Canvas Workpads

Canvas is Kibana's presentation and infographic tool. Unlike dashboards which focus on interactivity and exploration, Canvas creates pixel-perfect, styled layouts with live data for wall-mounted displays, executive reports, and branded presentations.

Canvas vs Dashboards

Opening Canvas

1. Go to Canvas in the navigation menu (under Analytics)
2. Click "Create workpad"
3. Choose:

• Blank workpad: Start from scratch
• Sample workpads: Pre-built examples (if sample data loaded)
• Import workpad: Upload a JSON file

The Canvas Interface

┌──────────────────────────────────────────────────────────────┐
│ Workpad Name [+Page] [ Fullscreen] [Save] [] │
├──────┬───────────────────────────────────────────────────────┤
│ │ ┌──────────────────────────────────────────────────┐ │
│ E │ │ │ │
│ l │ │ │ │
│ e │ │ Canvas Page │ │
│ m │ │ │ │
│ e │ │ [Live Data Element] │ │
│ n │ │ │ │
│ t │ │ [Chart] [Image] │ │
│ s │ │ │ │
│ │ └──────────────────────────────────────────────────┘ │
├──────┤ ┌────┐ ┌────┐ ┌────┐ │
│ Style│ │ P1 │ │ P2 │ │ P3 │ ← Page thumbnails │
└──────┘ └────┘ └────┘ └────┘ │
└──────────────────────────────────────────────────────────────┘

Key Areas

1. Toolbar (top): Add elements, controls, page management
2. Elements panel (left): Add new elements to the page
3. Canvas area (center): The workpad page with absolute positioning
4. Style panel (left/right): Configure selected element styling
5. Page thumbnails (bottom): Navigate between pages

Workpad Settings

Page Size

Configure the workpad dimensions:

Presets:
- US Letter (1920  1080) → Standard HD display
- A4 Portrait (842  1191) → PDF reports
- Custom → Any dimensions

Common sizes for displays:
- 1920  1080 → Full HD TV/monitor
- 3840  2160 → 4K display
- 1080  1920 → Vertical display/kiosk

Background

Set page background:

Options:
- Solid color: #1a1a2e (dark theme)
- Gradient: Linear from #16213e to #0f3460
- Image: Upload background image

Auto-Refresh

Settings → Auto-refresh interval

Recommended:
- Real-time displays: 10-30 seconds
- Office dashboards: 1-5 minutes
- Reports: No auto-refresh

Adding Elements

Element Types

Click "Add element" in the toolbar:

Adding a Metric Element

1. Click "Add element" → "Metric"
2. A metric element appears on the canvas
3. Click the element to select it
4. Configure in the right panel:

Data tab:
 Data source: Elasticsearch SQL
 Query: SELECT SUM(taxful_total_price) AS revenue
 FROM "kibana_sample_data_ecommerce"

Display tab:
 Label: "Total Revenue"
 Format: Currency ($)
 Font size: 48px
 Color: #00ff88

Adding a Chart Element

1. Click "Add element" → "Chart"
2. Choose chart type (area, bar, line, pie, etc.)
3. Configure data source:

Data source: Elasticsearch SQL
Query:
 SELECT category.keyword AS category,
 SUM(taxful_total_price) AS revenue
 FROM "kibana_sample_data_ecommerce"
 GROUP BY category.keyword
 ORDER BY revenue DESC
 LIMIT 5

Chart settings:
 Type: Horizontal bar
 X-axis: revenue
 Y-axis: category
 Colors: Custom palette

Data Sources

Canvas supports multiple data sources for elements.

