What is a Kibana Dashboard? A Complete Guide with Examples

A Kibana dashboard is a single page that combines visualizations, saved searches, and interactive controls into one view of your Elasticsearch data. Dashboards are how teams turn indexed data (logs, metrics, traces, business events) into something they can look at, filter, and act on. Most of the day-to-day value people get out of the Elastic Stack flows through dashboards.

Each dashboard is a layout of panels. A panel can be a Lens visualization, a Maps panel, a saved Discover search, a Markdown note, a control input, or an embedded link to another dashboard. Filters and time ranges apply across the whole dashboard, so you can drill down on a customer ID or narrow to the last 15 minutes and watch every panel update together.

Note: this article is about Kibana, the visualization tool that ships with the Elastic Stack. OpenSearch users have a separate (forked) tool called OpenSearch Dashboards. The concepts are nearly identical and most of what's below applies to both.

What a Kibana Dashboard Actually Contains

A dashboard is built from a small set of building blocks:

Visualizations (Lens, TSVB, Maps). Lens is the modern, default editor; it suggests chart types from the fields you drop in. TSVB (Time Series Visual Builder) is the older, more configurable option for time-series data with multiple metrics. Maps render geospatial data as layers.
Saved Searches. A query saved from Discover, rendered as a row-by-row table on the dashboard. Useful for log triage and audit views.
Controls. Dropdowns, sliders, and time pickers that let viewers filter the dashboard without editing it. The Controls panel is what turns a static dashboard into a self-service tool.
Markdown. Free-form text and links. Most teams use it for context, ownership, and runbook pointers ("if this dashboard is red, page @oncall").
Links and embeds. Pointers to other dashboards, the Discover view, or alerts.

A dashboard isn't a static report. It re-runs every query, every time it loads.

Building Your First Kibana Dashboard

The flow:

Open Kibana → Dashboards → Create dashboard.
Click Create visualization to open Lens. Drag a field (like @timestamp) onto the X-axis well and a metric (like Records or Sum of bytes) onto the Y-axis. Lens picks a chart type; you can override.
Save the visualization back to the dashboard.
Repeat for each panel. Resize and rearrange by dragging panel borders.
Add a Controls panel to expose key filters (host.name, service.name, customer_id) so users can slice without writing KQL.
Set the time picker to a sensible default (last 24 hours is common) and save the dashboard.

For a step-by-step walkthrough with concrete examples, see How to Create a Kibana Dashboard and Examples of Useful Kibana Dashboards.

Common Use Cases

Log analysis and incident triage

A dashboard with log volume by service, top error messages, recent stack traces, and a host filter is what most SRE teams open first when something breaks. It's the single highest-leverage Kibana dashboard you can build.

Infrastructure and Kubernetes monitoring

CPU, memory, disk, and network metrics, typically pulled in via Metricbeat or Elastic Agent, laid out per-host or per-pod with auto-refresh on. Combined with a host or namespace control, this covers a lot of what teams used to do in Grafana.

Application performance and APM

Latency p95/p99, error rate, throughput, slow transactions. Elastic APM ships with curated dashboards out of the box; most teams clone and adapt them rather than build from scratch.

Security analytics (SIEM)

Authentication failures, anomalous logins, alert volume by rule. Elastic Security has its own dedicated UI, but custom dashboards are still useful for overlaying business context onto the security signals.

Business intelligence

Order volume, conversion rate, customer activity. Dashboards on indexed event data perform well when retention and rollup have been thought through. They tend to fall apart when Elasticsearch is asked to behave like a transactional database.

Dashboard Filters and Time Ranges

Filters are the most important interaction model in Kibana. A few flavors:

Pinned filters stick across dashboards as you navigate.
Per-dashboard filters apply only to the current view.
Per-panel filters override the dashboard-level filter for one visualization. Useful when a single panel needs different scoping than the rest.
The time picker is a special filter that applies to every panel that uses a time field.

For text filters, Kibana Query Language (KQL) is the fastest way to scope: service.name : "checkout" and not status : 200.

Performance: Why Dashboards Get Slow

A slow dashboard is almost always one of these:

Too many panels (15+) on one page. Every panel runs an Elasticsearch query in parallel; the slowest one gates the whole load. Split into multiple dashboards or use drill-downs.
Wide time ranges over high-cardinality data. Querying 30 days of logs with no filter forces large scatter-gather aggregations. Pre-aggregate with rollups or transforms for long lookbacks.
Unnecessarily granular date histograms. A 1-second interval over a 7-day window can produce more than 600,000 buckets. Let Kibana auto-pick the interval.
Saved searches that return everything. A saved search returning 10,000 rows is a query Elasticsearch has to execute and serialize on every load.
Cluster-side issues. A slow cluster makes everything that depends on it slow. Hot threads, garbage collection, and shard imbalance can all show up as a slow dashboard.

The Kibana Inspector (the three-dot menu on any panel → Inspect) shows the actual query, request payload, and execution time. It's the fastest path from "the dashboard is slow" to "this aggregation is the bottleneck."

