Canvas Workpads

Canvas is Kibana's presentation and infographic tool. Unlike dashboards which focus on interactivity and exploration, Canvas creates pixel-perfect, styled layouts with live data for wall-mounted displays, executive reports, and branded presentations.

Canvas vs Dashboards

Opening Canvas

1. Go to Canvas in the navigation menu (under Analytics)
2. Click "Create workpad"
3. Choose:
   • Blank workpad: Start from scratch
   • Sample workpads: Pre-built examples (if sample data loaded)
   • Import workpad: Upload a JSON file

The Canvas Interface

┌──────────────────────────────────────────────────────────────┐
│  Workpad Name            [+Page] [▶ Fullscreen]  [Save] [⋯]  │
├──────┬───────────────────────────────────────────────────────┤
│      │  ┌──────────────────────────────────────────────────┐ │
│  E   │  │                                                  │ │
│  l   │  │                                                  │ │
│  e   │  │            Canvas Page                           │ │
│  m   │  │                                                  │ │
│  e   │  │     [Live Data Element]                          │ │
│  n   │  │                                                  │ │
│  t   │  │              [Chart]         [Image]             │ │
│  s   │  │                                                  │ │
│      │  └──────────────────────────────────────────────────┘ │
├──────┤  ┌────┐ ┌────┐ ┌────┐                                │
│ Style│  │ P1 │ │ P2 │ │ P3 │  ← Page thumbnails             │
└──────┘  └────┘ └────┘ └────┘                                │
└──────────────────────────────────────────────────────────────┘

Key Areas

1. Toolbar (top): Add elements, controls, page management
2. Elements panel (left): Add new elements to the page
3. Canvas area (center): The workpad page with absolute positioning
4. Style panel (left/right): Configure selected element styling
5. Page thumbnails (bottom): Navigate between pages

Workpad Settings

Page Size

Configure the workpad dimensions:

Presets:
- US Letter (1920 × 1080)    → Standard HD display
- A4 Portrait (842 × 1191)   → PDF reports
- Custom                      → Any dimensions

Common sizes for displays:
- 1920 × 1080    → Full HD TV/monitor
- 3840 × 2160    → 4K display
- 1080 × 1920    → Vertical display/kiosk

Background

Set page background:

Options:
- Solid color:    #1a1a2e (dark theme)
- Gradient:       Linear from #16213e to #0f3460
- Image:          Upload background image

Auto-Refresh

Settings → Auto-refresh interval

Recommended:
- Real-time displays: 10-30 seconds
- Office dashboards: 1-5 minutes
- Reports: No auto-refresh

Adding Elements

Element Types

Click "Add element" in the toolbar:

Adding a Metric Element

1. Click "Add element" → "Metric"
2. A metric element appears on the canvas
3. Click the element to select it
4. Configure in the right panel:

Data tab:
  Data source: Elasticsearch SQL
  Query: SELECT SUM(taxful_total_price) AS revenue
         FROM "kibana_sample_data_ecommerce"

Display tab:
  Label: "Total Revenue"
  Format: Currency ($)
  Font size: 48px
  Color: #00ff88

Adding a Chart Element

1. Click "Add element" → "Chart"
2. Choose chart type (area, bar, line, pie, etc.)
3. Configure data source:

Data source: Elasticsearch SQL
Query:
  SELECT category.keyword AS category,
         SUM(taxful_total_price) AS revenue
  FROM "kibana_sample_data_ecommerce"
  GROUP BY category.keyword
  ORDER BY revenue DESC
  LIMIT 5

Chart settings:
  Type: Horizontal bar
  X-axis: revenue
  Y-axis: category
  Colors: Custom palette

Data Sources

Canvas supports multiple data sources for elements.

