### Complex Dashboard Configuration Example (YAML) Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Demonstrates a comprehensive dashboard setup with global settings, a query, filters, controls, and multiple panels like markdown and metric/bar lenses. This serves as a blueprint for creating interactive data visualizations. ```yaml dashboards: - name: "Comprehensive Application Overview" description: "An overview of application performance and logs, with interactive filtering." settings: margins: true titles: true sync: cursor: true tooltips: true colors: false # Use distinct color palettes per panel controls: label_position: "above" chain_controls: true query: kql: "NOT response_code:500" # Global KQL query filters: - field: "geo.country_iso_code" equals: "US" - exists: resource.attributes.host.name controls: - type: options label: "Filter by Host" data_view: "metrics-*" field: "resource.attributes.host.name" panels: - markdown: content: "### Key Performance Indicators" size: {w: 12, h: 2} - lens: type: metric primary: aggregation: unique_count field: resource.attributes.host.name data_view: "metrics-*" title: "Total Hosts" size: {w: 4, h: 4} position: {x: 0, y: 2} - lens: type: bar dimension: type: values field: "resource.attributes.os.type" metrics: - aggregation: unique_count field: resource.attributes.host.name data_view: "metrics-*" title: "Hosts by OS Type" size: {w: 8, h: 4} position: {x: 4, y: 2} ``` -------------------------------- ### ES|QL FROM Command Examples Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Provides examples of the ES|QL FROM command, showing how to retrieve data from single or multiple indices, data streams, or aliases, and how to include metadata. ```esql FROM logs-* FROM logs-*, metrics-* FROM logs-* METADATA _id, _index ``` -------------------------------- ### Heatmap Chart Minimal Configuration Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt A minimal configuration example for a Heatmap chart panel. This demonstrates setting up the basic structure, data view, axes, and value aggregation for visualizing data patterns. ```yaml dashboards: - name: "Server Activity Dashboard" panels: - title: "Activity by Hour and Day" size: {w: 24, h: 15} lens: type: heatmap data_view: "logs-*" x_axis: field: "@timestamp" type: date_histogram label: "Hour of Day" y_axis: field: "host.name" type: values label: "Server" value: aggregation: count label: "Request Count" ``` -------------------------------- ### ES|QL DISSECT Command Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Shows an example of the ES|QL DISSECT command for extracting fields from strings using delimiter-based patterns. ```esql FROM logs-* | DISSECT message "%{method} %{path} HTTP/%{version}" ``` -------------------------------- ### YAML Examples for Lens Metric Configurations Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Demonstrates YAML configurations for different Lens metric types, including count, average, and formula metrics. These examples show how to specify aggregation, field, label, and formatting options. ```yaml # Count metric primary: aggregation: count label: "Total Requests" # Average metric primary: aggregation: average field: response_time_ms label: "Avg Response Time" format: type: duration # Formula metric primary: formula: "count(kql='status:error') / count() * 100" label: "Error Rate %" format: type: percent ``` -------------------------------- ### ES|QL SORT Command Examples Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Provides examples of the ES|QL SORT command for ordering results based on one or multiple columns, including ascending, descending, and handling null values. ```esql FROM logs-* | SORT @timestamp DESC | SORT status ASC, response_time DESC | SORT host.name ASC NULLS LAST ``` -------------------------------- ### ES|QL SHOW Command Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Illustrates the ES|QL SHOW command for retrieving deployment metadata. ```esql SHOW INFO ``` -------------------------------- ### Querying Gauge Metrics with Over Time Functions in ES|QL Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Illustrates how to query gauge metrics using `*_OVER_TIME()` functions in ES|QL. It provides examples for `LAST_OVER_TIME()` to get the current state and `AVG_OVER_TIME()` for typical values, applicable to metrics like connection counts and CPU utilization. ```esql # Current value - use LAST_OVER_TIME for "what is it now?" TS metrics-* | STATS connections = MAX(LAST_OVER_TIME(mysql.connections)) # Average over time - use AVG_OVER_TIME for "what is the typical value?" TS metrics-* | STATS avg_cpu = MAX(AVG_OVER_TIME(system.cpu.utilization)) ``` -------------------------------- ### CLI: Create YAML Dashboard Example Source: https://context7_llms Example of a basic YAML dashboard definition for use with the CLI. This defines a dashboard with a single markdown panel. ```yaml dashboards: - name: My First Dashboard description: A simple dashboard panels: - title: Welcome size: {w: 24, h: 15} markdown: content: | # Welcome to Kibana! ``` -------------------------------- ### ES|QL ENRICH Command Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Shows an example of the ES|QL ENRICH command for adding data from enrichment policies to the query results. ```esql FROM logs-* | ENRICH ip_location_policy ON client.ip WITH city, country ``` -------------------------------- ### Dashboard Controls Configuration Examples Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Examples of configuring interactive controls for dashboards, including an options list and a range slider. These controls allow dynamic data filtering and adjustment. ```yaml dashboards: - name: "Example Dashboard" controls: - type: options label: "Filter by OS Type" data_view: "metrics-*" field: "resource.attributes.os.type" - type: range label: "CPU Load Average (1m)" data_view: "metrics-*" field: "metrics.system.cpu.load_average.1m" ``` -------------------------------- ### ESQL Query Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Provides an example of an ESQL query, typically used within specific panel configurations that support ESQL for data retrieval and aggregation. ```yaml # Example within a panel configuration that supports ESQL panels: - type: some_esql_panel # Hypothetical panel type # ... other panel config query: | FROM my_index | STATS RARE(clientip) ``` -------------------------------- ### ES|QL TS (Time Series) Command Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Shows an example of the ES|QL TS command, optimized for time series data streams, including time-based filtering and aggregation. ```esql TS my_metrics | WHERE @timestamp >= NOW() - 1 day | STATS SUM(RATE(requests)) BY time_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend), host ``` -------------------------------- ### Heatmap Chart Grid and Legend Configuration Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt An example demonstrating advanced customization of a Heatmap chart, including grid cell and axis label visibility, as well as legend positioning and visibility. ```yaml dashboards: - name: "Customized Heatmap" panels: - title: "Response Time Heatmap" size: {w: 24, h: 15} lens: type: heatmap data_view: "logs-*" x_axis: field: "@timestamp" type: date_histogram y_axis: field: "service.name" type: values value: aggregation: average field: "response.time" format: type: duration grid_config: cells: show_labels: true x_axis: show_labels: true show_title: true y_axis: show_labels: true show_title: true legend: visible: show position: right ``` -------------------------------- ### Options List Control Configuration Example Source: https://context7_llms Example of configuring an 'options' list type control for a dashboard, used for filtering data based on a specified field. ```yaml dashboards: - name: "Example Dashboard" controls: - type: options label: "Filter by OS Type" data_view: "metrics-*" field: "resource.attributes.os.type" ``` -------------------------------- ### YAML Example for ESQL Metric Chart Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Illustrates a YAML configuration for an ESQL metric chart. This example shows how to define the chart type, ESQL query, and reference columns from the query's STATS clause for primary, secondary, and maximum metrics. ```yaml # ESQL metric referencing query result column esql: type: metric query: | FROM logs-* | STATS total_requests = COUNT(*), avg_duration = AVG(event.duration), error_rate = COUNT(kql='event.outcome:failure') / COUNT(*) * 100 primary: field: "total_requests" # References column from STATS secondary: field: "avg_duration" # References column from STATS maximum: field: "error_rate" # References column from STATS ``` -------------------------------- ### ES|QL Field and Function Control Examples (YAML) Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Provides YAML examples for configuring ES|QL controls, specifically for field and function selection. These controls allow users to dynamically select fields or functions within ES|QL queries. ```yaml controls: # Field selection control - type: esql variable_name: selected_field variable_type: fields choices: ["@timestamp", "host.name", "message", "log.level"] label: Select Field default: "@timestamp" # Function selection control - type: esql variable_name: aggregate_fn variable_type: functions choices: ["COUNT", "AVG", "SUM", "MAX", "MIN"] label: Aggregate Function default: "COUNT" ``` -------------------------------- ### Install Project Dependencies with uv Source: https://context7_llms Command to synchronize project dependencies using 'uv', a fast Python package installer and resolver. This is a prerequisite for using the CLI tool. ```bash uv sync ``` -------------------------------- ### KQL Query Usage Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Illustrates the usage of a KQL query applied at the dashboard level, filtering for successful user login events. ```yaml dashboards: - # ... query: kql: 'event.action:"user_login" AND event.outcome:success' ``` -------------------------------- ### Markdown