Kibana Lens: When Drag-and-Drop Beats Writing Queries by Hand

You need a quick chart of error rates by service over the last 24 hours. You could open the classic Visualize editor, pick a chart type, configure buckets and metrics, and fight the aggregation panel for ten minutes. Or you could drag three fields onto a canvas and be done. That second option is Lens, and for a large share of everyday visualization work in Kibana 8.x, it is the right default.

What Lens actually is

Lens is Kibana's drag-and-drop visualization builder, introduced in Kibana 7.10 and now the default charting experience in 8.x. Instead of asking you to think in Elasticsearch aggregation terms (terms, date histograms, filters), Lens lets you drag fields from a data view onto a canvas and suggests chart types that fit the data. Under the hood it still builds the same search requests the classic editor would — Lens just removes the translation step between "I want average latency per host" and the aggregation configuration that produces it.

The key mental model: Lens is a visual layer over Kibana's normal search pipeline. Every chart you build maps to concrete aggregations — count, average, sum, terms, date histogram — and the generated query is visible in the query bar, where you can still layer on KQL or Lucene filters.

A worked example: error rate by service

Assume you have logs in a data view called logs-* with fields service.name, log.level, and @timestamp. To build the chart:

1. In Kibana, go to Analytics > Visualize Library (or open a dashboard and click Create visualization) and choose Lens.
2. Select the logs-* data view in the top-left data view picker.
3. Drag @timestamp onto the canvas. Lens creates a date histogram on the horizontal axis with a count of records on the vertical axis.
4. Drag service.name onto the "breakdown" area to split the bars or lines per service.
5. In the query bar at the top, add a KQL filter: log.level : "error". The chart now shows error counts per service over time.
6. Click Save and add the panel to a dashboard.

No special permissions beyond standard Kibana read/write access to the data view and dashboard are needed. To verify the result, open the panel's Inspect panel (available from the panel menu on a dashboard) and check the request: you should see a date histogram aggregation with a terms sub-aggregation on service.name, filtered by your KQL clause. If the rendered chart matches what you configured in Lens, the pipeline is working end to end.

Where Lens falls short

Lens deliberately covers the common 80% of visualization needs, and it is honest about the other 20%:

• Scripted fields and custom metrics. If your visualization depends on a scripted field or a complex pipeline aggregation, Lens won't offer it. Fall back to the classic Visualize editor or TSVB for those cases.
• Exotic chart types. Lens covers bar, line, area, pie, table, metric, and a few others. Highly customized Vega visualizations still require the Vega editor.
• Version dependency. Lens requires Kibana 7.10 or newer. On older deployments the Lens tab simply does not exist, so confirm your version before writing runbooks that reference it.

The trade-off is intentional: by constraining the option space, Lens makes the common cases fast and keeps the generated queries readable. When you hit its ceiling, the escape hatches (classic Visualize, TSVB, Vega) are still there — you just lose the drag-and-drop speed.

A practical default

If you are on Kibana 8.x, make Lens your first stop for ad hoc charts and dashboard panels. It is faster to build, easier for teammates to read and modify, and the generated queries are transparent enough to audit. Reserve the classic editors for the cases Lens explicitly cannot express. A quick way to sanity-check any Lens panel before shipping it to a shared dashboard: open Inspect, confirm the request matches your intent, and compare the rendered chart against a known time window where you already know the expected shape of the data.