Lens Visualization Editor

Lens is Kibana's recommended visualization editor. It provides a drag-and-drop interface that intelligently suggests chart types based on the fields you select, making it fast to build effective visualizations without deep aggregation knowledge.

Why Lens?

Use Lens unless you need a specific feature only available in aggregation-based or TSVB editors.

Opening Lens

From Dashboard

1. Open or create a dashboard
2. Click "Create visualization"
3. Lens opens by default

From Visualize Library

1. Go to Visualize Library
2. Click "Create visualization"
3. Select "Lens"

From Discover

1. Run a search in Discover
2. Click "Visualize" in the toolbar
3. Opens Lens with your current search context

The Lens Interface

┌─────────────────────────────────────────────────────────────┐
│ Data view: [logs-* ▼] [Save] [Suggestions ▼] │
├──────────┬──────────────────────────────────────────────────┤
│ │ Chart Type: [Bar ▼] [Line] [Area] [Pie] [...] │
│ Field │ ┌──────────────────────────────────────────────┐ │
│ List │ │ │ │
│ │ │ Visualization │ │
│ # bytes │ │ Preview │ │
│ t host │ │ │ │
│  @time │ │ ████ │ │
│  status│ │ ████ ███ │ │
│ ... │ │ ████ ███ ██ │ │
│ │ └──────────────────────────────────────────────┘ │
│ │ ┌─────────────────┐ ┌──────────────────────┐ │
│ │ │ Horizontal axis │ │ Vertical axis │ │
│ │ │ [Drop field] │ │ [Drop field] │ │
│ │ └─────────────────┘ └──────────────────────┘ │
│ │ ┌─────────────────┐ │
│ │ │ Break down by │ │
│ │ │ [Drop field] │ │
│ │ └─────────────────┘ │
└──────────┴──────────────────────────────────────────────────┘

Key Areas

1. Field list (left): All fields from the selected data view
2. Chart type selector (top): Switch between visualization types
3. Preview area (center): Live preview of your visualization
4. Configuration zones (bottom): Drop zones for fields
5. Suggestions (top-right): Lens recommends alternative chart types

Building Your First Lens Visualization

Step 1: Select Data View

Choose the data view containing your data from the dropdown at the top-left.

Step 2: Drag Fields

Drag fields from the left panel into the configuration zones:

Example: Revenue over time

1. Drag "order_date" to Horizontal axis
 → Lens creates a date histogram automatically

2. Drag "taxful_total_price" to Vertical axis
 → Lens uses "Sum" aggregation by default
 → Preview shows a bar chart

Step 3: Adjust Chart Type

Click the chart type icons to switch:

Lens chose: Bar chart
But you want: Line chart

Click the line chart icon → Visualization updates instantly

Step 4: Refine Configuration

Click on any axis configuration to modify:

Click on "Sum of taxful_total_price":
 - Change function: Sum → Average → Median → Count
 - Change label: "Total Revenue"
 - Change format: Number → Currency

Step 5: Save

Click "Save and return" (to dashboard) or "Save to library" (standalone).

Chart Types in Lens

Bar and Column Charts

Vertical bar: Categories on X-axis, values on Y-axis. Horizontal bar: Categories on Y-axis, values on X-axis.

Configuration:
 Horizontal axis: category.keyword (Top values, 10)
 Vertical axis: Count
 Break down by: (optional) manufacturer.keyword

Options:
 - Stacked / Grouped / Percentage
 - Show value labels
 - Fit to axis bounds

Line Charts

Best for time series and trends.

Configuration:
 Horizontal axis: @timestamp (Date histogram)
 Vertical axis: Average of response_time

Options:
 - Curved / Straight lines
 - Show points
 - Missing values: Skip / Connect / Zero
 - Line thickness

Area Charts

Like line charts but with filled area beneath.

Configuration:
 Horizontal axis: @timestamp
 Vertical axis: Count
 Break down by: response (Top 3 values)

Options:
 - Stacked / Percentage / Overlapping
 - Opacity (fill level)

Pie and Donut Charts

Part-to-whole relationships.

Configuration:
 Slice by: category.keyword (Top values, 5)
 Size by: Sum of taxful_total_price

Options:
 - Pie / Donut / Treemap / Mosaic / Waffle
 - Show labels / percentages
 - Empty size ratio (donut hole size)

Metric

Single large number display.

Configuration:
 Primary metric: Sum of taxful_total_price
 Maximum: 100000 (for progress bar)

Options:
 - Trend line (show sparkline)
 - Color by value (thresholds)
 - Subtitle text
 - Prefix / Suffix ($, %, etc.)