Elasticsearch SQL

The most common data source:

-- Simple count
SELECT COUNT(*) AS total_orders
FROM "kibana_sample_data_ecommerce"

-- Aggregation with grouping
SELECT manufacturer.keyword AS brand,
 COUNT(*) AS order_count,
 SUM(taxful_total_price) AS revenue,
 AVG(taxful_total_price) AS avg_order
FROM "kibana_sample_data_ecommerce"
GROUP BY manufacturer.keyword
ORDER BY revenue DESC
LIMIT 10

-- Time-based query
SELECT HISTOGRAM(order_date, INTERVAL 1 DAY) AS day,
 COUNT(*) AS orders,
 SUM(taxful_total_price) AS revenue
FROM "kibana_sample_data_ecommerce"
GROUP BY day
ORDER BY day

-- Filtered query
SELECT COUNT(*) AS error_count
FROM "filebeat-*"
WHERE level = 'error'
 AND @timestamp > NOW() - INTERVAL 1 HOUR

Timelion

Time-series expression language:

.es(index=kibana_sample_data_ecommerce,
 timefield=order_date,
 metric=sum:taxful_total_price)
 .title("Revenue Over Time")
 .label("Revenue")
 .color(#00ff88)

Static Data (Demo Data)

For prototyping or static labels:

{
 "type": "datatable",
 "columns": [
 { "name": "metric", "type": "string" },
 { "name": "value", "type": "number" }
 ],
 "rows": [
 { "metric": "Revenue", "value": 125430 },
 { "metric": "Orders", "value": 4675 },
 { "metric": "Customers", "value": 2341 }
 ]
}

Expressions

Canvas uses an expression language under the hood. Every element is defined by an expression.

Viewing an Element's Expression

1. Select an element
2. Click "Expression editor" (bottom of the page, code icon)
3. See the raw expression:

filters
| essql
 query="SELECT SUM(taxful_total_price) AS revenue FROM \"kibana_sample_data_ecommerce\""
| math "revenue"
| metric "Total Revenue"
 metricFont={font size=48 family="'Open Sans', Helvetica, Arial, sans-serif"
 color="#00ff88" align="center" lHeight=60}
 labelFont={font size=18 family="'Open Sans', Helvetica, Arial, sans-serif"
 color="#FFFFFF" align="center"}
| render

Expression Building Blocks

SOURCES (data retrieval)
 essql → Elasticsearch SQL query
 esdocs → Raw Elasticsearch documents
 timelion → Timelion expressions
 demodata → Sample static data
 filters → Current workpad filters

TRANSFORMS (data manipulation)
 math → Mathematical operations
 mapColumn → Transform column values
 filterrows → Filter data rows
 sort → Sort results
 head → First N rows
 tail → Last N rows
 columns → Select/rename columns

DISPLAY (rendering)
 metric → Big number display
 plot → Charts (line, bar, area, etc.)
 pie → Pie chart
 table → Data table
 markdown → Markdown text
 image → Image display
 shape → Geometric shapes
 progress → Progress bar
 render → Final render step

Custom Expression Examples

Metric with conditional color:

filters
| essql
 query="SELECT COUNT(*) AS errors
 FROM \"filebeat-*\"
 WHERE level = 'error'
 AND @timestamp > NOW() - INTERVAL 1 HOUR"
| math "errors"
| if {math "errors" | gt 100}
 then={metric "Critical Errors"
 metricFont={font size=60 color="#ff4444"}}
 else={metric "Errors"
 metricFont={font size=60 color="#00ff88"}}
| render

Formatted number:

filters
| essql query="SELECT SUM(taxful_total_price) AS revenue
 FROM \"kibana_sample_data_ecommerce\""
| math "revenue"
| formatnumber "$ 0,0.00"
| markdown "## Revenue\n**{{}}"
 font={font size=36 color="#ffffff" align="center"}
| render

Styling Elements

Positioning

Click an element and use the position controls:

Position:
 X: 100 (pixels from left)
 Y: 50 (pixels from top)

Size:
 Width: 400
 Height: 200

Rotation: 0

Layer:
 Bring forward / Send backward

Element Styling

Background:
 - Color: #1a1a2e
 - Opacity: 80%
 - Border: 1px solid #333
 - Border radius: 8px

Shadow:
 - X offset: 2px
 - Y offset: 4px
 - Blur: 8px
 - Color: rgba(0,0,0,0.5)

