Bar graph of values in one event

Elastic Stack Logstash
1

I am testing out ELK for specific use case. I have several JSON objects like this:

{
  "field1": "uniquevalue1",
  "field2": [
    {
      "field2a": "value2a",
      "time": <sometimestampvalue>
    },
    {
      "field2b": "value2b",
      "time": <sometimestampvalue>
    },
    ...
  ]
}

I want to take each object like this into Kibana as a single event. field1 contains unique value which can identify an event. After searching by field1, or in other words, after finding specific event, I want to make a visualization(bar chart) in Kibana on field2 values. time on X-axis and field2b on Y-axis. Is it possible to create visualization based on values inside an array?

If I apply "split filter" on field2 in Logstash, I can create multiple events, and that could help in creating the above mentioned visualization easier. But, I do not want to create 1 event per 1 array element of field2. I want 1 event to contain entire field2 array. So, is it possible without split filter in Logstash?

2

Kibana does not support this type of nested events, so I believe you will need to split it up in Logstash in order to visualise it the way you describe.

3

Thanks for the quick response. I have a use case where I have to generate one event per object above. If I create multiple events by using "split filter" in Logstash, then per each object above, multiple events will be created. That I am trying to stop.

If I use "split filter", then say multiple events are created. In that case, is it possible to show Discover tab results in this fashion below?

field1:uniquevalue1 (header)

field2.field2a:xxx, field2.time:1478511000000 (event)
field2.field2a:yyy, field2.time:1478512000000 (event)
....

field1:uniquevalue2 (header)

field2.field2a:zzz, field2.time:1478513000000 (event)
field2.field2a:xyz, field2.time:1478514000000 (event)
....

In other words, for each object in my question, I need to display field1(which is unique) only once- something like a header. That should be followed by all the events generated because of split filter on field2. Is this structure possible in Kibana?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.