Discover, Visualize & Dashboards

Data Views & Discover

Kibana stores no data itself — it queries Elasticsearch. A data view (formerly "index pattern") tells Kibana which index/indices to query, e.g. logs-* matching multiple daily rolling indices. Discover is the raw document browser — the usual first stop when investigating logs, before building a formal visualization.

KQL Query Syntax

status: "error" and service: "api"
response_time > 500
message: *timeout*
not status: "ok"

# KQL covers most everyday filtering; Lucene syntax (toggle available in
# the search bar) exposes a few lower-level Elasticsearch query features
# (certain proximity/boosting behaviors) KQL doesn't express.

Dev Tools Console

GET logs-*/_search
{
  "query": {
    "bool": {
      "filter": [
        { "term": { "status": "error" } },
        { "range": { "@timestamp": { "gte": "now-1h" } } }
      ]
    }
  }
}

# Sends raw Elasticsearch API requests directly from the browser with
# autocomplete — faster than switching to curl/Postman for a quick check.

Lens & Dashboards

Lens is the recommended drag-and-drop visualization builder for most charts today. A dashboard collects saved visualizations onto one screen with a shared time range and filters — the standard way to give a team an at-a-glance view of key metrics.