Elasticsearch SQL

The most common data source:

-- Simple count
SELECT COUNT(*) AS total_orders
FROM "kibana_sample_data_ecommerce"

-- Aggregation with grouping
SELECT manufacturer.keyword AS brand,
       COUNT(*) AS order_count,
       SUM(taxful_total_price) AS revenue,
       AVG(taxful_total_price) AS avg_order
FROM "kibana_sample_data_ecommerce"
GROUP BY manufacturer.keyword
ORDER BY revenue DESC
LIMIT 10

-- Time-based query
SELECT HISTOGRAM(order_date, INTERVAL 1 DAY) AS day,
       COUNT(*) AS orders,
       SUM(taxful_total_price) AS revenue
FROM "kibana_sample_data_ecommerce"
GROUP BY day
ORDER BY day

-- Filtered query
SELECT COUNT(*) AS error_count
FROM "filebeat-*"
WHERE level = 'error'
  AND @timestamp > NOW() - INTERVAL 1 HOUR

Timelion

Time-series expression language:

.es(index=kibana_sample_data_ecommerce,
    timefield=order_date,
    metric=sum:taxful_total_price)
  .title("Revenue Over Time")
  .label("Revenue")
  .color(#00ff88)

Static Data (Demo Data)

For prototyping or static labels:

{
  "type": "datatable",
  "columns": [
    { "name": "metric", "type": "string" },
    { "name": "value", "type": "number" }
  ],
  "rows": [
    { "metric": "Revenue", "value": 125430 },
    { "metric": "Orders", "value": 4675 },
    { "metric": "Customers", "value": 2341 }
  ]
}

Expressions

Canvas uses an expression language under the hood. Every element is defined by an expression.

Viewing an Element's Expression

1. Select an element
2. Click "Expression editor" (bottom of the page, code icon)
3. See the raw expression:

filters
| essql
  query="SELECT SUM(taxful_total_price) AS revenue FROM \"kibana_sample_data_ecommerce\""
| math "revenue"
| metric "Total Revenue"
  metricFont={font size=48 family="'Open Sans', Helvetica, Arial, sans-serif"
    color="#00ff88" align="center" lHeight=60}
  labelFont={font size=18 family="'Open Sans', Helvetica, Arial, sans-serif"
    color="#FFFFFF" align="center"}
| render

Expression Building Blocks

SOURCES (data retrieval)
  essql           → Elasticsearch SQL query
  esdocs          → Raw Elasticsearch documents
  timelion        → Timelion expressions
  demodata        → Sample static data
  filters         → Current workpad filters

TRANSFORMS (data manipulation)
  math            → Mathematical operations
  mapColumn       → Transform column values
  filterrows      → Filter data rows
  sort            → Sort results
  head            → First N rows
  tail            → Last N rows
  columns         → Select/rename columns

DISPLAY (rendering)
  metric          → Big number display
  plot            → Charts (line, bar, area, etc.)
  pie             → Pie chart
  table           → Data table
  markdown        → Markdown text
  image           → Image display
  shape           → Geometric shapes
  progress        → Progress bar
  render          → Final render step

Custom Expression Examples

Metric with conditional color:

filters
| essql
  query="SELECT COUNT(*) AS errors
         FROM \"filebeat-*\"
         WHERE level = 'error'
           AND @timestamp > NOW() - INTERVAL 1 HOUR"
| math "errors"
| if {math "errors" | gt 100}
  then={metric "Critical Errors"
    metricFont={font size=60 color="#ff4444"}}
  else={metric "Errors"
    metricFont={font size=60 color="#00ff88"}}
| render

Formatted number:

filters
| essql query="SELECT SUM(taxful_total_price) AS revenue
               FROM \"kibana_sample_data_ecommerce\""
| math "revenue"
| formatnumber "$ 0,0.00"
| markdown "## Revenue\n**{{}}"
  font={font size=36 color="#ffffff" align="center"}
| render

Styling Elements

Positioning

Click an element and use the position controls:

Position:
  X: 100    (pixels from left)
  Y: 50     (pixels from top)

Size:
  Width: 400
  Height: 200

Rotation: 0°

Layer:
  Bring forward / Send backward

Element Styling

Background:
  - Color: #1a1a2e
  - Opacity: 80%
  - Border: 1px solid #333
  - Border radius: 8px

Shadow:
  - X offset: 2px
  - Y offset: 4px
  - Blur: 8px
  - Color: rgba(0,0,0,0.5)

Padding:
  - Top/Bottom/Left/Right: 16px

Typography

Font:
  - Family: 'Inter', 'Open Sans', 'Helvetica'
  - Size: 14px - 72px
  - Weight: Normal / Bold
  - Color: #ffffff
  - Alignment: Left / Center / Right
  - Line height: 1.4