Data Table

Tabular aggregation results.

Configuration:
 Rows: category.keyword (Top 10)
 Metrics:
 - Count
 - Sum of taxful_total_price
 - Average of taxful_total_price

Options:
 - Row totals
 - Column totals
 - Pagination
 - Alignment
 - Dynamic coloring

Gauge

Progress toward a goal.

Configuration:
 Metric: Count
 Goal: 1000
 Band colors:
 - 0-400: Red
 - 400-700: Yellow
 - 700-1000: Green

Types: Arc / Circle / Semi-circle

Heatmap

Two-dimensional density visualization.

Configuration:
 Horizontal axis: day_of_week (Top values, 7)
 Vertical axis: hour_of_day (Intervals, step 1)
 Cell value: Count

Options:
 - Color palette (green-red, blue-red, custom)
 - Show labels in cells
 - Custom value range

Tag Cloud

Word frequency visualization.

Configuration:
 Tags: products.product_name.keyword (Top 50)
 Size by: Count

Options:
 - Orientation (horizontal, vertical, mixed)
 - Min/Max font size

Functions and Formulas

Built-in Functions

Lens provides these aggregation functions:

Metric Functions:

Bucket Functions:

Formula Mode

Lens supports formulas for complex calculations. Click on a metric and select "Formula":

# Basic math
sum(taxful_total_price) / count()

# Percentage
count(kql='response: 200') / count() * 100

# Difference from average
average(response_time) - overall_average(response_time)

# Conditional counting
count(kql='level: "error"') / count() * 100

Formula Syntax

FUNCTIONS
 count() Document count
 count(kql='field: value') Filtered count
 sum(field_name) Sum of field
 average(field_name) Average of field
 min(field_name) Minimum
 max(field_name) Maximum
 percentile(field_name, 95) 95th percentile
 unique_count(field_name) Cardinality
 last_value(field_name) Most recent value
 counter_rate(field_name) Rate of counter

MATH
 + - * / Basic arithmetic
 () Grouping

COMPARISON (for color rules)
 Formulas return numbers - use color rules for thresholds

SPECIAL
 overall_sum(metric) Total across all buckets
 overall_average(metric) Average across all buckets
 overall_min(metric) Min across all buckets
 overall_max(metric) Max across all buckets
 cumulative_sum(metric) Running total
 differences(metric) Change from previous bucket
 moving_average(metric, window=7) Smoothed trend
 time_scale(metric, unit='1h') Normalize to time unit

Formula Examples

Error rate percentage:

count(kql='response >= 400') / count() * 100

Revenue per customer:

sum(taxful_total_price) / unique_count(customer_id)

Week-over-week growth:

differences(sum(taxful_total_price))

Moving average (7-day):

moving_average(sum(taxful_total_price), window=7)

Percentage of total:

sum(taxful_total_price) / overall_sum(sum(taxful_total_price)) * 100

Normalized rate (per hour):

time_scale(count(), unit='1h')

Multi-Layer Visualizations

Lens supports multiple layers on a single chart, useful for overlaying different metrics or reference lines.

Adding a Layer

1. Click "Add layer" at the bottom of the configuration panel
2. Choose layer type:

Example: Response Time with SLA Line

Layer 1 (Visualization):
 Type: Line
 X-axis: @timestamp
 Y-axis: percentile(response_time, 95)
 Label: "p95 Response Time"

Layer 2 (Reference line):
 Value: 500
 Label: "SLA Threshold"
 Color: Red
 Style: Dashed

Example: Error Rate with Deployment Annotations

Layer 1 (Visualization):
 Type: Area
 X-axis: @timestamp
 Y-axis: count(kql='response >= 500')

Layer 2 (Annotations):
 Data view: deployments-*
 Field: deploy_time
 Label: version
 Icon: Flag

Dual Axis

Show two metrics with different scales:

Layer 1 (Left Y-axis):
 Y-axis: Count of requests
 Axis title: "Request Count"
 Position: Left

Layer 2 (Right Y-axis):
 Y-axis: Average response_time
 Axis title: "Avg Response (ms)"
 Position: Right

Customization Options

Legend

Position: Right / Bottom / Top / Left / Hidden
- Show values in legend
- Truncate labels at N characters
- Number of lines per label

Colors

- Custom palette: Choose specific colors per series
- Gradient palettes: For continuous data (heatmaps)
- By value coloring: Threshold-based colors
 - < 100: Green
 - 100-500: Yellow
 - > 500: Red

