Dashboard creation in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a dashboard in Elasticsearch Kibana?

A dashboard in Kibana is a collection of visualizations and saved searches displayed together to provide an overview of data in one place.

beginner

How do you add a visualization to a Kibana dashboard?

You click the 'Add' button on the dashboard, then select the saved visualization you want to include.

beginner

What is the purpose of filters in a Kibana dashboard?

Filters let you narrow down the data shown in all visualizations on the dashboard to focus on specific information.

beginner

Why should you use time range controls in a Kibana dashboard?

Time range controls let you select the period for which data is shown, helping you analyze trends over specific times.

beginner

What is the benefit of saving a dashboard in Kibana?

Saving a dashboard lets you keep your layout and filters so you can easily return to the same view later or share it with others.

What is the first step to create a dashboard in Kibana?

A Write an Elasticsearch query

B Export data to CSV

C Install Kibana plugins

D Open the Dashboard app and click 'Create new dashboard'

You start by opening the Dashboard app in Kibana and clicking 'Create new dashboard' to begin adding visualizations.

How can you update the data shown in all visualizations on a dashboard?

A Restart Elasticsearch

B Change the time range filter

C Edit each visualization separately

D Export the dashboard

Changing the time range filter updates the data shown across all visualizations on the dashboard.

Which of these is NOT a visualization type you can add to a Kibana dashboard?

A Bar chart

B Pie chart

C Word document

D Scatter plot

Word documents are not visualization types in Kibana dashboards.

What happens when you apply a filter on a Kibana dashboard?

A It changes the data shown in all visualizations to match the filter

B It deletes the filtered data from Elasticsearch

C It exports filtered data to Excel

D It changes the dashboard layout

Applying a filter narrows the data shown in all dashboard visualizations to the filtered subset.

Why is it useful to share a saved dashboard?

A So others can see the same data view and insights

B To delete the dashboard from your account

C To export data to a database

D To change Elasticsearch settings

Sharing a saved dashboard allows others to view the same visualizations and filters for consistent insights.

Describe the steps to create and save a dashboard in Kibana.

Think about how you gather and arrange visualizations before saving.

Explain how filters and time range controls improve dashboard usefulness.

Consider how you focus on specific data in real life, like filtering emails or setting a calendar date.

Practice

1. What is the main purpose of a dashboard in Elasticsearch's Kibana?

easy

A. To display multiple visualizations together for easy data analysis

B. To write complex Elasticsearch queries

C. To store raw data from Elasticsearch indexes

D. To manage user permissions for Elasticsearch

Solution

1. Step 1: Understand dashboard function

   A dashboard groups visualizations so users can see data insights in one place.

2. Step 2: Compare options

   Options A, B, and C describe other tasks not related to dashboard display.

3. Final Answer:

   To display multiple visualizations together for easy data analysis -> Option A

4. Quick Check:

   Dashboard = multiple visualizations [OK]

Hint: Dashboards show many visuals together for quick insights [OK]

Common Mistakes:

• Confusing dashboards with query writing
• Thinking dashboards store raw data
• Mixing dashboards with user management

2. Which syntax correctly adds a saved visualization to a Kibana dashboard?

easy

A. dashboard.addVisualization('vis_id')

B. dashboard.add('vis_id')

C. Dashboard.addVisualization('vis_id')

D. Dashboard.add('vis_id')

Solution

1. Step 1: Recall Kibana dashboard API

   The correct method to add a visualization is Dashboard.add('vis_id') with capital D.

2. Step 2: Check case sensitivity and method name

   dashboard.add('vis_id') uses lowercase dashboard object; options C and D use incorrect method name 'addVisualization'.

3. Final Answer:

   <code>Dashboard.add('vis_id')</code> -> Option D

4. Quick Check:

   Correct method is Dashboard.add() [OK]

Hint: Dashboard object is capitalized; method is add() [OK]

Common Mistakes:

• Using lowercase 'dashboard' instead of 'Dashboard'
• Using wrong method name like addVisualization
• Confusing method parameters

3. Given this Elasticsearch query used in a visualization:

{"query": {"match": {"status": "error"}}}

What will the visualization show when added to a dashboard?

medium

A. All documents with status 'error' count or details

B. All documents regardless of status

C. Documents with status 'success' only

D. An error message due to invalid query

Solution

1. Step 1: Analyze the query filter

   The query matches documents where the field 'status' equals 'error'.

2. Step 2: Understand visualization output

   The visualization will display data filtered to only those documents with status 'error'.

3. Final Answer:

   All documents with status 'error' count or details -> Option A

4. Quick Check:

   Query filters status='error' so visualization shows those docs [OK]

Hint: Match query filters data shown in visualization [OK]

Common Mistakes:

• Assuming it shows all documents
• Confusing 'error' with 'success'
• Thinking query syntax is invalid

4. You tried to add a visualization to a Kibana dashboard but it does not appear. Which is the most likely cause?

medium

A. The dashboard is already full and cannot add more visualizations

B. The Elasticsearch cluster is offline

C. The visualization ID used in the add command is incorrect

D. The visualization was created in a different tool

Solution

1. Step 1: Check visualization ID correctness

   If the ID is wrong, the dashboard cannot find and add the visualization.

2. Step 2: Evaluate other options

   Cluster offline would cause broader failures; dashboards do not have fixed limits; visualizations must be from Kibana.

3. Final Answer:

   The visualization ID used in the add command is incorrect -> Option C

4. Quick Check:

   Wrong ID means visualization won't load [OK]

Hint: Verify visualization ID matches exactly [OK]

Common Mistakes:

• Assuming dashboard has max visualization limit
• Ignoring ID typos
• Blaming Elasticsearch cluster without checking

5. You want to create a dashboard that shows error counts by hour and success counts by hour side by side. Which approach is best?

hard

A. Create a dashboard with only one visualization and switch filters manually

B. Create two visualizations with filters for 'error' and 'success', then add both to the dashboard

C. Create one visualization with a combined filter for 'error' and 'success' together

D. Create visualizations in different dashboards and link them

Solution

1. Step 1: Understand requirement for side-by-side comparison

   Two separate visualizations filtered by 'error' and 'success' allow clear side-by-side display.

2. Step 2: Evaluate other options

   Create one visualization with a combined filter for 'error' and 'success' together mixes filters, losing clarity; A requires manual switching; D separates data, not side-by-side.

3. Final Answer:

   Create two visualizations with filters for 'error' and 'success', then add both to the dashboard -> Option B

4. Quick Check:

   Separate filtered visuals show side-by-side data clearly [OK]

Hint: Use separate filtered visuals for clear side-by-side comparison [OK]

Common Mistakes:

• Combining filters in one visualization losing clarity
• Using one visualization and switching filters manually
• Splitting visuals across dashboards