An amazing tool for Data Visualization
Use Cases and Deployment Scope
Our organization uses Kibana primarily to visualize and analyze large volumes of logs and performance data generated by our applications and infrastructure.
Kibana is integrated with AWS OpenSearch. We use AWS OpenSearch to store AWS WAF logs. Whenever we identify an issue, we go to the Kibana console and search for various parameters related to our infrastructure that help us in searching the logs quickly and enable us to identify the issues.
Pros
- Real-time Dashboards:
- We use Kibana to create live dashboards that track WAF performance in real-time. We have a dashboard that visualizes our whitelabel partners and the requests they received on various pages. Using these metrics, we identify the origin of the requests and also how many requests were allowed/blocked by our AWS WAF.
- Quick Search functionality: We have used OpenSearch to index WAF logs and hence Kibana gives us a quick search feature over several indexes in real time. We are able to filter logs almost real time against our WAF logs.
- Another feature which is great in Kibana is the alerting and monitoring. We use Kibana to send alerts to our Slack channels that helps us in quickly identifying the issues.
Cons
- Kibana supports both KQL and Lucene Syntax. While this functionality is great, but it is sometimes very confusing for the users to switch between these two.
- I have faced several performance issues with large data sets and dashboards. Kibana takes a lot of time to response when run against a large data set. Also, the visulization is delayed.
- While Kibana is great in alerting in a Slack channel, it is limited to send alerts to a single channel. I have been using Datadog and it allows sending alerts in multiple channels. This is a limitation from Kibana.
Likelihood to Recommend
Kibana is indeed a powerful tool and has many use cases especially in environments that rely heavily on real-time log analysis and visualisation. Kibana’s ability to handle large volumes of log data and present it in an accessible, searchable format is invaluable. We use Kibana to monitor security related issues and it proactively alerts our Slack channels about any anomality or issues.