Kibana- Want to split vertical bars based on my log fields
0
votes
1
answer
537
views
I have an application log file consists of following log levels: INFO, WARN, ERROR, DEBUG. Following filter criteria works fine in logstash config file:
filter {
grok {
match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log-level} \[%{DATA:thread_name}\]?-\[%{DATA:class}\] %{GREEDYDATA:message}" }
}
date {
match => ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
target => "@timestamp"
}
}
output {
elasticsearch { hosts => ["localhost:9200"] }
stdout { codec => rubydebug }
}
I can see log-level field in "Discover" view of Kibana. However, I would like to visualize my app log as following: Split a vertical bar at a given moment to show how many ERROR logs, how many INFO logs, etc. are hit at a given moment.
When I go to "Visualize" tab and try to do "Add sub-buckets", "split bars" on X-axis, sub-aggregation="Terms"; I cannot see the field: "log-level" under the selectable "Field" options.
Could you please help me to split the bars based on log-level?
Thanks.
Asked by Murat
(335 rep)
Jan 9, 2017, 11:17 AM
Last activity: Mar 21, 2018, 11:47 AM
Last activity: Mar 21, 2018, 11:47 AM