Padding:
 - Top/Bottom/Left/Right: 16px

Typography

Font:
 - Family: 'Inter', 'Open Sans', 'Helvetica'
 - Size: 14px - 72px
 - Weight: Normal / Bold
 - Color: #ffffff
 - Alignment: Left / Center / Right
 - Line height: 1.4

CSS Support

Canvas elements support custom CSS for advanced styling:

/* Apply to element via custom CSS option */
.canvasElement {
 background: linear-gradient(135deg, #1a1a2e 0%, #16213e 100%);
 border: 1px solid rgba(255, 255, 255, 0.1);
 border-radius: 12px;
 box-shadow: 0 4px 20px rgba(0, 0, 0, 0.3);
 transition: transform 0.2s ease;
}

.canvasElement:hover {
 transform: scale(1.02);
}

Multi-Page Workpads

Adding Pages

1. Click "+ Add page" at the bottom
2. Each page is like a slide in a presentation
3. Pages can have different backgrounds and layouts

Page Navigation

In edit mode: Click page thumbnails at the bottom
In fullscreen: Arrow keys or auto-advance

Auto-advance settings:
 Interval: 10 seconds per page
 Transition: Fade / Slide

Organizing Pages

Typical multi-page workpad:

Page 1: Executive Summary
 - Key KPIs (revenue, orders, customers)
 - Overall trend line
 - Company logo

Page 2: Sales Detail
 - Revenue by category
 - Top products
 - Geographic breakdown

Page 3: Operations
 - System health
 - Error rates
 - Response times

Page 4: Customer Insights
 - New vs returning
 - Cohort analysis
 - Customer satisfaction

Fullscreen and Kiosk Mode

Entering Fullscreen

1. Click the "Fullscreen" button () in the toolbar
2. Workpad fills the entire screen
3. All toolbars and navigation are hidden
4. Data continues to refresh based on auto-refresh settings

Kiosk Mode via URL

Access Canvas directly in kiosk mode for TV displays:

# Standard Canvas URL
https://kibana.example.com/app/canvas#/workpad/abc123/page/1

# Kiosk mode (no Kibana chrome)
https://kibana.example.com/app/canvas#/workpad/abc123/page/1?__fullScreen=true

Setting Up a Wall Display

1. Create workpad sized to your display (e.g., 1920  1080)
2. Configure auto-refresh (30 seconds)
3. Set up multi-page auto-advance (10 seconds per page)
4. Open in browser fullscreen mode (F11)
5. Set browser to auto-start on boot

Linux auto-start:
 chromium --kiosk "https://kibana:5601/app/canvas#/workpad/abc123?__fullScreen=true"

Workpad Templates

Creating a Template

Build a workpad and export it for reuse:

1. Build your workpad with layout and styling
2. Use placeholder data sources
3. Export: Click "..." → "Share" → "Download as JSON"
4. Save the JSON file as your template

Importing a Template

1. Go to Canvas → "Create workpad"
2. Click "Import workpad"
3. Select your JSON template
4. Modify data sources to point to your indices

Template Structure

{
 "id": "workpad-template-001",
 "name": "Operations Dashboard Template",
 "width": 1920,
 "height": 1080,
 "pages": [
 {
 "id": "page-1",
 "style": {
 "background": "#1a1a2e"
 },
 "elements": [
 {
 "id": "element-1",
 "type": "metric",
 "expression": "filters | essql query=\"...\" | math ...",
 "position": { "left": 50, "top": 30, "width": 400, "height": 200 }
 }
 ]
 }
 ]
}

Practical Examples

Example 1: NOC Wall Display

Network Operations Center display for monitoring:

Page layout (1920  1080):

