Creating Visualizations

The Visualize screen allows you to create a variety of charts and graphs fueled by your CHAOSSEARCH indices.

Create a visualization

To get started creating visualizations click Create a visualization.

Select visualization type

Kibana offers a multitude of charts and graphs to select from. Hover over any of the visualization types for more information. For the purposes of this document, click Pie.

Define the search source

The data for the visualization will either come from a new search or an existing search.
For a new search, select the index view that contains the data you wish to visualize. For an existing search, select the saved search you wish to use.

Configure the visualization builder

The visualization builder will contain different terms and features depending on the visualization type selected. The examples on this page reflect a pie chart.

For both new searches and existing searches, the visualization builder is displayed.

  1. Click Slice Size to expand the Metrics section.
  2. Select a slice size Aggregation. The sizes of the pie slices are determined by Count, Sum, Top Hit, or Unique Count. Enter a Custom Label to rename the displayed label.
  3. In the Buckets section, select whether or not you are splitting slices within a single pie chart or if you are splitting into multiple charts.
  4. Select a bucket Aggregation. Select from Date Histogram, Date Range, Filters, Histogram, IPv4 Range, Range, Significant Terms, or Terms.

Other options

After selecting the bucket aggregation, the options displayed are dependent on the selected aggregation type.

For this example, let's select Count as our slice size aggregation and Terms as our bucket aggregation. This allows us to visualize terms displayed by frequency.

For the remainder of the options displayed, select a value for Field and leave the remainder as their default value.

Click the Apply Changes button to create your first visualization.

"No results displayed because all values equal 0."

In the case where a visualization is not displayed, check to make sure your time filter is property configured. By default the time range is set to the last 15 minutes.

See setting the time filter for more information.

Additional actions

View detailed information

Hover over any of the pie slices to see detailed information including field value, term count, as well as overall percentage. In this example we can see that there are 118 instances of S3, making up 17.1% of total occurrences.

Change chart colors

Click any of the terms shown in the legend and select any color from the color picker.

Apply filters

There are two ways to add filters to your visualization.

From the legend

Click any of the terms shown in the legend. Select to filter by that term or select to exclude that term.

From the Add Filter screen

Click Add a filter to add filters to the visualization. Enter the filter criteria and click Save.

Filter actions

Once a filter is defined, it is displayed beneath the search bar.

Hover over the filter for the following available options:

  1. Enable - Click to toggle between enabled and disabled. A quick way to see the visualization with the filter removed without deleting the filter completely.
  2. Pin - Click to "pin" the filter. Pinning a filter will keep the filter across various screens (Visualize, Discover, etc.)
  3. Invert - Click to switch between a positive and negative filter. In our example, we are displaying all instances of "S3". Clicking this will display any instance NOT matching "S3"
  4. Delete - Click to remove the filter.
  5. Edit - Click to display the Edit Filter modal window.

Save a visualization

To save a visualization:

  1. Click Save
  2. Enter a name for the visualization
  3. Click Save

More information

Check out the Kibana documentation for more information about configuring a variety of visualization types through the Visualize screen.


What's Next

Navigate to the Dashboard screen

Building a dashboard

Creating Visualizations


The Visualize screen allows you to create a variety of charts and graphs fueled by your CHAOSSEARCH indices.

Suggested Edits are limited on API Reference Pages

You can only suggest edits to Markdown body content, but not to the API spec.