Skip to main content

Kibana: Data View, Discover, KQL, Lens and dashboards

The previous five modules happened inside a console. Léa will not open Dev Tools whenever a Veille client asks for the article breakdown by month: she wants to click, filter, compare, export. Kibana is that visual workshop built on top of the news index.

The kit ships Kibana in French

The kit sets I18N_LOCALE=fr-FR, so the interface you will see is entirely in French. The labels cited in this module are therefore the exact French wording you will read on screen, with the English label in parentheses on first mention (for example « Discover (Discover) », « Vues de données (Data Views) », « Analytique (Analytics) », « Visualize Library (Visualize Library) »). The concepts and the JSON payloads are identical to the English UI — only the button text changes.

Switch Kibana to English

Prefer the English UI? Edit .env, change I18N_LOCALE=fr-FR to I18N_LOCALE=en, then rerun:

./lab.sh reset
./lab.sh up

The rest of this module keeps the French labels the kit shows by default.

Open Kibana and get your bearings​

After ./lab.sh up, the URL is http://localhost:5601. Sign in with elastic / veille2026. The side menu (hamburger icon top-left) lists the main families:

  • Analytique (Analytics) → Discover (Discover), Tableaux de bord (Dashboards), Visualize Library (Visualize Library).
  • Outils de développement (Developer tools) → Console (Console), aka Dev Tools, the one from module 5.
  • Gestion (Management) → Stack Management → Vues de données (Data Views).

The keyboard shortcut Ctrl+/ opens the command palette and serves as a universal navigation engine.

Create the news data view​

A vue de données (Data View) tells Kibana which index to use and which field represents time. Without it, Discover finds nothing.

  1. Menu → Stack Management → Vues de données (Data Views).
  2. Click Créer une vue de données (Create data view).
  3. Nom (Name): news. Motif de nom d'index (Index pattern): news. Kibana confirms « ✓ Votre motif d'index correspond à 1 source ».
  4. Champ d'horodatage (Timestamp field): pick date.
  5. Save. The view is now listed.
Pitfall number one: "no results" in Discover

Kibana defaults the date range to the last fifteen minutes. The News corpus runs from 2012-01-28 to 2018-05-26: no recent data, so Discover shows « Aucun résultat » and everyone thinks it is a bug. The right answer is to switch the range to absolute on 2012-01-01 → 2018-06-01 before anything else (see below). Do it once, save the search, and you will not fall into the trap again.

Discover: browse, filter, export​

Menu → Analytique (Analytics) → Discover (Discover). Top right, click the time picker (default « ~ 15 dernières minutes »), tab Absolu (Absolute), enter:

  • De (From): 2012-01-01 00:00:00
  • À (To): 2018-06-01 00:00:00
  • Actualiser (Refresh).

The histogram comes back, with seven years of bars, and the document list appears below. On the left, the Champs disponibles (Available fields) column lets you drag headline, category, date, authors into the central table.

The top bar accepts KQL (Kibana Query Language). Three examples Léa uses every day:

category : "POLITICS" and headline : trump
headline : "climate change" and date >= "2016-01-01"
authors : "Lee Moran" and category : COMEDY

Two rules are enough: values with spaces or exact uppercase are wrapped in quotes; and, or, not are lowercase. Next to the bar, each green pill is a clickable filter you can edit, enable/disable, or pin so it survives tab changes.

Save and export​

Enregistrer (Save) button on top → Nom (Name): Recherche Veille — climat 2016+. This saved search can be recalled elsewhere (Lens, Dashboards). The Partager (Share) button exports the results as CSV for a client, or copies a short URL including every active filter.

Lens: four visualizations with no code​

Menu → Analytique (Analytics) → Visualize Library (Visualize Library) → Créer une visualisation (Create visualization) → Lens. Select the news view. Interface: fields list on the left, visualization area in the middle, settings on the right. Drag and drop, and Kibana proposes the best type.

Léa's "Veille" dashboard contains exactly four panels, to build in order then save.

1. Metric — Total number of articles​

  • Suggested type: Métrique (Metric).
  • Drag the Records field (native count) onto the area.
  • Check the aggregation: Count of records.
  • Result: 200,853.
  • Enregistrer et retourner (Save and return) → title Total articles.

2. Vertical bars — Top 10 categories​

  • Suggested type: Barres verticales (Vertical bar).
  • Horizontal axis: drag category, aggregation Termes principaux (Top values), size 10, sorted by record count descending.
  • Vertical axis: Count of records.
  • Result: POLITICS 32,739 in the lead, then WELLNESS 17,827, ENTERTAINMENT 16,058, TRAVEL 9,887, STYLE & BEAUTY 9,649.
  • Title: Top 10 catégories.

3. Line — Number of articles per month​

  • Suggested type: Ligne (Line).
  • Horizontal axis: drag date, aggregation Date histogramme (Date histogram), interval Mois (Month).
  • Vertical axis: Count of records.
  • Title: Volume mensuel 2012-2018.

4. Pie — Share of the top five categories​

  • Suggested type: Camembert (Pie).
  • Slice by: category, Top values, size 5.
  • Metric: Count of records.
  • Title: Part des 5 catégories dominantes.

