- Kibana Guide: other versions:
- What is Kibana?
- What’s new in 8.7
- Kibana concepts
- Quick start
- Set up
- Install Kibana
- Configure Kibana
- Alerting and action settings
- APM settings
- Banners settings
- Enterprise Search settings
- Fleet settings
- i18n settings
- Logging settings
- Logs settings
- Metrics settings
- Monitoring settings
- Reporting settings
- Search sessions settings
- Secure settings
- Security settings
- Spaces settings
- Task Manager settings
- Telemetry settings
- URL drilldown settings
- Start and stop Kibana
- Access Kibana
- Securing access to Kibana
- Add data
- Upgrade Kibana
- Configure security
- Configure reporting
- Configure logging
- Configure monitoring
- Command line tools
- Production considerations
- Discover
- Dashboard and visualizations
- Canvas
- Maps
- Build a map to compare metrics by country or region
- Track, visualize, and alert on assets in real time
- Map custom regions with reverse geocoding
- Heat map layer
- Tile layer
- Vector layer
- Plot big data
- Search geographic data
- Configure map settings
- Connect to Elastic Maps Service
- Import geospatial data
- Troubleshoot
- Reporting and sharing
- Machine learning
- Graph
- Alerting
- Observability
- APM
- Security
- Dev Tools
- Fleet
- Osquery
- Stack Monitoring
- Stack Management
- REST API
- Get features API
- Kibana spaces APIs
- Kibana role management APIs
- User session management APIs
- Saved objects APIs
- Data views API
- Index patterns APIs
- Alerting APIs
- Action and connector APIs
- Cases APIs
- Add comment
- Create case
- Delete cases
- Delete comments
- Find case activity
- Find cases
- Find connectors
- Get alerts
- Get case activity
- Get case
- Get case status
- Get cases by alert
- Get comments
- Get configuration
- Get reporters
- Get tags
- Push case
- Set configuration
- Update cases
- Update comment
- Update configuration
- Import and export dashboard APIs
- Logstash configuration management APIs
- Machine learning APIs
- Osquery manager API
- Short URLs APIs
- Get Task Manager health
- Upgrade assistant APIs
- Kibana plugins
- Troubleshooting
- Accessibility
- Release notes
- Developer guide
Explore your documents
editExplore your documents
editFine tune your explorations by customizing Discover to bring out the the best view of your documents. Adjust the chart height, modify the document table, and look inside a document.
Hide or resize the chart
editHide or resize the chart for a better fit.
-
To turn off the display of the chart, click
to open the Chart options menu, and then click Hide chart.
-
To change the chart height, drag the resize handle
to the size you want. The chart size is saved in your browser.
- To reset the height, open the Chart options menu, and then select Reset to default height.
Modify the document table
editCustomize the appearance of the document table and its contents by resizing the columns and rows, sorting and modifying the fields, and filtering the documents.
Reorder and resize the columns
edit- To move a single column, click its header. In the dropdown menu, click Move left or Move right.
- To move multiple columns, click Columns. In the pop-up, drag the column names to their new order.
-
To resize a column, drag the right edge of the column header until the column is the width that you want.
Column widths are stored with a saved search. When you visualize saved searches on dashboards, the saved search appears the same as in Discover.
Adjust the row height
editTo set the row height to one or more lines, or automatically
adjust the height to fit the contents, click the row height icon
.

Sort the fields
editSort the data by one or more fields, in ascending or descending order. The default sort is based on the time field, from new to old.
To add or remove a sort on a single field, click the column header, and then select the sort order.
To sort by multiple fields:
-
Click the field sorted option.
-
To add fields to the sort, select their names from the dropdown menu.
By default, columns are sorted in the order they are added.
- To change the sort order, select a field in the pop-up, and then drag it to the new location.
Edit a field
editChange how Kibana displays a field.
- Click the column header for the field, and then select Edit data view field.
-
In the Edit field form, change the field name and format.
For detailed information on formatting options, refer to Format data fields.
Filter the documents
editNarrow your results to a subset of documents so you’re comparing just the data of interest.
- Select the documents you want to compare.
-
Click the documents selected option, and then select Show selected documents only.
Set the number of rows per page
editTo change the numbers of rows you want to display on each page, use the Rows per page menu. The default is 100 rows per page.

Go inside a document
editDive into an individual document to inspect its fields, set filters, and view the documents that occurred before and after it.
-
Click the expand icon
.
You can view the document in two ways. The Table view displays the document fields row-by-row. The JSON (JavaScript Object Notation) view allows you to look at how Elasticsearch returns the document.
- In the Table view, scan through the fields and their values, or search for a field by name.
-
When you find a field of interest, hover your mouse over the Actions column to:
- Filter the results to include or exclude specific fields or values.
- Toggle the field in or out the document table.
- Pin the field so it stays at the top.
- To navigate to the next and previous documents, click the < and > arrows at the top of the view.
-
To create a view of the document that you can bookmark and share, click Single document.
The link is valid for the time the document is available in Elasticsearch. To create a customized view of the document, you can create your own plugin.
-
To view documents that occurred before or after the event you are looking at, click Surrounding documents.
Documents are displayed using the same set of columns as the Discover view from which the context was opened. The filters you applied are also carried over. Pinned filters remain active, while other filters are copied in a disabled state.
On this page