- Kibana Guide: other versions:
- What is Kibana?
- What’s new in 8.17
- Kibana concepts
- Quick start
- Set up
- Install Kibana
- Configure Kibana
- AI Assistant settings
- Alerting and action settings
- APM settings
- Banners settings
- Cases settings
- Enterprise Search settings
- Fleet settings
- i18n settings
- Logging settings
- Logs settings
- Metrics settings
- Monitoring settings
- Reporting settings
- Search sessions settings
- Secure settings
- Security settings
- Spaces settings
- Task Manager settings
- Telemetry settings
- URL drilldown settings
- Start and stop Kibana
- Access Kibana
- Securing access to Kibana
- Add data
- Upgrade Kibana
- Configure security
- Configure reporting
- Configure logging
- Configure monitoring
- Command line tools
- Production considerations
- Discover
- Dashboards
- Canvas
- Maps
- Build a map to compare metrics by country or region
- Track, visualize, and alert on assets in real time
- Map custom regions with reverse geocoding
- Heat map layer
- Tile layer
- Vector layer
- Plot big data
- Search geographic data
- Configure map settings
- Connect to Elastic Maps Service
- Import geospatial data
- Troubleshoot
- Reporting and sharing
- Machine learning
- Graph
- Alerting
- Observability
- Search
- Security
- Dev Tools
- Fleet
- Osquery
- Stack Monitoring
- Stack Management
- Cases
- Connectors
- Amazon Bedrock
- Cases
- CrowdStrike
- D3 Security
- Google Gemini
- IBM Resilient
- Index
- Jira
- Microsoft Teams
- Observability AI Assistant
- OpenAI
- Opsgenie
- PagerDuty
- SentinelOne
- Server log
- ServiceNow ITSM
- ServiceNow SecOps
- ServiceNow ITOM
- Swimlane
- Slack
- TheHive
- Tines
- Torq
- Webhook
- Webhook - Case Management
- xMatters
- Preconfigured connectors
- License Management
- Maintenance windows
- Manage data views
- Numeral Formatting
- Rollup Jobs
- Manage saved objects
- Security
- Spaces
- Advanced Settings
- Tags
- Upgrade Assistant
- Watcher
- REST API
- Get features API
- Kibana spaces APIs
- Kibana role management APIs
- User session management APIs
- Saved objects APIs
- Data views API
- Index patterns APIs
- Alerting APIs
- Action and connector APIs
- Cases APIs
- Import and export dashboard APIs
- Logstash configuration management APIs
- Machine learning APIs
- Osquery manager API
- Short URLs APIs
- Get Task Manager health
- Upgrade assistant APIs
- Synthetics APIs
- Uptime APIs
- Kibana plugins
- Troubleshooting
- Accessibility
- Release notes
- Upgrade notes
- Kibana 8.17.2
- Kibana 8.17.1
- Kibana 8.17.0
- Kibana 8.16.4
- Kibana 8.16.3
- Kibana 8.16.2
- Kibana 8.16.1
- Kibana 8.16.0
- Kibana 8.15.5
- Kibana 8.15.4
- Kibana 8.15.3
- Kibana 8.15.2
- Kibana 8.15.1
- Kibana 8.15.0
- Kibana 8.14.3
- Kibana 8.14.2
- Kibana 8.14.1
- Kibana 8.14.0
- Kibana 8.13.4
- Kibana 8.13.3
- Kibana 8.13.2
- Kibana 8.13.1
- Kibana 8.13.0
- Kibana 8.12.2
- Kibana 8.12.1
- Kibana 8.12.0
- Kibana 8.11.4
- Kibana 8.11.3
- Kibana 8.11.2
- Kibana 8.11.1
- Kibana 8.11.0
- Kibana 8.10.4
- Kibana 8.10.3
- Kibana 8.10.2
- Kibana 8.10.1
- Kibana 8.10.0
- Kibana 8.9.2
- Kibana 8.9.1
- Kibana 8.9.0
- Kibana 8.8.2
- Kibana 8.8.1
- Kibana 8.8.0
- Kibana 8.7.1
- Kibana 8.7.0
- Kibana 8.6.1
- Kibana 8.6.0
- Kibana 8.5.2
- Kibana 8.5.1
- Kibana 8.5.0
- Kibana 8.4.3
- Kibana 8.4.2
- Kibana 8.4.1
- Kibana 8.4.0
- Kibana 8.3.3
- Kibana 8.3.2
- Kibana 8.3.1
- Kibana 8.3.0
- Kibana 8.2.3
- Kibana 8.2.2
- Kibana 8.2.1
- Kibana 8.2.0
- Kibana 8.1.3
- Kibana 8.1.2
- Kibana 8.1.1
- Kibana 8.1.0
- Kibana 8.0.0
- Kibana 8.0.0-rc2
- Kibana 8.0.0-rc1
- Kibana 8.0.0-beta1
- Kibana 8.0.0-alpha2
- Kibana 8.0.0-alpha1
- Developer guide
Using ES|QL
editUsing ES|QL
editThe Elasticsearch Query Language, ES|QL, makes it easier to explore your data without leaving Discover.