CSS Support

Canvas elements support custom CSS for advanced styling:

/* Apply to element via custom CSS option */
.canvasElement {
  background: linear-gradient(135deg, #1a1a2e 0%, #16213e 100%);
  border: 1px solid rgba(255, 255, 255, 0.1);
  border-radius: 12px;
  box-shadow: 0 4px 20px rgba(0, 0, 0, 0.3);
  transition: transform 0.2s ease;
}

.canvasElement:hover {
  transform: scale(1.02);
}

Multi-Page Workpads

Adding Pages

1. Click "+ Add page" at the bottom
2. Each page is like a slide in a presentation
3. Pages can have different backgrounds and layouts

Page Navigation

In edit mode: Click page thumbnails at the bottom
In fullscreen: Arrow keys or auto-advance

Auto-advance settings:
  Interval: 10 seconds per page
  Transition: Fade / Slide

Organizing Pages

Typical multi-page workpad:

Page 1: Executive Summary
  - Key KPIs (revenue, orders, customers)
  - Overall trend line
  - Company logo

Page 2: Sales Detail
  - Revenue by category
  - Top products
  - Geographic breakdown

Page 3: Operations
  - System health
  - Error rates
  - Response times

Page 4: Customer Insights
  - New vs returning
  - Cohort analysis
  - Customer satisfaction

Fullscreen and Kiosk Mode

Entering Fullscreen

1. Click the "Fullscreen" button (▶) in the toolbar
2. Workpad fills the entire screen
3. All toolbars and navigation are hidden
4. Data continues to refresh based on auto-refresh settings

Kiosk Mode via URL

Access Canvas directly in kiosk mode for TV displays:

# Standard Canvas URL
https://kibana.example.com/app/canvas#/workpad/abc123/page/1

# Kiosk mode (no Kibana chrome)
https://kibana.example.com/app/canvas#/workpad/abc123/page/1?__fullScreen=true

Setting Up a Wall Display

1. Create workpad sized to your display (e.g., 1920 × 1080)
2. Configure auto-refresh (30 seconds)
3. Set up multi-page auto-advance (10 seconds per page)
4. Open in browser fullscreen mode (F11)
5. Set browser to auto-start on boot

Linux auto-start:
  chromium --kiosk "https://kibana:5601/app/canvas#/workpad/abc123?__fullScreen=true"

Workpad Templates

Creating a Template

Build a workpad and export it for reuse:

1. Build your workpad with layout and styling
2. Use placeholder data sources
3. Export: Click "..." → "Share" → "Download as JSON"
4. Save the JSON file as your template

Importing a Template

1. Go to Canvas → "Create workpad"
2. Click "Import workpad"
3. Select your JSON template
4. Modify data sources to point to your indices

Template Structure

{
  "id": "workpad-template-001",
  "name": "Operations Dashboard Template",
  "width": 1920,
  "height": 1080,
  "pages": [
    {
      "id": "page-1",
      "style": {
        "background": "#1a1a2e"
      },
      "elements": [
        {
          "id": "element-1",
          "type": "metric",
          "expression": "filters | essql query=\"...\" | math ...",
          "position": { "left": 50, "top": 30, "width": 400, "height": 200 }
        }
      ]
    }
  ]
}

Practical Examples

Example 1: NOC Wall Display

Network Operations Center display for monitoring:

Page layout (1920 × 1080):

┌────────────────────────────────────────────────────────┐
│  [Logo]   Network Operations Center     [Clock/Date]    │
├────────┬────────┬────────┬────────┬────────────────────┤
│ Active │ Error  │  Avg   │ Uptime │                    │
│ Users  │ Rate   │ Resp.  │        │   Traffic          │
│ 1,234  │ 0.3%   │ 145ms  │ 99.98% │   Over Time       │
│        │        │        │        │   (area chart)     │
├────────┴────────┴────────┤        │                    │
│                          │        │                    │
│  Top Error Endpoints     ├────────┴────────────────────┤
│  /api/checkout  45       │                             │
│  /api/search    23       │   Server Health Map         │
│  /api/payment   12       │   (table with colors)       │
│                          │                             │
└──────────────────────────┴─────────────────────────────┘