The "Veille" dashboard​

Menu → Analytique (Analytics) → Tableaux de bord (Dashboards) → Créer un tableau de bord (Create dashboard).

  1. Button Ajouter depuis la bibliothèque (Add from library) → tick the four visualizations built above.
  2. Rearrange: metric top-left, pie on the right, bars and line below.
  3. Add a contrôle (Controls) to filter by category: Contrôles button on top → Ajouter un contrôle (Add control) → field category → Liste des options (Options list). A drop-down appears, the four panels filter live.
  4. Set the absolute time range 2012-01-01 → 2018-06-01 and save it as a preset (checkbox « Enregistrer avec l'intervalle de temps »).
  5. Enregistrer (Save) → title Veille — vue d'ensemble.
URL-driven filters

The Partager (Share) tab offers a short link that contains the dashboard state (filters, range, hidden panels). Karim embeds it in the client area without duplicating the dashboard.

Export and import saved objects​

A dashboard can travel between installs thanks to the .ndjson format (one JSON line per object).

  • Menu → Stack Management → Objets enregistrés (Saved Objects).
  • Filter by Type = Dashboard, tick Veille — vue d'ensemble.
  • Exporter (Export) → tick « Inclure les objets associés » (visualizations, data view) → download export.ndjson.
  • On another install, come back to the same screen → Importer (Import) → drop the file. Use the "Check for conflicts" option to rename duplicates.

This mechanism is what lets Léa hand a dashboard to a client without forcing them to reclick everything.

Dev Tools: the shortcuts that save time​

Menu → Outils de développement (Dev Tools) → Console (Console) tab.

  • Contextual autocomplete: start with GET n, the index list appears.
  • Ctrl+Enter runs the request under the cursor.
  • Ctrl+I reformats the request JSON.
  • Historique (History) (clock icon top-right) replays a past command.
  • Multi-selection: you can run several requests by clicking the individual green triangles.
  • A line GET news/_search can be preceded by // comments — handy to document a session.

Try it 1 — Filter Discover on Reuters articles in 2017​

Build the filter in KQL, narrow the period, keep only the columns date, headline, category. How many results?

Solution

KQL bar:

authors : "Reuters" and date >= "2017-01-01" and date < "2018-01-01"

Time picker: Absolu (Absolute) range 2017-01-01 → 2018-01-01. Columns: click the + next to date, headline, category in the fields list. The counter top-left shows the total on this sub-set (your number may differ slightly but stays much lower than Reuters's 4,954 across the whole corpus).

Try it 2 — Build a "Most active authors in 2018" visualization​

Horizontal bars, top 10 of authors.raw, period 2018 only.

Solution
  • Menu → Visualize Library → Créer (Create) → Lens → view news.
  • Time picker: Absolu (Absolute) 2018-01-01 → 2018-06-01.
  • Type: Barres horizontales (Horizontal bar).
  • Vertical axis (categories): authors.raw, Top values, size 10.
  • Horizontal axis (values): Count of records.
  • Title: Auteurs les plus actifs (2018).
  • Save it in the library, then add it to the Veille dashboard via Ajouter depuis la bibliothèque.

Try it 3 — Export then re-import the dashboard​

Save Veille — vue d'ensemble as .ndjson, delete the dashboard, re-import the file, check that the four panels come back.

Solution
  • Stack Management → Objets enregistrés (Saved Objects) → filter Type = Dashboard → tick Veille — vue d'ensemble → Exporter (Export) (with associated objects).
  • Still in the same list, delete the dashboard (the visualizations remain).
  • Importer (Import) → drop export.ndjson → choose "Create a new object with a new identifier" if a conflict comes up.
  • Go back to Analytique → Tableaux de bord: Veille — vue d'ensemble is present, the four panels display the same numbers as before. The .ndjson format also carries the news data view if you tick « Inclure les objets associés ».

Key takeaways​

  • A data view points at the index and the time field: without it, no Discover, no Lens.
  • Pitfall number one: set the time range to absolute on 2012-01-01 → 2018-06-01, otherwise Discover shows « aucun résultat ».
  • KQL: field : value, and / or / not lowercase, quotes around values with spaces.
  • Lens builds four chart types by drag and drop: metric, bars, line, pie.
  • The Veille dashboard combines those four panels and a control on category.
  • Export/import in .ndjson with associated objects: the clean way to share a dashboard.
  • Dev Tools: Ctrl+Enter runs, Ctrl+I reformats, history replays.

Troubleshooting​

  • "Aucun résultat" in Discover → the default time range is too short, switch to Absolu 2012-01-01 → 2018-06-01.
  • "Kibana server is not ready yet" → the setup service did not set the kibana_system password; rerun with ./lab.sh down && ./lab.sh up and follow ./lab.sh logs setup.
  • The news data view does not show in Lens → you are probably in another Kibana Espace (Space); menu Espaces (Spaces) → return to Default or recreate the view in the current space.
  • A Lens visualization stays empty on 2012 data → the dashboard time picker overrides the panel; tick "Utiliser le temps global (Use global time)" or set the range on the panel itself.

Further reading​