Compact view of filtered logs

My dataset is the output from a lot of logging files that are pushed to Elastic search using fluent(d) (using 'tailing' of the log files). Visualizations are then created but the question has been asked "if a visualization indicates an issue, can we browse all the related logs to really drill down to the cause?"

I know that we can use "Discover" to see the logs or a text table but these are quite wasteful of whitespace and in the perfect world I would like to see some sort of nested lists where each "job" can be expanded to show the available "logfiles" (we have info on which logfile they originated from) and each "logfile" can be expected to see the individual "lines" that created the logs. Yes, essentially I want to see the "logfiles" like I would in a text editor - sorry ;-).

I took a quick look at vega and vega-lite but nothing jumped out at me as an interface for generating such text output. I appreciate that this is not really what Kibana is designed for, but are there any existing visualizations or vega components that I've overlooked that would allow me to create such a visualization?

You should look into the LogsUI, it's been built for this specific purpose. But I do think you'll have to ingest the data with filebeat for better formatting of the fields and data.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.