In this tutorial we’ll use the Kibana sample web logs in Discover and Lens to explore the data and create visualizations.
For the complete ES|QL documentation, including tutorials, examples and the full syntax reference, refer to the Elasticsearch documentation. For a more detailed overview of ES|QL in Kibana, refer to Use ES|QL in Kibana.
Prerequisite
editTo view the ES|QL option in Discover, the enableESQL
setting must be enabled from Kibana’s Advanced Settings. It is enabled by default.
Use ES|QL
editTo load the sample data:
- Install the web logs sample data.
- Go to Discover.
- Select Try ES|QL from the application menu bar.
Let’s say we want to find out what operating system users have and how much RAM is on their machine.
- Set the time range to Last 7 days.
-
Copy the query below:
We’re specifically looking for data from the sample web logs we just installed.
We’re only keeping the
machine.os
andmachine.ram
fields in the results table.Put each processing command on a new line for better readability.
-
Click ▶Run.
ES|QL keywords are not case sensitive.
Let’s add geo.dest
to our query, to find out the geographical destination of the visits, and limit the results.
-
Copy the query below:
FROM kibana_sample_data_logs | KEEP machine.os, machine.ram, geo.dest | LIMIT 10
-
Click ▶Run again. You can notice that the table is now limited to 10 results. The visualization also updated automatically based on the query, and broke down the data for you.
When you don’t specify any specific fields to retain using
KEEP
, the visualization isn’t broken down automatically. Instead, an additional option appears above the visualization and lets you select a field manually.
We will now take it a step further to sort the data by machine ram and filter out the GB
destination.
-
Copy the query below:
FROM kibana_sample_data_logs | KEEP machine.os, machine.ram, geo.dest | SORT machine.ram desc | WHERE geo.dest != "GB" | LIMIT 10
-
Click ▶Run again. The table and visualization no longer show results for which the
geo.dest
field value is "GB", and the results are now sorted in descending order in the table based on themachine.ram
field. - Click Save to save the query and visualization to a dashboard.
Edit the ES|QL visualization
editYou can make changes to the visualization by clicking the pencil icon. This opens additional settings that let you adjust the chart type, axes, breakdown, colors, and information displayed to your liking. If you’re not sure which route to go, check one of the suggestions available in the visualization editor.
If you’d like to keep the visualization and add it to a dashboard, you can save it using the floppy disk icon.
ES|QL and time series data
editBy default, ES|QL identifies time series data when an index contains a @timestamp
field. This enables the time range selector and visualization options for your query.
If your index doesn’t have an explicit @timestamp
field, but has a different time field, you can still enable the time range selector and visualization options by calling the ?_start
and ?_tend
parameters in your query.
For example, the eCommerce sample data set doesn’t have a @timestamp
field, but has an order_date
field.
By default, when querying this data set, time series capabilities aren’t active. No visualization is generated and the time picker is disabled.
FROM kibana_sample_data_ecommerce | KEEP customer_first_name, email, products._id.keyword

While still querying the same data set, by adding the ?_start
and ?_tend
parameters based on the order_date
field, Discover enables times series capabilities.
FROM kibana_sample_data_ecommerce | WHERE order_date >= ?_tstart and order_date <= ?_tend
