Fleet : Visualizing Synthetic logs

Elastic Observability
1

Hello,

I added a synthetics integration and I can see the Uptime monitor but I want to create a visualization with this data. How can I easily select the data I want to show?

I'm trying to add different filters to isolate the datastream type and name without success.

Thanks

2

Hi @Gustavo_Llermaly,

Apologies for the belated reply. Please have a look on the feature Exploratory data visualizations and see if this is what you are looking for.

In the upcoming releases, data shown in Uptime will have even more links to the Exploratory View, which will visualize only one or more metrics of that monitor, while also allowing the user to add more series.

Let us know if you have further questions.

3

Thanks Abdul,

I'm having a hard time trying to generate heartbeat visualizations outisde Uptime view because as you know we only need to grab the last event sort by @timestamp to know the current status.

The exploration data visualizations link is very useful but it doesnt include the chart that mentions if the monitor is up or down only. How can I generate this one to put it in my dashboard?

Thanks

4

I see your point @Gustavo_Llermaly. In some of the other charts, we do provide "Open in Lens" link to open a particular chart in Lens where that visualization can then be customized and added to a dashboard. I'll create an enhancement request to have that link for "Pings over time" chart in Uptime as well.

However, to recreate the "Pings over time" visualization for a particular monitor (or monitors if that's desired) should be fairly simple in Lens. I am summarizing the steps below:

  1. Find the Monitor ID from Uptime monitor details page.
  2. Goto Lens and choose the heartbeat-* (or synthetics-* in newer versions) index.
  3. Filter records by desired monitor.id and synthetics.type : "heartbeat/summary" as we are only interested in those records containing "up" and "down" statuses.
  4. Drag @timestamp field into Lens. Adjust the time range if needed.
  5. Drag monitor.status onto right sidebar of Lens under Break down by section.
  6. You should now have the "Pings over time" visualization recreated.
  7. When happy with the result, save the visualization.

If changing the series colors are desired, that can also be done. The following two screencasts demonstrates how that can be done. The first screencast repeats what is mentioned above. The second demonstrates how to have more granular series with custom colors and names.

How to re-create "Pings over time" chart:

How to customize series and colors:

Hope that helps, do let us know if you need further help.

5

Thanks @abdulz !! awesome explanation. in your example is better to use filters instead of the searchbar to filter the documents or is the same?

6

As far filtering monitors is concerned (on the Uptime page), whichever brings you the desired monitors in the list, works. Applying filters is handy if you are looking for monitors of specific type or monitors testing a port, for instance. So, in this case it's the same whether you zero in on the concerning monitor(s) by a text query or via filters.

To filter documents for visualizations (in Lens or other places), it's better NOT to use free style text searches.