Book Image

Kibana 8.x – A Quick Start Guide to Data Analysis

By : Krishna Shah
Book Image

Kibana 8.x – A Quick Start Guide to Data Analysis

By: Krishna Shah

Overview of this book

Unleash the full potential of Kibana—an indispensable tool for data analysts to seamlessly explore vast datasets, uncover key insights, identify trends and anomalies, and share results. This book guides you through its user-friendly interface, interactive visualizations, and robust features, including real-time data monitoring and advanced analytics, showing you how Kibana revolutionizes your approach to navigating and analyzing complex datasets. Starting with the foundational steps of installing, configuring, and running Kibana, this book progresses systematically to explain the search and data visualization capabilities for data stored in the Elasticsearch cluster. You’ll then delve into the practical details of creating data views and optimizing spaces to better organize the analysis environment. As you advance, you'll get to grips with using the discover interface and learn how to build different types of extensive visualizations using Lens. By the end of this book, you’ll have a complete understanding of how Kibana works, helping you leverage its capabilities to build an analytics and visualization solution from scratch for your data-driven use case.
Table of Contents (17 chapters)
Free Chapter
Part 1: Exploring Kibana
Part 2: Visualizations in Kibana
Part 3: Analytics on a Dashboard
Part 4: Querying on Kibana and Advanced Concepts

Understanding how ES|QL works

The query language works fundamentally through a source command, and it can be followed by (optional) commands called processing commands. They are separated by a pipe (|); hence, ES|QL is also referred to as Elastic’s piped query language. The source command results into a table formation from the data in Elasticsearch, as shown in the following figure:

Figure 9.1 – The source command concept in Elasticsearch

Figure 9.1 – The source command concept in Elasticsearch

Three different source commands that are supported, which are FROM, ROW, and SHOW.

Here’s a simple example of how ES|QL works. Imagine you have an index named products that contains product data, and you want to find all products with a price above $50.

With ES|QL, you could write the following query:

FROM products WHERE price > 50;

This query looks just like a standard SQL query, but ES|QL translates it into Elasticsearch’s query language, retrieving the desired results. Refer...