Display total sum in Kibana Dashboards

[Sherrie]

The following are my log messages: These together with date and time are grouped under "message"

Read 24 records from duplicate error queue into database 30s, 39
Read 22 records from duplicate error queue into database 30s, 22
Read 31 records from duplicate error queue into database 30s, 21

In this, I’m filtering out using the string “duplicate error queue”. Say, it occurs 100 times. Is there any way in Kibana were we can sum up the number of records which is available ?
i.e., for the above example, if we have 3 strings as “duplicate exceptions queue”, my search query should add (24+22+31=77) and provide me output as 3 strings “duplicate exceptions queue” found and the sum is 77.

Is there a way by which we can do this in Kibana ? Could you please let me know whether any option is available to sum up a particular string in Kibana ?

[matw (Matthias Wilhelm)]

Hi

Are you looking for something like this (Table Visualisation embedded in an Dashboard)?

Do you have a possibility to parse your log messages before ingesting into Elasticsearch?

Thx & Best,
Matthias

[Sherrie]

Yes, I'm looking for something like this only. How to we sum up the count here ?

If we have the below logs,

Read 24 records from duplicate error queue into database 30s, 39
Read 22 records from duplicate error queue into database 30s, 22
Read 31 records from duplicate error queue into database 30s, 21

We could get the count of string "duplicate error queue" easily as 3.

But I also want to sum the count of records read - in this case 24+22+31 = 77

Yes, these are pcf log messages; We could parse the messages via logstash.

[matw (Matthias Wilhelm)]

Step 1, I've been using the following test message, so you should use Logstash to extract the number of records:

POST /error-msg/_doc
{
  "message": "Read 24 records from duplicate error queue into database 30s",
  "records": 24 
}

POST /error-msg/_doc
{
  "message": "Read 22 records from duplicate error queue into database 30s",
  "records": 22 
}

POST /error-msg/_doc
{
  "message": "Read 32 records from duplicate error queue into database 30s",
  "records": 31 
}

[matw (Matthias Wilhelm)]

Step2 create a table visualization (Visualize / Create Visualization / Data Table) like this (Coming a count and a sum aggregation)