How to create a new field for the data which does not exist in logs

Elastic Stack Kibana
1

I am trying to analyze few job logs. My job log contains Job names with information on completed/started/failed status of Jobs .

Now if a job is not run that will not appear in the Logs. But I want to have a dashboard which lists job which are not run yet.
the problem is , in logs, if a job is not run, neither its name or the status will appear. then how to I show my job in the visualisation as NOT-STARTED.

2

Hi @shikhar_singh,

Looks like what you need is scripted field that would return status if it exists and NOT-STARTED if it doesn't.

Best,
Oleg

3

@azasypkin thanks for the quick response,

Will it work even when the job name does not even exist in the Logs?
I will elaborate more - One of my Control has 8 jobs in it , I can see those jobs which are completed/started/failed , I can see those because those job names appear in the logs with these statuses.

but my control is showing completed in the the pie chart visualisation as 6 jobs completed, in fact its not , but my pie chart has no idea about the remaining two jobs. how will I map the job names which don't exists in search ( logs) with a scripted field which says NOT-STARTED.

4

Hi @shikhar_singh,

I think I'm not entirely understand what type of data you have to give you a good advice. Can you, maybe, share these 8 raw log records here and the form you'd like to transform them into?

Best,
Oleg

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.