┌────────────────────────────────────────────────────────┐
│ [Logo] Network Operations Center [Clock/Date] │
├────────┬────────┬────────┬────────┬────────────────────┤
│ Active │ Error │ Avg │ Uptime │ │
│ Users │ Rate │ Resp. │ │ Traffic │
│ 1,234 │ 0.3% │ 145ms │ 99.98% │ Over Time │
│ │ │ │ │ (area chart) │
├────────┴────────┴────────┤ │ │
│ │ │ │
│ Top Error Endpoints ├────────┴────────────────────┤
│ /api/checkout 45 │ │
│ /api/search 23 │ Server Health Map │
│ /api/payment 12 │ (table with colors) │
│ │ │
└──────────────────────────┴─────────────────────────────┘

Data sources:
- Metric elements: essql queries with 30s refresh
- Area chart: Timelion for time series
- Error table: essql with ORDER BY count DESC

Key metric expression:

filters
| essql query="SELECT COUNT(DISTINCT clientip) AS active
 FROM \"filebeat-*\"
 WHERE @timestamp > NOW() - INTERVAL 5 MINUTE"
| math "active"
| metric "Active Users"
 metricFont={font size=60 color="#00ff88" align="center"}
 labelFont={font size=16 color="#888888" align="center"}
| render

Example 2: Executive Revenue Report

Multi-page branded report:

Page 1: Cover Page
 - Company logo (image element)
 - Report title (markdown)
 - Date range (time filter value)
 - Generated timestamp

Page 2: Revenue Overview
 - Total Revenue metric
 - Revenue trend (area chart)
 - Revenue by region (horizontal bar)
 - vs. Previous period comparison

Page 3: Product Performance
 - Top 10 products table
 - Category breakdown (pie chart)
 - Product revenue trend per category

Page 4: Customer Insights
 - Unique customers metric
 - Revenue per customer metric
 - Geographic distribution (if map data available)

Example 3: Real-Time Sales Counter

Minimal display for retail environments:

Layout (1080  1920, vertical):

┌────────────────────┐
│ │
│ TODAY'S SALES │
│ │
│ $47,832.00 │
│ ↑ 12% vs yday │
│ │
│ ──────────── │
│ │
│ ORDERS: 423 │
│ │
│ ──────────── │
│ │
│ [Progress bar] │
│ 84% of target │
│ │
│ ──────────── │
│ │
│ TOP PRODUCT: │
│ Premium Shirt │
│ ($2,340) │
│ │
└────────────────────┘

Auto-refresh: 10 seconds

Tips and Best Practices

Design Tips

 Design for the target screen size and resolution
 Use high-contrast colors for readability at distance
 Keep fonts large (48px+ for metrics, 24px+ for labels)
 Use consistent color coding (green=good, red=bad)
 Limit to 6-8 data elements per page

 Don't overcrowd pages (whitespace is good)
 Don't use small text on wall displays
 Don't use light colors on light backgrounds
 Don't show unnecessary decoration

Performance Tips

 Use essql with specific queries (no SELECT *)
 Limit result sets (LIMIT 10)
 Use appropriate refresh intervals (not too frequent)
 Optimize Elasticsearch queries for speed

 Don't query all indices when one suffices
 Don't refresh every second (5-10s minimum)
 Don't use complex aggregations without caching

Maintainability

 Use descriptive element names
 Group related elements on the same page
 Document data sources in a markdown element
 Export backups of important workpads regularly
 Use templates for consistent branding

 Don't hardcode dates in queries (use NOW() and intervals)
 Don't rely on Canvas for complex analysis (use dashboards)

Common Issues

"No data" on elements

Causes:

1. SQL query error → Check expression editor for errors
2. Wrong index name → Verify index exists
3. Time range → Ensure data falls within query timeframe

Fix: Open expression editor, test the query step by step.

Elements overlap incorrectly

Fix: Use layer ordering:

• Right-click element → "Send to back" / "Bring to front"
• Or use the layer controls in the position panel

Workpad doesn't auto-refresh

Fix:

1. Check auto-refresh is enabled (Settings icon)
2. Ensure the filters function is at the start of expressions
3. Verify Kibana can reach Elasticsearch

Next Steps

Continue to 10-alerts.md for setting up alerts and notifications.