Kibana Lens Guide: Build Visualizations Without Writing DSL

Desired Outcome

Use Kibana Lens to create a bar chart that shows the total sales amount per region for the sales-2024 index pattern, export the underlying JSON query, and verify that the chart renders correctly across Elastic Stack 7.10, 8.0, and 8.10.

Prerequisites

• Elastic Stack installed – Kibana 7.10, 8.0, or 8.10 with an active Elasticsearch cluster.
• Index pattern – An index pattern named sales-2024 that contains at least the fields amount (numeric), region (keyword), and date (date).
• Permissions – User must have the view role for the index pattern and the ability to create visualizations.
• Optional: Dev Tools – To inspect the generated JSON in the “Code” tab.

Step‑by‑Step Procedure

1. Open Lens
   • Navigate to Visualize Library in Kibana.
   • Click + Create visualization and select Lens.
   • Choose the sales-2024 index pattern from the drop‑down.
2. Drag the metric field
   • In the Fields pane, drag amount onto the Metrics area.
   • By default, Lens uses Sum aggregation; you can click the aggregation icon to switch to Average, Max, etc.
3. Drag the dimension field
   • Drag region onto the Break down by area.
   • Lens automatically creates a Terms aggregation on the field.
4. Choose chart type
   • Click the chart type selector in the top toolbar.
   • Select Bar chart (available in all Elastic Stack versions).
5. Apply a date filter (optional but recommended for large indices)
   • Click Filters in the top toolbar.
   • Add a date range filter, e.g., "2024‑01‑01 to 2024‑12‑31".
   • This reduces the document count seen by Lens, improving performance.
6. Save the visualization
   • Click Save at the top right.
   • Enter a name like Sales by Region 2024 and optionally add a description.
7. Inspect the generated JSON
   • Click the Code tab next to Visualization and Canvas.
   • Copy the JSON; it will look similar to the following (placeholder values):

     {
       "title": "Sales by Region 2024",
       "type": "lens",
       "params": {
         "layers": [
           {
             "type": "metric",
             "field": "amount",
             "aggregation": "sum"
           }
         ],
         "breakdowns": [
           {
             "field": "region",
             "aggregation": "terms"
           }
         ],
         "chartType": "bar",
         "filters": [
           {
             "field": "date",
             "range": {
               "gte": "2024-01-01",
               "lte": "2024-12-31"
             }
           }
         ]
       }
     }

Checking the Generated DSL

In the Code tab, you can view the underlying Elasticsearch query that Lens constructs. Verify that:

• The aggs section contains a sum on amount and a terms on region.
• The query section reflects any filters you added.
• There is no scripted_metric or bucket_script unless explicitly added in the UI.

Performance Tips for Large Indices

• Always apply a date or histogram filter before dragging a metric onto Lens.
• Use the Data view filters panel to reduce the document count globally.
• Consider adding a pipeline aggregation (e.g., moving_avg) if you need smoothing over time; Lens supports this in the Code tab.
• Monitor the time taken in the bottom right of Lens; if it exceeds a few seconds, revisit the filters.

Exporting and Re‑importing Visualizations

Lens visualizations are stored as JSON objects in the Kibana index. You can export them manually or via the REST API.

1. Export via UI
   • Open the Visualize Library, click the three‑dot menu next to your visualization, and select Export.
   • Choose JSON format. The file will contain the Lens JSON.
2. Re‑import via UI
   • In Visualize Library, click Import and upload the JSON file.
   • Kibana will create a new Lens visualization with the same settings.
3. Export via REST API
   • Run the following command as a Kibana superuser (replace YOUR_VIS_ID):

     curl -X GET "http://localhost:5601/api/saved_objects/visualization/YOUR_VIS_ID" \
       -H "kbn-xsrf: true" \
       -H "Content-Type: application/json" \
       -o vis.json

   • To import, use POST /api/saved_objects/_import with the vis.json file.

Comparing Chart Types Across Elastic Stack Versions

While Lens supports core chart types across all versions, newer features appear in later releases:

Version	Available Lens Chart Types
7.x	Bar, Line, Pie, Area, Table
8.0+	Map, Scatter, Advanced Table, plus responsive layout improvements
8.10+	All 8.0 features plus better multi‑layer support and performance optimizations

When upgrading, test your Lens visualizations to ensure that newly added chart types render correctly and that any removed or deprecated aggregations are still supported.

Troubleshooting Common Issues

• Chart not rendering – Verify that the index pattern is still valid and that the fields exist. Lens will show an error icon if the field is missing.
• Performance slowdown – Check the document count in the Data view filters. Reduce the time range or add a histogram aggregation on a date field.
• Unexpected aggregation – Lens may default to avg if the field type is ambiguous. Explicitly set the aggregation in the Code tab.
• Security restrictions – If a user cannot see a field, ensure that the field is included in the index pattern and that the user’s role grants read access to that field.

Summary

Kibana Lens offers a rapid, visual path to building powerful dashboards without writing Elasticsearch DSL. By following the steps above, you can create a bar chart that aggregates sales by region, export the underlying JSON for automation or version control, and apply performance best practices for large datasets. Remember to test visualizations after upgrading Elastic Stack to take advantage of new chart types and to avoid regressions.