Axis Settings

Left axis:
 - Title: "Total Revenue ($)"
 - Bounds: Auto / Custom (0 to 10000)
 - Orientation: Horizontal / Vertical

Bottom axis:
 - Title: "Date"
 - Extent: Data bounds / Custom
 - Label rotation: 0 / 45 / 90

Value Format

Click on a metric to change its display format:

Format options:
 - Number (1,234.56)
 - Percent (0.85 → 85%)
 - Bytes (1536000 → 1.5 MB)
 - Bits (8192 → 8 Kbit)
 - Currency ($1,234.56)
 - Custom (suffix, prefix, decimals)

Suggestions Panel

Lens analyzes your current field selection and suggests alternative visualizations:

1. Click "Suggestions" in the top-right
2. Browse recommended chart types
3. Click one to instantly switch
4. Undo with Ctrl/Cmd + Z if you don't like it

Example flow:
 You build: Bar chart of top categories by count
 Lens suggests:
 - Pie chart (same data, different view)
 - Treemap (hierarchical view)
 - Table (detailed numbers)
 - Metric (if single category selected)

Practical Examples

Example 1: Operations Dashboard Panels

Request Rate (Line Chart):

Data view: webserver-logs-*
Horizontal axis: @timestamp (auto interval)
Vertical axis: count() with time_scale(count(), unit='1s')
Label: "Requests per Second"

Error Rate (Metric with Trend):

Data view: webserver-logs-*
Primary metric: Formula
 count(kql='response >= 500') / count() * 100
Subtitle: "Server Error Rate"
Format: Percent (1 decimal)
Color rules:
 - < 1%: Green
 - 1-5%: Yellow
 - > 5%: Red
Secondary metric: Trend line (show direction)

Response Time Percentiles (Line Chart, Multi-Layer):

Layer 1:
 X: @timestamp
 Y: percentile(response_time, 50) → "p50 (Median)"
 Color: Blue

Layer 2 (add layer):
 X: @timestamp
 Y: percentile(response_time, 95) → "p95"
 Color: Orange

Layer 3 (add layer):
 X: @timestamp
 Y: percentile(response_time, 99) → "p99"
 Color: Red

Reference line: 500ms SLA threshold (dashed red)

Example 2: E-Commerce Analysis

Revenue vs Orders (Dual Axis):

Layer 1 (left axis):
 X: order_date (weekly)
 Y: sum(taxful_total_price)
 Type: Bar
 Label: "Weekly Revenue"

Layer 2 (right axis):
 X: order_date (weekly)
 Y: count()
 Type: Line
 Label: "Order Count"

Customer Cohort Table:

Type: Data Table
Rows: Split by geoip.country_iso_code (Top 10)
Metrics:
 - unique_count(customer_id) → "Customers"
 - count() → "Orders"
 - sum(taxful_total_price) → "Revenue"
 - Formula: sum(taxful_total_price) / unique_count(customer_id) → "Rev/Customer"

Sort: Revenue descending
Color: Revenue column with gradient

Example 3: Infrastructure Heatmap

Type: Heatmap
Data view: metricbeat-*
X-axis: host.name (Top 20)
Y-axis: Filters:
 - system.cpu.total.pct > 0 → "CPU"
 - system.memory.used.pct > 0 → "Memory"
 - system.filesystem.used.pct > 0 → "Disk"
Cell value: Average of each metric
Palette: Green (0%) to Red (100%)

Tips and Best Practices

Workflow Tips

 Start with drag-and-drop, refine with configuration
 Use suggestions to explore alternative chart types
 Switch to formula mode for complex calculations
 Use Ctrl/Cmd+Z to undo changes
 Save frequently while building complex visualizations

 Don't start with formulas (drag fields first)
 Don't ignore suggestions (they often reveal better options)
 Don't put too many series on one chart (max 5-7)

Performance Tips

 Use Top 5-10 instead of Top 100 for terms
 Narrow time range before building visualizations
 Use date histogram with reasonable intervals
 Prefer count() and sum() over expensive calculations

 Avoid percentile() on high-cardinality fields
 Avoid unique_count() on text fields (use keyword)
 Avoid wide time ranges with small intervals

Design Tips

 Choose the right chart type for the data
 Label axes clearly with units
 Use consistent colors across related panels
 Add reference lines for context (SLAs, targets)
 Show data labels on metrics and bar charts

 Don't use pie charts for more than 7 categories
 Don't use 3D effects
 Don't rely on color alone (add labels)
 Don't truncate axis to exaggerate differences

Next Steps

Continue to 09-canvas.md for creating pixel-perfect presentations with Canvas.