Elasticsearch with Kibana

Analogy categoryAnalogies

What Kibana Is and How It Talks to Elasticsearch

Kibana is a browser-based application that sits in front of an Elasticsearch cluster and communicates with it exclusively through the same REST API that any client application would use, typically on port 9200. It does not store data itself; every Discover query, dashboard panel, and Dev Tools command is translated into Elasticsearch Query DSL or an internal API call, sent over HTTP, and rendered from the JSON response. Because Kibana is stateless with respect to your indexed data, you can point it at a different cluster simply by changing elasticsearch.hosts in kibana.yml.

🏏

Cricket analogy: Kibana is like the broadcaster's graphics overlay at a match — Hawk-Eye and Snickometer don't store the ball's physics themselves, they query the tracking system's data feed in real time and render it as a visual for the viewer.

Exploring Documents with Discover

The Discover app is where you interactively search raw documents using a Data View (formerly index pattern) that maps to one or more indices, such as logs-*. You type queries using KQL (Kibana Query Language) or Lucene syntax in the search bar, apply a time range against a configured @timestamp field, and Kibana issues a search request under the hood with the equivalent bool query and range filter. The resulting hits are shown as a sortable, expandable document table, and you can add specific fields as columns to focus on what matters, such as status_code or user.id in a log dataset.

🏏

Cricket analogy: Discover is like using Cricinfo's ball-by-ball commentary search to filter every delivery Jasprit Bumrah bowled in the death overs of IPL matches — you narrow a huge log of deliveries down to just the rows that match your filter.

Building Visualizations and Dashboards

Kibana's Lens editor lets you drag fields onto a canvas to build bar charts, line charts, and data tables by choosing an aggregation, such as a date histogram bucketed by day combined with an average or percentile metric on a numeric field. Under the hood each visualization is one Elasticsearch aggregation request, and a Dashboard is simply a saved collection of these visualization panels laid out on a grid, optionally sharing a global time range and filter pills. This makes dashboards live views rather than static reports — refreshing the page reruns every underlying aggregation against current data.

🏏

Cricket analogy: Building a Lens chart is like a coach dragging match data into a tool to plot a batter's strike rate by over, bucketing every ball into six-ball groups instead of listing raw deliveries.

Dev Tools Console and Index Management

The Dev Tools Console gives you a lightweight editor for issuing raw Elasticsearch REST calls with autocomplete and syntax highlighting, using a simplified shorthand like GET my-index/_search instead of a full curl command with headers. It's the fastest way to prototype a query, inspect mapping with GET my-index/_mapping, or run administrative actions such as creating an index lifecycle policy, before wiring the same request into an application. Stack Management within Kibana then exposes GUI equivalents for many of these tasks, including creating Data Views, managing index templates, and configuring roles.

🏏

Cricket analogy: The Dev Tools console is like a scorer's manual override pad at the ground, letting an official type a direct correction into the system, such as fixing a misattributed wicket, without going through the public scoreboard interface.

json

GET orders-2026.07/_search
{
  "query": {
    "bool": {
      "filter": [
        { "range": { "@timestamp": { "gte": "now-1d/d" } } },
        { "term": { "status": "failed" } }
      ]
    }
  },
  "aggs": {
    "errors_over_time": {
      "date_histogram": { "field": "@timestamp", "fixed_interval": "1h" }
    }
  },
  "size": 0
}

Every Lens visualization and Discover query you build in the UI can be inspected by clicking 'Inspect' on the panel to see the exact Elasticsearch request and response — a fast way to learn Query DSL by watching Kibana generate it for you.

Kibana's saved objects (dashboards, visualizations, index patterns) live in a hidden .kibana index inside Elasticsearch itself. Deleting or reindexing that system index without exporting saved objects first can wipe out every dashboard you've built.

Kibana stores no data of its own; it renders everything from live REST calls to Elasticsearch.
Discover queries raw documents against a Data View using KQL or Lucene syntax.
Lens visualizations are backed by Elasticsearch aggregations, and dashboards are collections of saved panels.
Dev Tools Console offers a fast shorthand syntax for raw REST calls with autocomplete.
Stack Management provides GUI equivalents for index templates, ILM policies, and role management.
Kibana's own configuration and dashboards are stored in a hidden .kibana system index.
Use 'Inspect' on any panel to see and learn the underlying Query DSL request.