Help visualising uptime data in Kibana

Hi - I am ingesting uptime messages from some custom code that provides me with

UptimeXML=<nus><s u="true" s="1585627182" e="1585627182"/></nus>

's' is the start of an uptime period and 'e' is the end of that same period. Periods can be of different durations.

From this, I can use logstash to parse out the start and end epoch time of an 'up period'.

I don't get anything for 'down periods' - they are implied by their absence.

Using these events I would like to plot an 'uptime visualization' in Kibana - line or bar - showing the uptime periods above the horizontal axis and the implied downtime periods on the horizontal axis. Time running normally from left to right.

I am struggling to see how to do that - any bright sparks out there able to point me in the right direction so I can make a start?

Many thanks

Hi and welcome back!

So when I hear about update messages, I think of a server frequently sending messages to Elasticsearch, and you could use a date histogram to visualize those messages. the down periods would be the gap. But your system is different, you don't get the messages frequently, but in a kind of bulk, with an start and and end, that can be unlike the example you provided differently, do I understand this correctly?

thx & best,
Matthias

Hi Matthias - Thanks for the message!

yes, a perfect description of what I am getting.

Happy that the downtime will appear as 'gaps' but really strugging to see how I go about creating events from logstash that will allow me to visualise the uptime periods which come in with both a start and stop time?

You could use the logstash ruby filter to analyze the input record, and to generate additional events if necessary:

https://www.elastic.co/guide/en/logstash/current/plugins-filters-ruby.html

so if you want an uptime record every 5 seconds, and you get an record with a duration of 10s, you could add another record with a timestamp + 5s. then it would be easy to build a visualization.

Best,
Matthias

Thanks Matthias

I wondered if regenerating 'normal' uptime events might be the way to go. I'll have a play - appreciate your pointing me in the right direction and its good to know I'm not missing something really obvious!

Thanks again,

John

1 Like

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.