- Kibana Guide: other versions:
- What is Kibana?
- What’s new in 8.3
- Kibana concepts
- Quick start
- Set up
- Install Kibana
- Configure Kibana
- Alerting and action settings
- APM settings
- Banners settings
- Enterprise Search settings
- Fleet settings
- i18n settings
- Logging settings
- Logs settings
- Metrics settings
- Monitoring settings
- Reporting settings
- Search sessions settings
- Secure settings
- Security settings
- Spaces settings
- Task Manager settings
- Telemetry settings
- URL drilldown settings
- Start and stop Kibana
- Access Kibana
- Securing access to Kibana
- Add data
- Upgrade Kibana
- Configure security
- Configure reporting
- Configure logging
- Configure monitoring
- Command line tools
- Production considerations
- Discover
- Dashboard and visualizations
- Canvas
- Maps
- Build a map to compare metrics by country or region
- Track, visualize, and alert on assets in real time
- Map custom regions with reverse geocoding
- Heat map layer
- Tile layer
- Vector layer
- Plot big data
- Search geographic data
- Configure map settings
- Connect to Elastic Maps Service
- Import geospatial data
- Troubleshoot
- Reporting and sharing
- Machine learning
- Graph
- Alerting
- Observability
- APM
- Security
- Dev Tools
- Fleet
- Osquery
- Stack Monitoring
- Stack Management
- REST API
- Get features API
- Kibana spaces APIs
- Kibana role management APIs
- User session management APIs
- Saved objects APIs
- Data views API
- Index patterns APIs
- Alerting APIs
- Action and connector APIs
- Cases APIs
- Import and export dashboard APIs
- Logstash configuration management APIs
- Machine learning APIs
- Short URLs APIs
- Get Task Manager health
- Upgrade assistant APIs
- Kibana plugins
- Troubleshooting
- Accessibility
- Release notes
- Developer guide
Expressions always start with a function
editExpressions always start with a function
editExpressions simply execute functions in a specific order, which produce some output value. That output can then be inserted into another function, and another after that, until it produces the output you need.
To use demo dataset available in Canvas to produce a table, run the following expression:
/* Simple demo table */ filters | demodata | table | render
This expression starts out with the filters function, which provides the value of any time filters or dropdown filters in the workpad. This is then inserted into demodata, a function that returns exactly what you expect, demo data. Because the demodata function receives the filter information from the filters function before it, it applies those filters to reduce the set of data it returns. We call the output from the previous function context.
The filtered demo data becomes the context of the next function, table, which creates a table visualization from this data set. The table function isn’t strictly required, but by being explicit, you have the option of providing arguments to control things like the font used in the table. The output of the table function becomes the context of the render function. Like the table, the render function isn’t required either, but it allows access to other arguments, such as styling the border of the element or injecting custom CSS.
It is possible to add comments to the expression by starting them with a //
sequence or by using /*
and */
to enclose multi-line comments.