Search and visualize data

Use Kibana after data is present in Elasticsearch and your user has access to the intended indices and Kibana space.

Create a data view

1. Sign in to Kibana.
2. Use the navigation search to open Data Views.
3. Select Create data view.
4. Enter an approved name and an index pattern that matches only the intended data.
5. Select the timestamp field when the data has one.
6. Save the data view.

If no matching indices appear, confirm that data has been indexed and that the current user has read access.

Find events

1. Open Discover.
2. Select the data view.
3. Choose a time range that includes the indexed events.
4. Filter by a known non-sensitive field.
5. Add useful fields to the result table.
6. Save the search only if other users need to reuse it.

Create a first visualization

1. Open Dashboard and create a dashboard.
2. Select Create visualization.
3. Choose the data view and a simple count or time-series view.
4. Verify that filters and time range affect the result as expected.
5. Save the visualization and dashboard with descriptive names.

Use Kibana spaces and roles to separate teams. A missing result can be caused by an incorrect time range, data view, field, or permission. See Elastic search troubleshooting before changing index mappings or privileges.