Skip to content

Search and visualize data

Use Kibana to explore, search, analyze, and visualize data stored in Elasticsearch.

Depending on the workload, this can include:

  • OpenTelemetry logs, metrics, and traces;
  • infrastructure and application telemetry;
  • search documents;
  • knowledge-base content;
  • application and business data.

Open Kibana

Use the Kibana URL provided for your deployment.

Sign in with an account that has access to the required Elasticsearch data and Kibana space.

Find observability data

For OpenTelemetry-based observability workloads, start with the relevant Kibana observability views and integration dashboards.

Depending on the data collected, this can include:

  • Logs;
  • Infrastructure;
  • Applications and services;
  • Traces;
  • dashboards installed by Elastic integrations.

For example, OpenTelemetry-native integrations can provide ready-made dashboards for technologies such as:

  • hosts;
  • NGINX;
  • MySQL;
  • Kafka;
  • Airflow.

Use the integration-provided dashboards before building custom dashboards when they already cover the required operational view.

Explore data with Discover

Use Discover when you want to inspect individual documents or events.

  1. Open Discover.
  2. Select the appropriate data view.
  3. Choose a time range when the data is time-based.
  4. Search or filter using known fields.
  5. Add useful fields to the results table.
  6. Inspect representative documents.

For OpenTelemetry data, useful fields can include:

  • service.name;
  • environment;
  • host;
  • cloud;
  • Kubernetes resource attributes;
  • trace and span identifiers.

Create a data view

If a suitable data view does not already exist:

  1. Open Data Views.
  2. Select Create data view.
  3. Enter a descriptive name.
  4. Enter an index or data-stream pattern that matches only the required data.
  5. Select the timestamp field when applicable.
  6. Save the data view.

For OpenTelemetry-native telemetry, use the appropriate OTel data streams rather than creating an unnecessarily broad wildcard across all Elasticsearch data.

Search application data

For search workloads, use Kibana or Elasticsearch queries to validate indexed application data.

Typical checks include:

  • full-text search;
  • exact-match filters;
  • sorting;
  • aggregations;
  • relevance;
  • semantic or vector search when configured.

Search behavior should be validated using representative application queries rather than only checking that documents exist.

Create dashboards

Use Kibana dashboards to combine visualizations and saved searches.

To create a dashboard:

  1. Open Dashboard.
  2. Create a new dashboard.
  3. Add existing integration visualizations or create new visualizations.
  4. Apply filters and time ranges.
  5. Confirm the dashboard represents the intended workload.
  6. Save it with a descriptive name.

Prefer existing Elastic integration dashboards when available, then extend them where the workload requires additional views.

Use Kibana spaces

Use Kibana spaces to separate content for different teams or workloads.

For example:

Observability
Search Applications
Platform Operations
Security

Combine spaces with users and roles to control which users can access specific data and content.

If data is missing

Check:

  • the expected source is sending data;
  • Elastic Agent is healthy in Fleet for observability sources;
  • the correct integration or agent policy is applied;
  • the expected index or data stream exists;
  • the Kibana time range includes the data;
  • the current user has read access;
  • the selected data view matches the expected data.

For OpenTelemetry telemetry, also confirm the expected .otel datasets or OTel-native data streams are present.

For assistance:

  • AI chat: https://copilot.ivedha.cloud
  • Support portal: https://support.ivedha.com/

Next step

Continue with monitor health and capacity to understand platform health and resource usage.