Lens for drag-and-drop analysis in Elasticsearch - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is Lens in Elasticsearch Kibana?

Lens is a drag-and-drop interface in Kibana that helps users create visualizations easily by selecting fields and metrics without writing queries.

beginner

How do you add a field to a Lens visualization?

You drag a field from the available fields list and drop it onto the workspace area to create a visualization based on that field.

intermediate

What types of visualizations can Lens create using drag-and-drop?

Lens can create bar charts, line charts, pie charts, tables, and more by dragging fields and metrics into the visualization workspace.

intermediate

How does Lens handle aggregation when you drag a numeric field?

Lens automatically applies default aggregations like sum or average to numeric fields when dragged, but you can customize the aggregation type.

beginner

Can Lens visualizations be saved and reused?

Yes, Lens visualizations can be saved as part of Kibana dashboards and reused or shared with others.

What is the main purpose of Lens in Kibana?

A To create visualizations using drag-and-drop without coding

B To write complex Elasticsearch queries

C To manage Elasticsearch clusters

D To monitor server health

Lens is designed to let users create visualizations easily by dragging and dropping fields, without needing to write queries.

Which of these visualization types can Lens create?

A 3D models

B Video streams

C Bar charts

D Text editors

Lens supports common chart types like bar charts, line charts, pie charts, and tables.

When you drag a numeric field into Lens, what happens by default?

A Lens converts it to text

B Lens ignores the field

C Lens deletes the field

D Lens applies a default aggregation like sum or average

Lens automatically applies aggregations such as sum or average to numeric fields.

Can Lens visualizations be saved and shared in Kibana?

A Yes, they can be saved and reused

B No, they are temporary only

C Only if exported as images

D Only by exporting raw data

Lens visualizations can be saved as part of dashboards and shared with others.

What is required to create a Lens visualization?

A Writing SQL queries

B Dragging fields into the workspace

C Installing plugins manually

D Configuring Elasticsearch nodes

Lens uses drag-and-drop of fields to build visualizations without needing query writing.

Explain how Lens simplifies creating visualizations in Kibana.

Think about how Lens helps users who don't want to write queries.

Describe the steps to create a bar chart using Lens with a numeric field.

Focus on dragging fields and how Lens handles numbers.

Practice

1.

What is the main purpose of Lens in Elasticsearch?

easy

A. To write complex Elasticsearch queries manually

B. To manage Elasticsearch cluster settings

C. To analyze data visually by dragging and dropping fields

D. To monitor server hardware performance

Solution

1. Step 1: Understand Lens functionality

   Lens provides a visual interface to analyze data without coding.

2. Step 2: Compare options with Lens features

   Only To analyze data visually by dragging and dropping fields describes visual drag-and-drop analysis, matching Lens's purpose.

3. Final Answer:

   To analyze data visually by dragging and dropping fields -> Option C

4. Quick Check:

   Lens = Visual drag-and-drop analysis [OK]

Hint: Lens is for visual data analysis, not manual coding [OK]

Common Mistakes:

• Thinking Lens requires writing queries
• Confusing Lens with cluster management tools
• Assuming Lens monitors hardware

2.

Which of the following is the correct way to add a field to a Lens visualization?

Drag the field from the left panel and _______

easy

A. drop it onto the visualization workspace

B. double-click the field name in the index pattern

C. type the field name in the search bar

D. right-click and select 'Add to Lens'

Solution

1. Step 1: Recall Lens drag-and-drop method

   Lens uses drag-and-drop to add fields to the visualization workspace.

2. Step 2: Evaluate options for adding fields

   Only drop it onto the visualization workspace describes dragging and dropping onto the workspace, matching Lens usage.

3. Final Answer:

   drop it onto the visualization workspace -> Option A

4. Quick Check:

   Drag field + drop on workspace = Add field [OK]

Hint: Drag fields directly onto the workspace to add [OK]

Common Mistakes:

• Trying to add fields by typing names
• Using double-click instead of drag-and-drop
• Looking for right-click menu options

3.

Given a Lens visualization with a date histogram on the x-axis and a count metric, what will happen if you drag a status.keyword field to the 'Break down by' area?

medium

A. The chart will show only the total count without breakdown

B. The chart will split counts by each unique status value

C. The chart will display an error and not render

D. The date histogram will be removed automatically

Solution

1. Step 1: Understand 'Break down by' in Lens

   Dragging a field to 'Break down by' splits the chart by unique values of that field.

2. Step 2: Apply to status.keyword field

   The chart will show counts split by each unique status value over time.

3. Final Answer:

   The chart will split counts by each unique status value -> Option B

4. Quick Check:

   Break down by field = split chart by field values [OK]

Hint: 'Break down by' splits chart by unique field values [OK]

Common Mistakes:

• Expecting no change in chart
• Thinking the date histogram is removed
• Assuming an error occurs

4.

In Lens, you try to drag a numeric field to the 'Y-axis' but the chart does not update. What is the most likely cause?

medium

A. The field is not mapped as a numeric type in the index pattern

B. You need to refresh the browser to see changes

C. Lens only supports string fields on the Y-axis

D. The drag-and-drop feature is disabled in settings

Solution

1. Step 1: Check field type requirements for Y-axis

   Y-axis requires numeric fields to aggregate values like count or sum.

2. Step 2: Identify cause of no update

   If the field is not numeric in the index pattern, Lens cannot use it on Y-axis, so chart won't update.

3. Final Answer:

   The field is not mapped as a numeric type in the index pattern -> Option A

4. Quick Check:

   Y-axis needs numeric field type [OK]

Hint: Y-axis fields must be numeric type in index pattern [OK]

Common Mistakes:

• Assuming browser refresh fixes it
• Thinking Lens supports strings on Y-axis
• Believing drag-and-drop can be disabled

5.

You want to create a Lens visualization showing average response time per user, but only for users with more than 10 requests. How can you achieve this using Lens drag-and-drop features?

hard

A. Use Lens to write a custom query filtering users with more than 10 requests, then drag fields normally

B. Drag 'user.keyword' to 'X-axis', 'requests' to 'Y-axis' with 'Sum' aggregation, then filter 'response_time < 10'

C. Drag 'response_time' to 'Break down by', 'user.keyword' to 'Y-axis' with 'Count' aggregation, no filters needed

D. Drag 'user.keyword' to 'Break down by', 'response_time' to 'Y-axis' with 'Average' aggregation, then add a filter 'requests > 10' to the visualization

Solution

1. Step 1: Set up breakdown and metric

   Drag 'user.keyword' to 'Break down by' to split by user, and 'response_time' to 'Y-axis' with 'Average' aggregation to get average response time.

2. Step 2: Apply filter for requests count

   Add a filter 'requests > 10' to include only users with more than 10 requests.

3. Final Answer:

   Drag 'user.keyword' to 'Break down by', 'response_time' to 'Y-axis' with 'Average' aggregation, then add a filter 'requests > 10' to the visualization -> Option D

4. Quick Check:

   Breakdown + average metric + filter = correct Lens setup [OK]

Hint: Use filters plus breakdown and aggregation to refine Lens charts [OK]

Common Mistakes:

• Filtering wrong field or with wrong condition
• Mixing up X-axis and Break down by roles
• Trying to write queries instead of using filters