Visualization types in Elasticsearch - Step-by-Step Execution

Concept Flow - Visualization types

Data Indexed in Elasticsearch

↓

Choose Visualization Type

↓

Bar Chart

↓

Data Aggregation & Buckets

↓

Render Visualization

↓

User Interaction & Update

Data flows from Elasticsearch index to choosing a visualization type, then data is aggregated and rendered visually, allowing user interaction.

Execution Sample

Elasticsearch

GET /sales/_search
{
  "aggs": {
    "sales_over_time": {
      "date_histogram": {"field": "date", "calendar_interval": "month"}
    }
  }
}

This query aggregates sales data by month to prepare for a line chart visualization.

Execution Table

Step	Action	Aggregation Type	Data Processed	Result
1	Receive query	date_histogram	All sales documents	Ready to aggregate by month
2	Aggregate data	date_histogram	Sales documents grouped by month	Buckets with monthly sales counts
3	Prepare visualization	line chart	Buckets data	Points for line chart
4	Render chart	line chart	Points data	Line chart displayed
5	User interaction	filter or zoom	Chart data	Chart updates dynamically
6	Exit	-	-	Visualization complete and interactive

💡 User finishes interaction or closes visualization

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	Final
sales_documents	All sales data	Grouped by month	Aggregated buckets	Chart points	Displayed chart
visualization_state	None	None	Prepared	Rendered	Interactive

Key Moments - 2 Insights

Why do we need to aggregate data before visualization?

Because raw data is too detailed; aggregation groups data into buckets (see execution_table step 2) so the visualization can show meaningful summaries.

What happens if the aggregation type doesn't match the visualization?

The visualization won't display correctly because it expects data in a certain format (e.g., line chart needs time buckets). This is shown in execution_table step 3 where data is prepared for the chosen chart.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result after step 2?

A All sales documents

B Line chart displayed

C Buckets with monthly sales counts

D User interaction

💡 Hint

Check the 'Result' column in execution_table row for step 2

At which step does the visualization become interactive?

A Step 5

B Step 3

C Step 4

D Step 6

💡 Hint

Look for 'User interaction' in the 'Action' column in execution_table

If we change the aggregation from date_histogram to terms, how would the data processed change at step 2?

A Data grouped by months as before

B Data grouped by unique terms instead of months

C No aggregation happens

D Visualization renders immediately

💡 Hint

Aggregation type affects how data is grouped, see 'Aggregation Type' column in execution_table step 2

Concept Snapshot

Visualization types in Elasticsearch:
- Choose type (bar, pie, line)
- Use aggregations to group data
- date_histogram for time series
- terms for categories
- Render and interact dynamically

Full Transcript

This visualization types concept shows how data indexed in Elasticsearch is processed step-by-step to create visual charts. First, a query with aggregation is sent. The aggregation groups data into buckets, like months for a date_histogram. Then, the visualization type is chosen, such as a line chart, which uses the aggregated data points. The chart is rendered and becomes interactive for the user to filter or zoom. Variables like sales_documents and visualization_state change through these steps. Key moments include understanding why aggregation is needed and matching aggregation to visualization type. The quiz tests understanding of the execution steps and data changes.

Practice

1. Which visualization type is best to show how parts make up a whole in Elasticsearch dashboards?

easy

A. Bar chart

B. Line chart

C. Pie chart

D. Data table

Solution

1. Step 1: Understand visualization purpose

   Pie charts are designed to show parts of a whole by dividing a circle into slices.

2. Step 2: Match visualization to data type

   Since the question asks for parts of a whole, pie chart fits best over line or bar charts which show trends or comparisons.

3. Final Answer:

   Pie chart -> Option C

4. Quick Check:

   Parts of whole = Pie chart [OK]

Hint: Parts of whole? Think pie chart slices [OK]

Common Mistakes:

• Choosing bar chart for parts of whole
• Confusing line chart with pie chart
• Using data table instead of visual chart

2. Which of the following is the correct Elasticsearch aggregation type to use for a bar chart showing counts per category?

easy

A. terms aggregation

B. date_histogram aggregation

C. avg aggregation

D. max aggregation

Solution

1. Step 1: Identify aggregation for categories

   Terms aggregation groups data by unique values, perfect for categories.

2. Step 2: Match aggregation to bar chart data

   Bar charts often show counts per category, so terms aggregation is correct.

3. Final Answer:

   terms aggregation -> Option A

4. Quick Check:

   Category counts = terms aggregation [OK]

Hint: Use terms aggregation for category counts [OK]

Common Mistakes:

• Using avg or max aggregation for counts
• Choosing date_histogram for non-date data
• Confusing aggregation types

3. Given this Elasticsearch aggregation result for a line chart showing sales over time:

{"buckets": [{"key_as_string": "2024-01-01", "doc_count": 10}, {"key_as_string": "2024-01-02", "doc_count": 15}]}

What will the line chart display?

medium

A. A line rising from 10 to 15 between Jan 1 and Jan 2

B. A flat line at 10 for both days

C. A line dropping from 15 to 10 between Jan 1 and Jan 2

D. No line because data format is incorrect

Solution

1. Step 1: Read aggregation buckets

   The buckets show counts 10 on Jan 1 and 15 on Jan 2.

2. Step 2: Interpret line chart trend

   The line chart plots these points over time, so it rises from 10 to 15.

3. Final Answer:

   A line rising from 10 to 15 between Jan 1 and Jan 2 -> Option A

4. Quick Check:

   Counts increase over time = rising line [OK]

Hint: Line chart shows trend from low to high values [OK]

Common Mistakes:

• Assuming flat line despite different counts
• Thinking data format is invalid
• Reversing the trend direction

4. You created a pie chart in Kibana but it shows only one slice with 100% instead of multiple categories. What is the most likely cause?

medium

A. The date range filter is too wide

B. The aggregation used is a single metric, not a terms aggregation

C. The pie chart visualization is not supported in Kibana

D. The data has no documents

Solution

1. Step 1: Understand pie chart data needs

   Pie charts require terms aggregation to split data into categories.

2. Step 2: Identify cause of single slice

   If a single metric aggregation is used, it returns one value, so pie chart shows one slice.

3. Final Answer:

   The aggregation used is a single metric, not a terms aggregation -> Option B

4. Quick Check:

   Single slice = single metric aggregation [OK]

Hint: Use terms aggregation for multiple pie slices [OK]

Common Mistakes:

• Blaming Kibana for unsupported visualization
• Assuming no data causes single slice
• Thinking date range affects slice count

5. You want to create a dashboard showing monthly sales trends and category sales distribution side by side. Which combination of visualization types and aggregations should you use?

hard

A. Bar chart with avg aggregation for trends, data table with max aggregation for categories

B. Data table with sum aggregation for trends, bar chart with avg aggregation for categories

C. Pie chart with date_histogram aggregation for trends, line chart with terms aggregation for categories

D. Line chart with date_histogram aggregation for trends, pie chart with terms aggregation for categories

Solution

1. Step 1: Choose visualization for monthly trends

   Line chart is best for showing trends over time; date_histogram groups data by month.

2. Step 2: Choose visualization for category distribution

   Pie chart shows parts of whole; terms aggregation groups by category.

3. Final Answer:

   Line chart with date_histogram aggregation for trends, pie chart with terms aggregation for categories -> Option D

4. Quick Check:

   Trends = line + date_histogram; categories = pie + terms [OK]

Hint: Trends = line + date_histogram; parts = pie + terms [OK]

Common Mistakes:

• Mixing pie chart with date_histogram aggregation
• Using avg or max aggregation for category grouping
• Choosing data table instead of visual charts