# Graph based on a Value within a String **URL:** \ **Category:** Kibana\ **Created:** [July 30, 2016, 4:06pm UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794 "2016-07-30T16:06:18Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![rider\_nf](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@rider\_nf](https://discuss.elastic.co/u/rider_nf)\ **Post date:** [July 30, 2016, 4:06pm UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/1 "2016-07-30T16:06:18Z")
Hello Community. I am fairly new to Kibana but reading the manuals I got it to a good state so far. I am having a problem which is as follows: I have ELK working and in Kibana I can go to discover and find the following records: Table JSON @timestamp July 30th 2016, 16:54:50.000 t@version 1 t\_id AVY8hAU1XLw-TOW0T-WC t\_index logstash-2016.07.30 #\_score t\_type rpmstats #average\_rtt 523 tdevice\_name MX80-6 #facility 3 tfacility\_label system thost 172.25.90.48 #jitter 0 #loss\_percent 0 tlsp\_name EF1-32158\_mx80-6-mx240-2 #max\_rtt 523 tmessage RPM\_TEST\_RESULTS: test-owner=northstar-lsp test-name=EF1-32158\_mx80-6-mx240-2 loss=0.000000 min-rtt=523 max-rtt=523 avgerage-rtt=523 jitter=0 #min\_rtt 523 #priority 30 tprogram cscript #severity 6 tseverity\_label Informational ttags lsp ttest\_owner northstar-lsp ttimestamp Jul 30 11:54:50 ttype rpmstats As you can see above I have a field called 'message' and in that field I have a "loss=0.000000" ... I would like to create a line chart based on that 'loss' value so that I can graph and track the changed on that ... Can you help ? Thanks Nuno Ferreira ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 31, 2016, 12:31am UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/2 "2016-07-31T00:31:16Z")
You need to extract the field from the message, KB cannot do that for you. Using Logstash will do this for you. ---
**Author:** ![rider\_nf](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@rider\_nf](https://discuss.elastic.co/u/rider_nf)\ **Post date:** [July 31, 2016, 10:03am UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/3 "2016-07-31T10:03:07Z")
Can you give me an example please ? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 1, 2016, 7:06am UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/4 "2016-08-01T07:06:10Z")
Your best bet is to read over [https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html](https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html) and then come back with any other questions 🙂 ---
**Author:** ![rider\_nf](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@rider\_nf](https://discuss.elastic.co/u/rider_nf)\ **Post date:** [August 1, 2016, 5:10pm UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/5 "2016-08-01T17:10:02Z")
Mark, this is my configuration file for this bit is like this: cat /etc/logstash/conf.d/rpm.conf input { syslog { port =\> 1514 type =\> 'rpmstats' } } filter { if ([type] == 'rpmstats') { grok { match =\> { "message" =\> "RPM\_TEST\_RESULTS: test-owner=%{USER:test\_owner} test-name=%{NOTSPACE:test\_name} loss=%{NUMBER:loss\_percent} min-rtt=%{NUMBER:min\_rtt} max-rtt=%{NUMBER:max\_rtt} avgerage-rtt=%{NUMBER:average\_rtt} jitter=%{NUMBER:jitter}" } } mutate { convert =\> { "loss\_percent" =\> "float" "average\_rtt" =\> "float" "min\_rtt" =\> "float" "max\_rtt" =\> "float" "jitter" =\> "float" } rename =\> { "logsource" =\> "device\_name" } } } ``` if ([test_owner] == 'northstar-lsp') { mutate { rename => { "test_name" => "lsp_name" } add_tag => ["lsp"] } } else if ([test_owner] == 'northstar-ifl') { mutate { rename => { "test_name" => "interface_name" } add_tag => ["ifl"] } } ``` } output { if ([type] == 'rpmstats') { elasticsearch { hosts =\> ["localhost:9200"] document\_type =\> "rpmstats" } # stdout { # codec =\> rubydebug { metadata =\> "true" } # } ``` } ``` } I wonder if I have to do some different mutation to get the loss in a specific field that I can then graph on ? Thanks a lot for your help .. Nuno ---
