# Designing a Kibana Dashboard to Display Only the "Time" Value

**URL:** <https://discuss.elastic.co/t/designing-a-kibana-dashboard-to-display-only-the-time-value/337599>\
**Category:** Kibana\
**Tags:** elastic-stack-monitoring, dashboard\
**Created:** [July 5, 2023, 4:15am UTC](https://discuss.elastic.co/t/designing-a-kibana-dashboard-to-display-only-the-time-value/337599 "2023-07-05T04:15:52Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![abntkpi](https://avatars.discourse-cdn.com/v4/letter/a/b5a626/32.png) [@abntkpi](https://discuss.elastic.co/u/abntkpi)\
**Post date:** [July 5, 2023, 4:15am UTC](https://discuss.elastic.co/t/designing-a-kibana-dashboard-to-display-only-the-time-value/337599/1 "2023-07-05T04:15:52Z")

</div>

Hello and good time to you all. I receive the following log in Kibana:

64 bytes from 4.2.2.4: icmp\_seq=3 ttl=46 time=116 ms

I want to design a dashboard that only displays the value of "time". I was able to easily accomplish this in GrayLog using extractors, but I couldn't figure out how to implement it in Kibana. I would appreciate your guidance on how I can design a dashboard that shows only the value of "time".

---

<div class="post-metadata">

**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\
**Post date:** [July 5, 2023, 9:01pm UTC](https://discuss.elastic.co/t/designing-a-kibana-dashboard-to-display-only-the-time-value/337599/2 "2023-07-05T21:01:18Z")

</div>

Hi Ahmad. How are you ingesting your data into Elasticsearch?

You would probably want to use something like the [Dissect plugin](https://www.elastic.co/guide/en/logstash/current/plugins-filters-dissect.html) for Logstash or the [Dissect processor](https://www.elastic.co/guide/en/elasticsearch/reference/8.8/dissect-processor.html) in a pipeline for Elasticsearch.

---

<div class="post-metadata">

**Author:** ![abntkpi](https://avatars.discourse-cdn.com/v4/letter/a/b5a626/32.png) [@abntkpi](https://discuss.elastic.co/u/abntkpi)\
**Post date:** [July 12, 2023, 2:21pm UTC](https://discuss.elastic.co/t/designing-a-kibana-dashboard-to-display-only-the-time-value/337599/3 "2023-07-12T14:21:58Z")

</div>

Thank you for your response. I appreciate your guidance. I'm currently using Filebeat on one server to send logs to Elasticsearch, and I'm using Fleet on another server. I will follow your suggestion and try using the Dissect plugin or processor to extract the "time" value. I will let you know if I successfully resolve my issue and achieve the desired result.

---

<div class="post-metadata">

**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\
**Post date:** [July 13, 2023, 2:06pm UTC](https://discuss.elastic.co/t/designing-a-kibana-dashboard-to-display-only-the-time-value/337599/4 "2023-07-13T14:06:04Z")

</div>

Hi Ahmad. I was thinking about this and it looks like you are logging the output from a `ping` command? Obviously I'm not aware of your environment, but you might be able to replicate this more easily with the ICMP monitor available via [Heartbeat](https://www.elastic.co/guide/en/beats/heartbeat/8.8/heartbeat-overview.html). Heartbeat replicates the ICMP `ECHO_REQUEST` and has built-in support for extracting the fields for Elasticsearch.

---

<div class="post-metadata">

**Author:** ![abntkpi](https://avatars.discourse-cdn.com/v4/letter/a/b5a626/32.png) [@abntkpi](https://discuss.elastic.co/u/abntkpi)\
**Post date:** [July 15, 2023, 6:06am UTC](https://discuss.elastic.co/t/designing-a-kibana-dashboard-to-display-only-the-time-value/337599/5 "2023-07-15T06:06:07Z")

</div>

Dear nickpeihl, yes you understood correctly. My log is the output of a ping command. I will try to address the issues you mentioned and will let you know the result.

