Kibana is the visualization and search front end for Elasticsearch. In a data engineering stack it is the human-facing layer of the ELK/Elastic stack, where pipeline logs, application traces, and ingested events land as JSON documents. Its strength is interactive full-text search and aggregation over semi-structured data, which is the kind of high-cardinality, schema-loose data that columnar BI tools handle poorly.
Discover, search, and the query languages
The Discover view lets you scan raw documents in an index, filter by field, and run full-text queries. Kibana exposes two main query languages: KQL (Kibana Query Language) for simple field filters in the search bar, and Elasticsearch Query DSL (JSON) for complex boolean, range, and aggregation logic. Newer versions also offer ES|QL, a piped query language for transforming and aggregating in one expression.
# KQL in the search bar: failed ingest events from one pipeline in the last hour
service: "ingest-worker" and status: "error" and pipeline: "orders-cdc"
# ES|QL: count errors per pipeline, newest first
FROM logs-ingest-*
| WHERE status == "error"
| STATS error_count = COUNT(*) BY pipeline
| SORT error_count DESCDashboards, log analytics, and observability
On top of search, Kibana builds visualizations (histograms, data tables, heat maps, maps) and assembles them into dashboards backed by Elasticsearch aggregations. For data engineers the common uses are tracing a record through a pipeline by correlation ID, charting ingest error rates by source over time, and spotting the spike in a histogram that marks when a job started dropping events. Dedicated Logs and APM apps add log tailing and distributed-trace views without building panels by hand.
| Task | Kibana feature |
|---|---|
| Find one event across pipelines | Discover + KQL filter |
| Error rate by source over time | Date histogram + terms aggregation |
| Live tail of pipeline logs | Logs app |
| Alert on ingest error surge | Alerting rules (threshold over a query) |
Index patterns, mappings, and scale
Kibana queries through data views (formerly index patterns) that point at one or more Elasticsearch indices, often time-based like logs-ingest-2026.06.18. How a field is mapped in Elasticsearch decides what you can do with it in Kibana: a field mapped as keyword aggregates and filters exactly, while text is analyzed for full-text search but is not aggregatable. Getting mappings right at ingest time, usually via an index template, is the difference between fast dashboards and ones that fail or return surprising results. Index Lifecycle Management rolls older log indices to cheaper storage and eventually deletes them, which keeps log retention affordable.
Frequently asked questions
Can Kibana visualize data outside Elasticsearch? No. Kibana only reads from Elasticsearch (and the wider Elastic stack). To chart logs you first ship them into Elasticsearch, typically with Logstash, Filebeat, or the Elastic Agent.
Kibana or Grafana for logs? Kibana is built around Elasticsearch's full-text search and is stronger for ad-hoc log investigation and trace correlation. Grafana with Loki is preferable when you want logs and infrastructure metrics on a single dashboard.
Why does a field not show up for aggregation? It is almost always a mapping issue. A field analyzed as text is not aggregatable; you need a keyword mapping (or a .keyword sub-field) to group or filter on exact values.
Is Kibana a BI tool for business reporting? Not really. It targets logs, events, and observability data. For modeled warehouse tables and stakeholder reporting, a SQL-warehouse BI tool such as Looker or Power BI is the better fit.