q: Is Kibana free? A: Kibana is source-available under the Elastic License 2.0. The free Basic tier covers Discover, dashboards, and most visualization features.

Q: Can Kibana work without Elasticsearch? A: No. Kibana requires a running Elasticsearch cluster as its data store and query engine.

Q: How do I import dashboards from the community? A: Use the Saved Objects management page to import .ndjson exports, or install prebuilt dashboards via Elastic Agent integrations.

Q: What hardware does Kibana need? A: A minimum of 1 GB RAM for small deployments. Kibana itself is lightweight; the Elasticsearch cluster handles the heavy query work.

Sources

• https://github.com/elastic/kibana
• https://www.elastic.co/kibana