Anyone, Help me about vizualization with my log pattern!

[quangdv.6466 (Quang Doan)]

Hi there!
Here is my complete configuration of the elk stack for my stub.

• Log example:
  

  

• Filebeat configuration:
  

  

• Logstash configuration:
  

  

• Fields auto define on kibana:
  

  

• And here is result on my Kibana:
  

  
  
  I'm quite confused with the aggregation. I have quite a lot of "errorCode" inside the message field. For example:

• errorCode: 18003

• errorCode: 198877

• errorCode: 19035

and more...

My question is:

How can I count each errorCode and fill result to a vertical graph vizualize with the corresponding errorCode being the bucket?

So, anyone could you help me solution with whole my everything above i provided? And i would like to implement it into my Kibana. Thank you so much!

[Marta_Bondyra]

Hi @quangdv.6466
You didn't mention what version of kibana you're in, but assuming you're on 7.9.3 or 7.10 you could use lens to achieve what you need.

I'll try to walk you through similar example:

1. Go to Visualize -> Lens.

2. Inside the app, on the left side, choose the index pattern you want to work.

3. From the left side, move the field 'errorCode' to the right horizontal axis (x-axis).

4. Click on the freshly created 'Top values of errorCode' and change the number of values in the flyout that will open (depending on how many different errorCodes you expect):
   

   

5. Move the field 'Records' to Vertical axis (Y axis)

6. Remember about changing the timepicker range if no data is shown.
   

   

I hope it's helpful!

[quangdv.6466 (Quang Doan)]

The first one, Thanks Marta, i'm using Kibana 7.9.3. And, i know what you mean.
But the issue is that the errorCode is inside the message field. I don't know how I can get the errorCode from inside the message field out for statistics and fill whole result into vertical chart in lens.
Hope you can support me about this issue. Many thanks!

[Marta_Bondyra]

Oh ok, I see the problem now. The only option I see is to ingest your data differently so you have a separate field errorCode that you can then visualise.
Maybe someone else can give a better answer, but I don't think it's possible this way.