Kibana highlights

This list summarizes the most important enhancements in Kibana 7.14.

7.14 adds the ability to export and import rules and connectors between Kibana deployments and spaces. This increases support for Kibana’s multi-tenancy paradigm and for reusability. Write your rules once and reuse them fast and effortlessly according to your organization’s needs.

This release also improves the observability of alerting by enhancing the following:

With formulas, you can combine math operations and aggregated fields to author your own metrics at query time. With the easy-to-use, autocompleting formula editor, you can:

Want to learn more? Check out the searchable in-product reference documentation, which also includes common use cases. When you’re ready, use full screen mode to create your own formulas.

Make easy and powerful comparisons between two time periods by adding time shifted metrics to your visualizations. Time shifted metrics help to reduce the distraction caused by the seasonal or behavioral changes in your data.

Enhancements to tables include:

Kibana now uses the new EUI theme by default, bringing a more modern look to the entire interface. Due to small changes to padding, margins, and font sizes in the base components, you might notice minor changes to dashboard layouts. During the 7.x cycle, you can revert to the old theme in Advanced Settings.

The migration system for saved objects, the data structures that underpin much of Kibana, has improved. Now upgrading from prior versions is quicker and more seamless, even for the largest of deployments. When problems arise, the error logging is now more clear, so administrators can get migration back on track faster.

You can now analyze and explore space and time with the time slider. This control allows you to look at a subset of time (a time slice), move it forward or backward, and play back your data based on the global time extent. The time slider works on all layers that are based on a time-field.

[beta] This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. You can now create an index, and with a new set of drawing tools, add or delete documents. Use the drawing tools to create new data and add geographic context to your map, good for annotation or ad-hoc analysis. You can edit both new and existing layers (indices). Editing is not supported on layers with clustering, joins, or time filtering.

Filtering is now more intuitive. The spatial filters in Maps are enhanced to work with all layers on the map, meaning you no longer have to specify a target index pattern when configuring the filter. When using the distance filter, you will now see a distance value displayed as you draw the shape. This makes it easier to filter all documents that are within 10 kilometers of a specific location.

Discover debuts several community-requested features: a multi-fields toggle, enhanced Lens integration, and source views in the document viewer. Discover also enhances the user experience with improvements to stability, performance, accessibility, and usability. For more information on the most-used app in Kibana, refer to Discover.

The Elasticsearch SQL expression function in Canvas has changed to gracefully handle arrays in retrieved data. If the data for the SQL expression includes an array, the first entry of the array is returned in the result set.

In addition, the SQL expression function now supports passing parameters into the query, making it easier to pass in variable values to your SQL queries on your workpad.

Choropleth maps are now available in the Anomaly Explorer and the Data Visualizer for fields such as country and region codes, zip codes, and states. The integration relies on a new service provided by the Maps plugin, which automatically identifies fields that store location data based on sample values or contextual knowledge about the data. For example, for jobs with region ISO code partitioning or influencer fields, a map showing the count of anomalies by location is displayed in the Anomaly Explorer .

For more details, see Mapping anomalies by location.

Delayed data are documents that are indexed after the datafeed has already processed the time period for the anomaly detection job. For jobs with delayed data, it can be difficult to understand why the current data is different from what was processed for the anomaly detection job.

The delayed data visualization—opened from Job Management—charts the event counts of the job and the source data to identify where missing data has occurred and understand if it is a persistent problem. It enables you to decide whether to take action, such as to increase the query delay of the datafeed or to restore a model snapshot.

Beginning in 7.14, you can create rare detector jobs by using the new anomaly detection job wizard. Three general detector types are available: rare, rare in population, and frequently rare in population. The latter two require a population field to select, and it’s also possible to add a split field to any of the choices. A detector summary appears when the configuration details are provided, showing what the job will do and which fields it will operate on.

[beta] This functionality is in beta and is subject to change. The design and code is less mature than official GA features and is being provided as-is with no warranties. Beta features are not subject to the support SLA of official GA features. You can now manage your Enterprise Search deployments without leaving Kibana! 7.14 introduces App Search and Workplace Search management dashboards for Kibana, so you can experience the full power of Elastic from a single interface. Get started by selecting Enterprise Search from the main menu or Kibana home page. Learn more in Setting up Enterprise Search in Kibana.

With Labs, you can now try out and provide feedback on the Canvas and Dashboard features that are in progress or experimental. When enabled, you’ll see Labs in the toolbar.

The first Labs project is Defer loading panels below the fold. To improve dashboard loading time, only the visible panels are loaded when you open the dashboard. All other panels are loaded as you scroll. Give the Labs project a try, and let us know what you think.