elasticsearch - Unable to see data in Kibana 4 on Ubuntu -
i trying visualize data file using kibana
the format of file follows
timestamp;elapsed;label;responsecode;responsemessage;threadname;success;failuremessage;bytes;grpthreads;allthreads;latency;samplecount;errorcount;hostname 2016-01-16 02:27:17,565;912;http request;200;ok;thread group 1-5;true;;78854;10;10;384;1;0;sundeep-latitude-e6440 timestamp;elapsed;label;responsecode;responsemessage;threadname;success;failuremessage;bytes;grpthreads;allthreads;latency;samplecount;errorcount;hostname 2016-01-16 02:27:17,565;912;http request;200;ok;thread group 1-5;true;;78854;10;10;384;1;0;sundeep-latitude-e6440
to map above data, logstash config follows:
input { file { path => [ "/home/sundeep/data/test.csv"] start_position => "beginning" sincedb_path => "/dev/null" } } filter { if ([message] =~ "responsecode") { drop { } } else { csv { separator => ";" columns => ["timestamp", "elapsed", "label", "responsecode","responsemessage","threadname", "success","failuremessage", "bytes", "grpthreads", "allthreads", "latency", "samplecount", "errorcount", "hostname"] } } } output { elasticsearch { hosts => ["localhost:9200"] index => "aa-%{+yyyy-mm-dd}" } }
the template file follows:
{ "template": "aa-*", "settings": { "number_of_shards": 1, "number_of_replicas": 0, "index.refresh_interval": "5s" }, "mappings": { "logs": { "properties": { "timestamp": { "index": "analyzed", "type": "date", "format": "yyyy-mm-dd hh:mm:ss,sss" }, "elapsed": { "type": "long" }, "dummyfield": { "type": "long" }, "label": { "type": "string" }, "responsecode": { "type": "integer" }, "threadname": { "type": "string" }, "success": { "type": "boolean" }, "failuremessage":{ "type": "string" }, "bytes": { "type": "long" }, "grpthreads": { "type": "long" }, "allthreads": { "type": "long" }, "latency": { "type": "long" }, "samplecount": { "type": "long" }, "errorcount": { "type": "long" }, "hostname": { "type": "string" } } } }
}
now can see, new index created in elasticsearch start logstash config file.
the newly created index starts aa-* expected.
now, search index in kibana , can see below:
[
however, cannot see data when try plot line chart.
- things have tried:
- deleting index sense , creating again via sense (did not work)
- changing timestamp of log file, did not work import successful
- tried solution here similar question
also, able visualize dataset, blog post:enter link description here
trace log:
[2016-01-16 02:45:41,105][info ][cluster.metadata ] [hulk 2099] [aa-2016-01-15] deleting index [2016-01-16 02:46:01,370][info ][cluster.metadata ] [hulk 2099] [aa-2016-01-15] creating index, cause [auto(bulk api)], templates [aa], shards 1/[0], mappings [logs] [2016-01-16 02:46:01,451][info ][cluster.metadata ] [hulk 2099] [aa-2016-01-15] update_mapping [logs]
elk stack elasticsearch - 2.1 logstash - 2.1 kibana - 4.3.1.1
Comments
Post a Comment