Discover, Lens, TSVB: Which Kibana Visualisation Should You Use?
Kibana ships three overlapping editors. The differences matter — pick wrong and you hit a ceiling three weeks in.
New Kibana users often make the same mistake: they open whatever visualisation editor they opened first, and they stay there. Discover, Lens, and TSVB are optimised for different work.
Discover — raw document exploration
The home of ad-hoc investigation. You're reading actual documents, filtering with KQL, and saving searches — not drawing charts. Discover is where you figure out what your data actually looks like before you visualise anything.
service.name : "payments-api" and http.response.status_code : 500
and @timestamp >= now-1hLens — the default for most dashboards
Drag-and-drop with smart suggestions. It produces proper bucket/metric aggregations under the hood and exports clean JSON. Limitations:
- No pipeline aggregations (cumulative sum, moving avg) out of the box.
- Series-level expressions are constrained — one formula per layer.
Lens is what to use when a teammate will maintain the dashboard.
TSVB — the power tool for time-series
Time Series Visual Builder exposes the full aggregation pipeline: math, moving averages, rate-of-change, series filters. It's the right choice when you need:
- Percentile bands (p50/p95/p99 on one chart).
- Ratios between two queries:
errors / requests. - Split-by-term with a secondary filter per series.
The honest trade-off
TSVB dashboards are harder to hand off. Expressions encode behaviour in a small DSL that your teammates may or may not read. A practical rule: reach for Lens first, switch to TSVB only when you hit a real wall.
And: Vega
If you need a chart Kibana simply can't draw — a Sankey, a chord diagram, a custom map overlay — Vega-Lite is the escape hatch. It talks to Elasticsearch directly via data.url.%context%. Write very few of these; they're the first to rot on upgrade.