# How can I do log analysis using kibana

**URL:** <https://discuss.elastic.co/t/how-can-i-do-log-analysis-using-kibana/49613>\
**Category:** Kibana\
**Created:** [May 10, 2016, 6:35am UTC](https://discuss.elastic.co/t/how-can-i-do-log-analysis-using-kibana/49613 "2016-05-10T06:35:00Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nitesh](https://avatars.discourse-cdn.com/v4/letter/n/8491ac/32.png) [@nitesh](https://discuss.elastic.co/u/nitesh)\
**Post date:** [May 10, 2016, 6:35am UTC](https://discuss.elastic.co/t/how-can-i-do-log-analysis-using-kibana/49613/1 "2016-05-10T06:35:00Z")

</div>

Hello Team,

Till now what I have implemented.  
**Filebeat(logs)---\>Logstash-----\>Elasticsearch-----\>Kibana**

I can see these logs on kibana dashboard when I make a search \* in discover.

Can you please help me how can I improve search on **dashboard** like:

**1)** I have logs of same file like /mnt/logs/logxyz.log from various different remote machine, so how can I see all these log in same search.

Here I want same logs file from different node to viewed on Kibana.

\*\*2)\*\*How can I apply some analysis based on which I will get graph/diagram showing error. As of now even if there are error in log file and I apply to view pie-diagram/graph diagram it shows all passed. There would be a way I am sure to but I am not sure how to do that.

TIA

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 10, 2016, 7:06am UTC](https://discuss.elastic.co/t/how-can-i-do-log-analysis-using-kibana/49613/2 "2016-05-10T07:06:39Z")

</div>

1. If they are all the same filename, then just search for that filename.
2. That's too hard to answer, if you cannot find the errors in a basic search then how do you graph them? Are you sure you have errors in your logs?

---

<div class="post-metadata">

**Author:** ![nitesh](https://avatars.discourse-cdn.com/v4/letter/n/8491ac/32.png) [@nitesh](https://discuss.elastic.co/u/nitesh)\
**Post date:** [May 10, 2016, 11:14am UTC](https://discuss.elastic.co/t/how-can-i-do-log-analysis-using-kibana/49613/3 "2016-05-10T11:14:15Z")

</div>

Thanks Mark.

Also can you let me know how can I use **OR operator** in search.  
Like eg: I have file name tntracksp.log from 4 different nodes so I want to see it from only host1

Here host1 is the hostname which is also there in logfile so can we write  
**"tntracksp.log" "host1"** in discover search option.

TIA.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [May 10, 2016, 8:50pm UTC](https://discuss.elastic.co/t/how-can-i-do-log-analysis-using-kibana/49613/4 "2016-05-10T20:50:09Z")

</div>

`tntracksp.log AND host1` would be more accurate.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:53pm UTC](https://discuss.elastic.co/t/how-can-i-do-log-analysis-using-kibana/49613/5 "2017-07-06T13:53:43Z")

</div>