Panel Content Example (Markdown) Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt An example of content that can be displayed within a Markdown panel. It showcases basic Markdown syntax like headers, italics, lists, and links, suitable for adding context or instructions to a dashboard. ```markdown # Bold headers and *italic* flair, - Bullet lists with items to share, [Links](that take you anywhere), Markdown panels handle with care! When charts alone won't tell the tale, And metrics need context to prevail, You write instructions, notes, and more, To help users understand the score. "## Welcome to this Dashboard space!" "Please follow these steps with grace!" Font size twelve or twenty-four, Open a new tab, or replace this bore. From setup guides to troubleshooting tips, Important warnings, helpful quips, Your markdown keeps the team aligned, Thanks to documentation found in-line! ``` -------------------------------- ### ES|QL GROK Command Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Demonstrates the ES|QL GROK command for extracting fields from strings using regular expression patterns. ```esql FROM logs-* | GROK message "%{IP:client_ip} - %{DATA:user}" ``` -------------------------------- ### Metric Formatting Examples Dashboard Definition (YAML) Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt A YAML definition demonstrating various metric formatting options available in Kibana Lens. This example focuses on how to customize the display of metric values. ```yaml --8<-- "examples/metric-formatting-examples.yaml" ``` -------------------------------- ### Navigation Example Dashboard Definition (YAML) Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt A YAML definition demonstrating dashboard navigation features in Kibana Lens. It includes examples of link panels, dashboard linking patterns, and passing URL parameters. ```yaml --8<-- "examples/navigation-example.yaml" ``` -------------------------------- ### Lucene Query Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Shows how to configure a Lucene query at the dashboard level for filtering documents, using syntax like event module and dataset. ```yaml # Applied at the dashboard level dashboards: - # ... query: lucene: 'event.module:nginx AND event.dataset:nginx.access' ``` -------------------------------- ### Formula Metric Examples (YAML) Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Demonstrates the use of formula metrics for custom calculations in Kibana. Examples include simple arithmetic, range calculations using min/max, error rate percentages with filters, and formatted byte averages. ```yaml primary: formula: "count() / 100" label: "Count Percentage" ``` ```yaml primary: formula: "max(response.time) - min(response.time)" label: "Response Time Range" format: type: duration ``` ```yaml primary: formula: "count(kql='status:error') / count() * 100" label: "Error Rate %" format: type: percent ``` ```yaml primary: formula: "average(bytes)" label: "Avg Bytes" format: type: bytes compact: true ``` -------------------------------- ### ES|QL ROW Command Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Demonstrates the ES|QL ROW command for creating inline data, useful for testing purposes. ```esql ROW x = 1, y = "test", z = null ``` -------------------------------- ### ES|QL KEEP Command Examples Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Illustrates the ES|QL KEEP command for selecting and ordering specific columns, including the use of wildcards. ```esql FROM logs-* | KEEP @timestamp, host.name, message | KEEP @timestamp, host.* # Wildcards supported ``` -------------------------------- ### ES|QL LIMIT Command Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Illustrates the ES|QL LIMIT command for restricting the number of rows returned by a query. ```esql FROM logs-* | LIMIT 100 ``` -------------------------------- ### CLI: Compile and Upload Dashboard Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Commands to install the CLI using 'make' and then compile and upload a dashboard to Kibana. Assumes a 'my-dashboard.yaml' file exists. ```bash # From repository root make cli install ``` ```bash # From repository root make cli compile ``` ```bash uv run kb-dashboard compile --upload --kibana-url http://localhost:5601 ``` -------------------------------- ### Minimal Kibana Dashboard YAML Configuration Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt A basic example of a Kibana dashboard configuration in YAML format. It demonstrates the essential 'dashboards' array with a 'name' and a single 'markdown' panel. This serves as a starting point for creating custom dashboards. ```yaml dashboards: - name: "Simple Log Dashboard" panels: - markdown: content: "Welcome to the dashboard!" size: {w: 6, h: 3} ``` -------------------------------- ### ES|QL Counter Metric Rate Calculation Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Illustrates the correct way to calculate the rate of a counter metric in ES|QL. It uses the `RATE()` function with `SUM()` to get the per-second