Creating a VM Status Table - Visualization

I'm trying to create a status table dasboard. This table will consist of the following columns:

Process ID | Next Schedule Run | VM Status | Process Status | Reasonable Duration (Will require some logic)

The columns will be populated using 3 Index Parameters and will require a group-by clause

  1. heartbeat
  2. winlogbeat
  3. logbeat

These columns are to update every X minutes and should change colors depending on Status (e.g., VM Status: Red: offline, Green: Online

I've read a few posts on here that I wont be able to achieve this using visualizations.

I'm wondering if anyone knows if there is a plugin or tool I can use to achieve this type of dashboard in Kibana? Could this been done with Vega?

Thank you.

I think you could get the table you're looking for. You're probably loading time-based data right now. I suggest you consider also loading another index with your VM data which is not time-based. Instead this index would use update. You would have one doc in this index per VM (or some unique id). I'm not sure what you're using to load the data into Elasticsearch but if you describe that I might be able to offer some more tips.

Once you have that data in Elasticsearch it would be easy to create the table in Discover and you can use field formatting to show colors on the values. Discover can auto-refresh at some interval.

Hi LeeDr,

Thank you. I'm glad to hear there is a possibility. For the loading of data we are using:

  1. heartbeat
  2. winlogbeat
  3. logbeat

I did not know it was possible to create a table in Discover, I thought this had to be done in Visualization. I'll look into field formatting. If you would like an example of the data itself, I can provide that also.

Thanks!

It looks like the beats don't have a way to do updates. So you would have to have your beats (or only the ones where you want a current status index) to Logstash and let it write to your Elasticsearch.

Here's one other post where a user is doing updates;

and another;

I'm sorry that neither of those seems very clear.

If you want to post some data I could see if there's a way to get the table you're looking for without having to use Logstash to create another index.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.