Shareable links preserve the current filters and time range. Send teammates a link, not a screenshot.
iframe embeds drop a dashboard into Confluence, Notion, or any internal portal. The embed inherits Kibana's auth, so anonymous embeds aren't a thing without extra work.
Roles and Spaces restrict who sees what. A common pattern is a Space per team or per environment, with role-based access on dashboards within the Space.
Reports generate PDF or PNG snapshots, useful for stakeholders who don't log in. Reporting is a paid feature; the exact tier required depends on the specific reporting capability (post-URL, scheduled, large-export). See Elastic's subscriptions matrix for the current feature/tier mapping in your version.

Common Issues with Kibana Dashboards

When dashboards break, it's usually one of:

No data. Either the time picker is set to a window with no events, the index pattern is wrong, or the user lacks permissions on the underlying indices. Start by widening the time range. See Kibana data not showing in dashboards for the full debug flow.
Index pattern not found. Someone deleted the data view, or the underlying alias was renamed. See Kibana index pattern not found.
Saved object missing. An upgrade or restore left dangling references. See Kibana saved objects not found.
Authentication failures. The dashboard loads but panels show errors. See Kibana authentication failures.
Dashboard slow or timing out. Usually the query, occasionally the cluster. See Kibana request timeout after 30000ms.

Migrating Dashboards Between Environments

Use Saved Objects → Export to package a dashboard (and its dependent visualizations and index patterns) as an NDJSON file, then Import on the target Space. The import will warn you about ID collisions and missing data views. For programmatic migrations, the Kibana Saved Objects API does the same thing as JSON.

For exporting an individual dashboard as PNG or PDF, see Exporting Kibana Dashboard.

Enhanced Elasticsearch and Kibana Monitoring with Pulse

Kibana dashboards visualize the data; the cluster underneath has to keep delivering. When a dashboard suddenly times out at 30 seconds, the answer is almost always in the cluster (JVM pressure, slow shards, hot nodes, query queue saturation) and not in Kibana itself.

Pulse provides AI-powered monitoring for Elasticsearch and OpenSearch clusters. Root-cause analysis when queries slow down, alerts on shard imbalance and JVM pressure, and a Shard Heatmap visualization that surfaces hot data nodes pulling your dashboards down. Start a free trial to see what it looks like on your own cluster.

Frequently Asked Questions

Q: What's the difference between a Kibana dashboard and a Kibana visualization?
A: A visualization is a single chart or panel: a bar chart, a metric, a map. A dashboard is a layout of multiple visualizations on one page, sharing filters and a time range. You build visualizations, then assemble them into dashboards.

Q: Can I build dashboards without writing code or queries?
A: Yes. Lens is drag-and-drop and infers the chart type from the fields you choose. KQL helps for advanced filtering, but most dashboards can be built from the UI alone. Painless scripting only enters the picture for runtime fields and computed columns.

Q: How many visualizations should a single dashboard have?
A: 8 to 12 is the practical sweet spot. Beyond 15, load times get noticeable and the page becomes hard to scan. If you're tempted to add more, build a second dashboard and link to it.

Q: Do Kibana dashboards refresh automatically?
A: Yes. Set the auto-refresh interval from the time picker. Common settings are 30s for ops dashboards and "Off" for analytical exploration. Every refresh re-runs every panel's query against Elasticsearch, so don't set it tighter than you actually need.

Q: Can I share a Kibana dashboard with people who don't have a Kibana account?
A: Not safely. Dashboards inherit Kibana's auth, so even iframe embeds require a logged-in user. For external sharing, use scheduled PDF reports (paid tier) or export to PNG. Some teams stand up a separate, read-only Kibana with anonymous access for public dashboards, but that's a meaningful security exposure to plan around.

Q: How do I copy a dashboard between Kibana environments?
A: Saved Objects → Export from the source, Import on the destination. The export bundles the dashboard with its visualizations and data view references. If the data views don't exist on the target, you'll be prompted to remap them at import time.

Q: Why is my Kibana dashboard so slow?
A: In rough order of frequency: too many panels firing in parallel, time range too wide, date histogram interval too granular, an underperforming cluster, or shard imbalance making one node a bottleneck. Use the panel Inspector to identify the slow query, then narrow filters or pre-aggregate with transforms.

Q: Can I embed a Kibana dashboard in another application?
A: Yes, via iframe with the share-link URL. The embedding application needs to handle Kibana auth, typically by passing the user's session or using a service account. For internal tools this works well. For customer-facing embeds, you'll either build a thin proxy or look at Elastic's serverless options.

Q: What permissions does a user need to view a dashboard?
A: Read access on the Kibana feature in the Space, plus read access on the underlying indices the visualizations query. The most common "blank dashboard" symptom is having Kibana access but missing index-level privileges.

How to Create a Kibana Dashboard: step-by-step build walkthrough
Examples of Useful Kibana Dashboards: real-world layouts to clone
Exporting Kibana Dashboard: PDF, PNG, and JSON export
Kibana Query Language: KQL syntax reference
Kibana data not showing in dashboards: common troubleshooting