Sample Header Ad - 728x90

Kibana- Want to split vertical bars based on my log fields

0 votes
1 answer
537 views
I have an application log file consists of following log levels: INFO, WARN, ERROR, DEBUG. Following filter criteria works fine in logstash config file: filter { grok { match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log-level} \[%{DATA:thread_name}\]?-\[%{DATA:class}\] %{GREEDYDATA:message}" } } date { match => ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS"] target => "@timestamp" } } output { elasticsearch { hosts => ["localhost:9200"] } stdout { codec => rubydebug } } I can see log-level field in "Discover" view of Kibana. However, I would like to visualize my app log as following: Split a vertical bar at a given moment to show how many ERROR logs, how many INFO logs, etc. are hit at a given moment. When I go to "Visualize" tab and try to do "Add sub-buckets", "split bars" on X-axis, sub-aggregation="Terms"; I cannot see the field: "log-level" under the selectable "Field" options. Could you please help me to split the bars based on log-level? Thanks.
Asked by Murat (335 rep)
Jan 9, 2017, 11:17 AM
Last activity: Mar 21, 2018, 11:47 AM