kibana-vega

Custom charts in Kibana that go beyond standard Lens visualizations are the domain of this skill, which builds Vega and Vega-Lite visualizations backed by ES|QL queries. It strictly supports ES|QL data sources and requires Serverless Kibana or version 9.4+ (SNAPSHOT); it will not work reliably on older versions or with Lucene or KQL data-source definitions. A bundled Node script, scripts/kibana-vega.js, drives everything from the command line.

Connection is configured through environment variables, with four documented options: Elastic Cloud using KIBANA_CLOUD_ID and KIBANA_API_KEY, a direct URL with an API key, basic authentication with username and password, and local development via start-local, whose generated .env supplies credentials. Running node scripts/kibana-vega.js test verifies the connection, and the guidance is to stop and fix setup before exploring further if that test fails. The basic workflow then creates, gets, and updates visualizations and creates dashboards, adds panels, and applies layouts - with a dash argument letting specs be piped from stdin so no intermediate file is needed.

A minimal Vega-Lite spec shows the ES|QL pattern: a data.url object with %type%: esql and a query such as FROM logs-* | STATS count = COUNT() BY status, plus mark and encoding definitions. ES|QL data-source options include %context% to apply dashboard filters and %timefield% to enable time ranges with the tstart and tend parameters. The guidance stresses proper JSON rather than HJSON triple-quotes to avoid parse errors.

Dashboard layout uses a 48-column grid, with widths of 48, 24, 16, and 12 for full, half, third, and quarter panels. An above-the-fold discipline keeps primary information within the top roughly 22 height units at 1080p, with height guidelines (h:10 compact bar charts, h:12-13 standard, h:15+ detailed) and an operational-dashboard layout pattern. Panels can be added individually with x, y, w, and h positions or applied wholesale from a layout JSON.