Elastic (ELK)
Kibana — Discover, Visualize & Query
Explore, visualize, and build dashboards over Elasticsearch data.
Kibana is the visualization and exploration front end for the Elastic Stack. Discover lets you search raw documents interactively — pick a data view (index pattern), filter with KQL (Kibana Query Language), and inspect fields and their values, which is the everyday tool for log triage. From there, Lens and the visualization editors build charts, and dashboards combine them with shared filters and time pickers.
The dashboard and steering wheel of a car whose engine is Elasticsearch: you do not touch the engine directly — you drive, watch the gauges, and navigate from the cabin.
Key Concepts
1
Kibana is also the control plane for much of Elastic: it hosts the Observability and Security (SIEM) apps, manages Elastic Agent through Fleet, configures index lifecycle and alerting rules, and exposes Dev Tools for raw query DSL. Newer query options include ES|QL, a piped query language that brings a Splunk-SPL-like compute-and-aggregate experience to Elasticsearch. For interviews, the key idea is that Kibana is where humans search, visualize, and operate the stack — Elasticsearch does the work underneath.
2
What the interviewer is probing.
What the interviewer is probing.
3
1. "What is Discover used for?" *Probing:* the basics. *Stalls:* "Dashboards." *Moves up:*
exploring raw documents with filters and a time range — the starting point for an investigation,
before any visualisation.
1. "What is Discover used for?"
4
2. "What query languages does it offer?" *Probing:* the breadth. *Stalls:* "One." *Moves up:*
KQL for most filtering, Lucene syntax, and ES|QL in recent versions for pipeline-style analysis.
2. "What query languages does it offer?"
5
3. "What is a data view?" *Probing:* the vocabulary. *Stalls:* "An index." *Moves up:* the
pattern telling Kibana which indices and fields to query, which is why a new index can be invisible
until it is added.
3. "What is a data view?"
6
4. "What is the performance consideration?" *Probing:* the practical angle. *Stalls:* "None."
*Moves up:* wide time ranges across many indices scan a great deal — the time picker is the main
performance control.
4. "What is the performance consideration?"