Replicate Kibana 3 Dashboard using Kibana 4

Question

I've been using Kibana 3 for event log review for about a year or so and it's worked out great. I can create different dashboards for different types of logs and provide end users (IT folks) with the dashboards they require.

In these dashboards I'll have a date histogram, pie charts, and lastly a table of all the documents within the query (the first 500 anyway). All of these in one page that the end users are very happy with.

I'm having trouble replicating that in our QA environment that leverages Kibana 4 Beta 3.

I can create dashboards that contain "Visualizations", this being the date histogram and the pie charts. I can even do some cool new things since it's based on aggregations.

However, I'm struggling with including a table of the documents within the dashboard. In Kibana 3 I'd add a "table" panel and select the fields I want to view. It appears this functionality has been replaced by the "Discover" page.

Is it possible to accomplish this in Kibana 4? Right now I have to switch between the Dashboard and Discover page to get what I need. Furthermore, if I click a slice of a pie chart, it creates a filter on the Dashboard page (all graphs are affected), but this doesn't translate to the Discover page so I'd have to create the filter manually. This is a bit counter intuitive and a bit of a separation from Kibana 3's usability for log review.

I'd wager I'm just missing something here. Hopefully that's the case and someone can help me see the obvious. Thanks!

Answer 1

Kibana 4 was released a few days ago ( see announcement ): among other new functionalities, you can now add a search to your dashboard, which results in something similar to the old table you had in Kibana 3.

First of all, you need to create and save a search in the Discover page. Then, if you switch to the Dashboard page, you can add a new visualization and select a saved search, besides widgets your created in the Visualize area:

You'll get a table showing search results, similar to its Kibana 3 counterpart.

The table will respond to filters you set directly on the dashboard itself. However, if you want to change the table fields or other search parameters, you'll have to go back to the saved search in the Discover tab and edit it there.

Answer 2

实际上，第一个“发现”标签应该重命名为“搜索”！

Answer 3

根据我所听到的，Kibana 4，beta 4将包含此功能。

Answer 4

Just use Kibana 3 and be happy, especially if you need to have identical dashboards for different indexes. So to do that in K3 you need to change the index pattern and save the dashboard under different name. That's it. Whereas in K4 you need do that separately for all the visualizations and then dashboards, well basically you need a script to do that. And yes there is a fork of K3 that supports Elasticsearch 2.X:

https://github.com/immunochomik/kibana3