Creating a VM Status Table - Visualization

[stevenmarrocco]

I'm trying to create a status table dasboard. This table will consist of the following columns:

Process ID | Next Schedule Run | VM Status | Process Status | Reasonable Duration (Will require some logic)

The columns will be populated using 3 Index Parameters and will require a group-by clause

1. heartbeat
2. winlogbeat
3. logbeat

These columns are to update every X minutes and should change colors depending on Status (e.g., VM Status: Red: offline, Green: Online

I've read a few posts on here that I wont be able to achieve this using visualizations.

I'm wondering if anyone knows if there is a plugin or tool I can use to achieve this type of dashboard in Kibana? Could this been done with Vega?

Thank you.

[LeeDr (Lee Drengenberg)]

I think you could get the table you're looking for. You're probably loading time-based data right now. I suggest you consider also loading another index with your VM data which is not time-based. Instead this index would use update. You would have one doc in this index per VM (or some unique id). I'm not sure what you're using to load the data into Elasticsearch but if you describe that I might be able to offer some more tips.

Once you have that data in Elasticsearch it would be easy to create the table in Discover and you can use field formatting to show colors on the values. Discover can auto-refresh at some interval.

[stevenmarrocco]

Hi LeeDr,

Thank you. I'm glad to hear there is a possibility. For the loading of data we are using:

1. heartbeat
2. winlogbeat
3. logbeat

I did not know it was possible to create a table in Discover, I thought this had to be done in Visualization. I'll look into field formatting. If you would like an example of the data itself, I can provide that also.

Thanks!

[LeeDr (Lee Drengenberg)]

It looks like the beats don't have a way to do updates. So you would have to have your beats (or only the ones where you want a current status index) to Logstash and let it write to your Elasticsearch.

Here's one other post where a user is doing updates;

Logstash Update a document in elasticsearch

Trying to update a specific field in elasticsearch through logstash. Is it possible to update only a set of fields through logstash ? Please find the code below, filter { csv { separator => "|" columns => ["NAME","ID","COUNTRYNAME","DATE","STATECODE", "G_NAME","G_ID","G_COUNTRYNAME"," G_DATE","G_STATECODE"] } ruby { code => " hash = event.to_hash hash.each do |k,v| if v == nil event.remove(k) end end " } } We are using the above configuration when we use this the null value fi…

and another;

Updating documents with Elasticsearch output

I'm trying to figure out how to update documents properly using the Elasticsearch output. Documentation on this issue is very confusing. I have a document that might already be in Elasticsearch, and if so I would like to update it. Going over the documentation I see that there are multiple options for updating documents. So for example this is my current configuration: if [doc_id] { elasticsearch { hosts => ["http://elastic:9200"] document_type => "log" document_id => "%{doc_id}…

I'm sorry that neither of those seems very clear.

If you want to post some data I could see if there's a way to get the table you're looking for without having to use Logstash to create another index.