rate of change for monotonically increasing metrics like 'apache.requests'. The incorrect example shows how `MAX()` on a counter yields the cumulative total, not the rate. ```esql # CORRECT - Use RATE() for counter metrics TS metrics-* | STATS request_rate = SUM(RATE(apache.requests)) ``` ```esql # WRONG - MAX() on a counter gives cumulative total, not rate FROM metrics-* | STATS requests = MAX(apache.requests) ``` -------------------------------- ### ES|QL Syntax Examples Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Illustrates the correct ES|QL syntax for common operations, contrasting it with incorrect SQL syntax. Covers filtering, aggregation, sorting, and string matching. ```esql FROM logs-* FROM logs-* | WHERE status == 200 FROM logs-* | SORT @timestamp DESC | LIMIT 10 FROM logs-* | STATS COUNT(*) BY host FROM logs-* | STATS avg_time = AVG(response_time) FROM logs-* | WHERE message LIKE "*error*" ``` -------------------------------- ### KQL Query Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Demonstrates how to apply a KQL query at the dashboard level to filter documents based on specific criteria like response code and user ID. ```yaml # Applied at the dashboard level dashboards: - # ... query: kql: 'response_code:200 AND "user.id": "test-user"' ``` -------------------------------- ### Range Slider Control Configuration Example Source: https://context7_llms Example of configuring a 'range' slider type control for a dashboard, used for filtering data within a numerical range. ```yaml dashboards: - name: "Example Dashboard" controls: - type: range label: "CPU Load Average (1m)" data_view: "metrics-*" field: "metrics.system.cpu.load_average.1m" ``` -------------------------------- ### YAML Panel Configuration Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Demonstrates how to configure the 'size' object for a panel using both semantic and numeric values for width, and a numeric value for height. This is the recommended approach for defining panel dimensions. ```yaml size: w: quarter # Semantic value h: 8 # Or with numeric value: size: width: 24 # Numeric value height: 12 ``` -------------------------------- ### ES|QL vs SQL Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Highlights the key differences between ES|QL and standard SQL syntax, providing correct ES|QL equivalents for common SQL queries. ```APIDOC ## ES|QL vs SQL: Key Differences ES|QL is **not** SQL. Common mistakes: | SQL Syntax (Wrong) | ES|QL Syntax (Correct) | | ------------------ | --------------------- | | `SELECT * FROM logs` | `FROM logs-*` | | `SELECT COUNT(*) FROM logs WHERE status = 200` | `FROM logs-* | WHERE status == 200 | STATS COUNT(*)` | | `SELECT * FROM logs ORDER BY @timestamp DESC LIMIT 10` | `FROM logs-* | SORT @timestamp DESC | LIMIT 10` | | `SELECT host, COUNT(*) FROM logs GROUP BY host` | `FROM logs-* | STATS COUNT(*) BY host` | | `SELECT AVG(response_time) AS avg_time FROM logs` | `FROM logs-* | STATS avg_time = AVG(response_time)` | | `SELECT * FROM logs WHERE message LIKE '%error%'` | `FROM logs-* | WHERE message LIKE "*error*"` | Key differences: - **Piped syntax**: Commands flow left-to-right with `|` (pipe) operators - **Equality**: Use `==` not `=` for comparison - **No SELECT**: Use `KEEP` to select columns, or just aggregate directly - **No GROUP BY clause**: Use `BY` within `STATS` - **Wildcards**: Use `*` in patterns, not `%` - **Index patterns**: FROM uses Elasticsearch index patterns (e.g., `logs-*`) ### Syntax Rules **Case sensitivity:** - Keywords and function names are **case-insensitive**: `FROM`, `from`, `WHERE`, `where` all work - Field names are **case-sensitive**: `host.name` ≠ `Host.Name` - String comparisons are **case-sensitive**: `"Germany"` ≠ `"germany"` **String literals use double quotes**, not single quotes: ```esql # Correct WHERE country == "Germany" # Wrong - single quotes not supported WHERE country == 'Germany' ``` **Always name computed columns** to avoid awkward backtick references later: ```esql # Bad - creates column named "height * 3.281" | EVAL height * 3.281 | STATS MEDIAN(`height * 3.281`) # Must quote expression # Good - explicit name | EVAL height_feet = height * 3.281 | STATS MEDIAN(height_feet) ``` ``` -------------------------------- ### Time Range Configuration Example (YAML) Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Illustrates how to configure a default time range for a dashboard using 'from' and 'to' keys with relative time expressions. This ensures the dashboard loads with a specific time period pre-selected. ```yaml dashboards: - name: "Last 30 Days Overview" time_range: from: "now-30d/d" to: "now" panels: - markdown: content: "This dashboard defaults to the last 30 days." size: {w: 12, h: 3} ``` -------------------------------- ### YAML: Lens Metric Panel Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt An example of a YAML definition for a Kibana Lens metric panel. This specifies a count metric for a given data view. ```yaml dashboards: - name: Metric Dashboard description: A dashboard with