Data sources:
- Metric elements: essql queries with 30s refresh
- Area chart: Timelion for time series
- Error table: essql with ORDER BY count DESC

Key metric expression:

filters
| essql query="SELECT COUNT(DISTINCT clientip) AS active
               FROM \"filebeat-*\"
               WHERE @timestamp > NOW() - INTERVAL 5 MINUTE"
| math "active"
| metric "Active Users"
  metricFont={font size=60 color="#00ff88" align="center"}
  labelFont={font size=16 color="#888888" align="center"}
| render

Example 2: Executive Revenue Report

Multi-page branded report:

Page 1: Cover Page
  - Company logo (image element)
  - Report title (markdown)
  - Date range (time filter value)
  - Generated timestamp

Page 2: Revenue Overview
  - Total Revenue metric
  - Revenue trend (area chart)
  - Revenue by region (horizontal bar)
  - vs. Previous period comparison

Page 3: Product Performance
  - Top 10 products table
  - Category breakdown (pie chart)
  - Product revenue trend per category

Page 4: Customer Insights
  - Unique customers metric
  - Revenue per customer metric
  - Geographic distribution (if map data available)

Example 3: Real-Time Sales Counter

Minimal display for retail environments:

Layout (1080 × 1920, vertical):

┌────────────────────┐
│                    │
│    TODAY'S SALES   │
│                    │
│    $47,832.00      │
│    ↑ 12% vs yday   │
│                    │
│    ────────────    │
│                    │
│    ORDERS: 423     │
│                    │
│    ────────────    │
│                    │
│    [Progress bar]  │
│    84% of target   │
│                    │
│    ────────────    │
│                    │
│    TOP PRODUCT:    │
│    Premium Shirt   │
│    ($2,340)        │
│                    │
└────────────────────┘

Auto-refresh: 10 seconds

Tips and Best Practices

Design Tips

✅ Design for the target screen size and resolution
✅ Use high-contrast colors for readability at distance
✅ Keep fonts large (48px+ for metrics, 24px+ for labels)
✅ Use consistent color coding (green=good, red=bad)
✅ Limit to 6-8 data elements per page

❌ Don't overcrowd pages (whitespace is good)
❌ Don't use small text on wall displays
❌ Don't use light colors on light backgrounds
❌ Don't show unnecessary decoration

Performance Tips

✅ Use essql with specific queries (no SELECT *)
✅ Limit result sets (LIMIT 10)
✅ Use appropriate refresh intervals (not too frequent)
✅ Optimize Elasticsearch queries for speed

❌ Don't query all indices when one suffices
❌ Don't refresh every second (5-10s minimum)
❌ Don't use complex aggregations without caching

Maintainability

✅ Use descriptive element names
✅ Group related elements on the same page
✅ Document data sources in a markdown element
✅ Export backups of important workpads regularly
✅ Use templates for consistent branding

❌ Don't hardcode dates in queries (use NOW() and intervals)
❌ Don't rely on Canvas for complex analysis (use dashboards)

Common Issues

"No data" on elements

Causes:

1. SQL query error → Check expression editor for errors
2. Wrong index name → Verify index exists
3. Time range → Ensure data falls within query timeframe

Fix: Open expression editor, test the query step by step.

Elements overlap incorrectly

Fix: Use layer ordering:

• Right-click element → "Send to back" / "Bring to front"
• Or use the layer controls in the position panel

Workpad doesn't auto-refresh

Fix:

1. Check auto-refresh is enabled (Settings icon)
2. Ensure the filters function is at the start of expressions
3. Verify Kibana can reach Elasticsearch

Summary

In this chapter, you learned:

• ✅ How Canvas differs from dashboards (presentation vs exploration)
• ✅ Creating workpads with custom dimensions and backgrounds
• ✅ Adding and configuring elements (metrics, charts, markdown)
• ✅ Using Elasticsearch SQL and expressions for data
• ✅ Styling elements with positioning, colors, and CSS
• ✅ Building multi-page workpads with auto-advance
• ✅ Setting up fullscreen and kiosk mode for displays
• ✅ Practical examples for NOC displays, reports, and retail

Next: Setting up alerts and rules to be notified when conditions change!