**Author:** ![rider\_nf](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@rider\_nf](https://discuss.elastic.co/u/rider_nf)\ **Post date:** [September 2, 2016, 10:00am UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/6 "2016-09-02T10:00:05Z")
Gurus, Based on the above conf, shouldn't I be getting the value loss into the variable loss\_percent ? From what I understand that should be the case. but if the loss comes up as 100% then I get no loss\_percent at all ... Can someone help please ? Thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [September 2, 2016, 12:17pm UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/7 "2016-09-02T12:17:50Z")
What does the stdout show? ---
**Author:** ![rider\_nf](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@rider\_nf](https://discuss.elastic.co/u/rider_nf)\ **Post date:** [September 2, 2016, 2:54pm UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/8 "2016-09-02T14:54:16Z")
In Kibana this is what I'm getting: September 1st 2016, 15:22:22.000 message:RPM\_TEST\_RESULTS: test-owner=northstar-lsp test-name=AF2-42156\_mx80-4-mx240-2 loss=0.000000 min-rtt=1215 max-rtt=1780 avgerage-rtt=1422 jitter=565 @version:1 @timestamp:September 1st 2016, 15:22:22.000 type:rpmstats host:172.25.90.46 priority:30 timestamp:Sep 1 10:22:22 program:cscript severity:6 facility:3 facility\_label:system severity\_label:Informational test\_owner:northstar-lsp loss\_percent:0 min\_rtt:1,215 max\_rtt:1,780 average\_rtt:1,422 jitter:565 device\_name:MX80-4 lsp\_name:AF2-42156\_mx80-4-mx240-2 tags:lsp \_id:AVbmIZxuu-rzbV2JZY2Q \_type:rpmstats \_index:logstash-2016.09.01 \_score: if you see abote the loss is 0 so I get the loss\_percent as 0 as well But below you can see that I have the loss at 100% and the loss\_percent thing just disappears ... September 1st 2016, 15:22:27.000 message:RPM\_TEST\_RESULTS: test-owner=northstar-lsp test-name=AF30-1236\_br1dc1 loss=100.00000 min-rtt=NaN max-rtt=NaN avgerage-rtt=NaN jitter=NaN @version:1 @timestamp:September 1st 2016, 15:22:27.000 type:rpmstats host:172.25.90.42 priority:30 timestamp:Sep 1 10:22:27 program:cscript severity:6 facility:3 facility\_label:system severity\_label:Informational tags:\_grokparsefailure device\_name:MX240-2 \_id:AVbmIa3Xu-rzbV2JZY3S \_type:rpmstats \_index:logstash-2016.09.01 \_score: ---
**Author:** ![rider\_nf](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@rider\_nf](https://discuss.elastic.co/u/rider_nf)\ **Post date:** [September 7, 2016, 5:51pm UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/9 "2016-09-07T17:51:09Z")
Anyone can shed a light please ? Thanks ---
**Author:** ![rider\_nf](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@rider\_nf](https://discuss.elastic.co/u/rider_nf)\ **Post date:** [September 19, 2016, 12:39am UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/10 "2016-09-19T00:39:50Z")
To add to the above request I have noticed that when the loss=100.00000 I get a tags:grokparsefailure (as per above message) I have run it through the parser and it doesn't give me any error ... but obviously it is in the real thing I believe is due to some of the variables having a value of "NaN" when they are defined as a float. Can someone help me in hat changes I need to make to have the grok accepting those values ? Thanks ---
**Author:** ![rider\_nf](https://avatars.discourse-cdn.com/v4/letter/r/c4cdca/32.png) [@rider\_nf](https://discuss.elastic.co/u/rider_nf)\ **Post date:** [September 19, 2016, 11:22am UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/11 "2016-09-19T11:22:35Z")
OK I think I managed to get this working 🙂 I changed the message input to WORD and then convert it properly - This allows the grok not to fail which puts the variables in the right place and get things working Cheers ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:38pm UTC](https://discuss.elastic.co/t/graph-based-on-a-value-within-a-string/56794/12 "2017-07-06T13:38:46Z")