a single metric panel panels: - title: Document Count type: lens size: {w: 24, h: 15} data_view: your-index-pattern-* chart: type: metric metrics: - type: count label: Total Documents ``` -------------------------------- ### ES|QL WHERE Clause Examples Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Demonstrates various ways to use the ES|QL WHERE command for filtering data based on different conditions, including numerical comparisons, string matching, and list membership. ```esql FROM logs-* | WHERE status == 200 | WHERE response_time > 1000 | WHERE host.name LIKE "prod-*" | WHERE event.category IN ("authentication", "network") ``` -------------------------------- ### Heatmap Examples Dashboard Definition (YAML) Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt A YAML definition providing examples of heatmap visualizations within Kibana Lens. This snippet focuses on the configuration and usage of heatmap charts. ```yaml --8<-- "examples/heatmap-examples.yaml" ``` -------------------------------- ### Links Panel Configuration Example (Text) Source: https://context7_llms A textual representation of a poem describing the functionality of the Links panel. It highlights its use for creating navigation hubs and providing quick access to related resources, including dashboard links and external URLs. ```text Portals to dashboards near and far— Links will take you where they are. Horizontal rows or vertical stacks, Teleporting users through the cracks. Dashboard links with time preserved, Filters carried, context preserved. External URLs in tabs brand new, Wiki pages, docs to pull you through. "with_time: true" keeps your clock alive, "with_filters" helps context survive. What you selected stays in place As you traverse from space to space. From the ops hub to service views, Your links provide the crucial clues. No more wandering, lost and stressed— Click once, arrive. You know the rest. ``` -------------------------------- ### YAML Panel Position Configuration Example Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Illustrates how to set the 'position' for a panel using explicit x/y coordinates or verbose alternatives. It also shows how omitting the 'position' field enables auto-layout. ```yaml position: x: 0 y: 0 # Or verbose: position: from_left: 24 from_top: 10 # Example with auto-positioning (omit position entirely): # No position field - will be auto-positioned size: w: quarter h: 8 ``` -------------------------------- ### Build VS Code Extension using Make Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Builds the VS Code extension using the 'make' command from the repository root. This process includes installing dependencies, compiling the code, and packaging the extension. ```bash make vscode install make vscode compile make vscode package ``` -------------------------------- ### ESQL Area Chart Configuration Example (YAML) Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt An example of an ESQL Area chart configuration in YAML format. This snippet demonstrates how to define the chart type, ESQL query, stacking mode, dimension, metrics, and breakdown. ```yaml dashboards: - name: "ESQL Area Chart Example" description: "Example of ESQL area chart with stacked mode" panels: - title: "Total Bytes by Host" size: {w: 48, h: 20} esql: type: area query: | FROM logs-* | STATS bytes_total = SUM(bytes) BY timestamp_bucket = BUCKET(@timestamp, 20, ?_tstart, ?_tend), host.name | SORT timestamp_bucket ASC mode: stacked dimension: field: "timestamp_bucket" metrics: - field: "bytes_total" breakdown: field: "host.name" ``` -------------------------------- ### Initialize a Dashboard Object in Python Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Shows the basic initialization of a `Dashboard` object using the `kb_dashboard_core` library. It highlights the required `name` parameter and the optional `description` parameter for defining a new dashboard. ```python from kb_dashboard_core.dashboard.config import Dashboard dashboard = Dashboard( name='Dashboard Name', # Required: Display name description='Dashboard description', # Optional: Description ) ``` -------------------------------- ### Color Palette Example Dashboard Definition (YAML) Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt A YAML definition illustrating color customization options for charts in Kibana Lens. It includes examples of custom palettes, manual color assignments, and per-chart color configuration. ```yaml --8<-- "examples/color-palette-examples.yaml" ``` -------------------------------- ### ES|QL EVAL Command Examples Source: https://strawgate.com/kb-yaml-to-lens/llms-full.txt Shows how to use the ES|QL EVAL command to create new columns or modify existing ones, including mathematical operations, conditional logic with CASE, and boolean expressions. ```esql FROM logs-* | EVAL response_time_ms = response_time * 1000 | EVAL status_category = CASE( status >= 500, "error", status >= 400, "client_error", status >= 300, "redirect", "success" ) | EVAL is_slow = response_time > 1000 ```