I have a typical ELK stack, and am a huge fan of Kibana for analysing structured logs like e.g. Apache access logs. I can draw graphs to my hearts content showing real time performace of our webservers which is awesome.
However it doesn't work so well for reading unstructured logs. These could be logs from anywhere (e.g. /var/log/messages, Tomcats' catalina.out etc), that need to be read more as a traditional log file with a sequential sequence of messages rather than independent events.
Is there anyway within Kibana, or another front end to Elasticsearch, that can do something like the following:
- Use attributes on logs (e.g. filename, hostname, etc) to find a specific log file.
- Scroll back and forwards through this log file as if it was being read in a normal text editor.
- Find and highlight search terms within the file.
- Ideally this search would show all the results, and then you could click each result to drill into the logfile where it was found.
(I've posted this in the "Logstash" forum rather than "Kibana" because I'm interested in any tools that can do this, not just Kibana)