---

<div class="post-metadata">

**Author:** ![abntkpi](https://avatars.discourse-cdn.com/v4/letter/a/b5a626/32.png) [@abntkpi](https://discuss.elastic.co/u/abntkpi)\
**Post date:** [July 18, 2023, 7:33am UTC](https://discuss.elastic.co/t/designing-a-kibana-dashboard-to-display-only-the-time-value/337599/6 "2023-07-18T07:33:19Z")

</div>

Hello, good time to you!

I have read the links you sent and created a pipeline from the "Stack Management \> Ingest Pipelines" section as follows:

test-PingTime  
Processors  
[  
{  
"grok": {  
"field": "message",  
"patterns": [  
"%{NUMBER:bytes} bytes from %{IP:ip\_address}: icmp\_seq=%{NUMBER:icmp\_seq} ttl=%{NUMBER:ttl} time=%{NUMBER:pingtime} ms"  
]  
}  
}  
]

Failure processors  
[  
{  
"dissect": {  
"field": "message",  
"pattern": "%{bytes} bytes from %{ip\_address}: icmp\_seq=%{icmp\_seq} ttl=%{ttl} time=%{pingtime} ms"  
}  
}  
]

I have created patterns for my desired log in both Grok and Dissect formats. Now, how can I design a dashboard only for pingtime that I specified in the pattern?

---

<div class="post-metadata">

**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\
**Post date:** [July 18, 2023, 2:19pm UTC](https://discuss.elastic.co/t/designing-a-kibana-dashboard-to-display-only-the-time-value/337599/7 "2023-07-18T14:19:00Z")

</div>

Hi Ahmad. You should be able to add the name of your pipeline to your Filebeat config. [See this example](https://www.elastic.co/guide/en/elasticsearch/reference/8.8/ingest.html#pipelines-for-beats).

Then restart Filebeat and as new logs are ingested they are split into fields in your Elasticsearch index. The field names were specified in your pipeline, (e.g. `bytes`, `ip_address`, `icmp_seq`, `ttl`, `pingtime`).

Use a Kibana Data View (or Index Pattern on Kibana \<8.0) matching your Elasticsearch index(es). Then you can view the data in Discover and create a visualization by selecting the field and clicking the "Visualize" button.

Once again I want say how much easier this is by [using Heartbeat](https://www.elastic.co/guide/en/beats/heartbeat/8.8/heartbeat-installation-configuration.html) rather than Filebeat. Heartbeat sets up the Elasticsearch index, the ingest pipeline, and it can replicate the `ping` command so you don't need to parse the output. Heartbeat can even install example visualizations and dashboards in Kibana.

---

<div class="post-metadata">

**Author:** ![abntkpi](https://avatars.discourse-cdn.com/v4/letter/a/b5a626/32.png) [@abntkpi](https://discuss.elastic.co/u/abntkpi)\
**Post date:** [July 24, 2023, 10:09am UTC](https://discuss.elastic.co/t/designing-a-kibana-dashboard-to-display-only-the-time-value/337599/8 "2023-07-24T10:09:50Z")

</div>

Dear Nickpeihl,

I followed the links you provided but didn't get any results. I am surprised how other engineers work with Kibana. This software is very difficult. I don't want to make things difficult with this software; I just want to design a simple dashboard for the time value in the log. I have seen all the websites and YouTube videos, but I have not seen anyone design a dashboard for a specific value in the log. They are either not interested in doing this or regret using Kibana because it is so complicated. I need your help to introduce me to an article or website that has designed a dashboard for a specific value inside a log in Kibana, except for [elastic.co](http://elastic.co), because I am really frustrated with Kibana.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 21, 2023, 10:10am UTC](https://discuss.elastic.co/t/designing-a-kibana-dashboard-to-display-only-the-time-value/337599/9 "2023-08-21T10:10:09Z")

</div>

Closed on August 21, 2023, 10:10am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.