# How to create new visualisation component from fields dissected from log in logstash?

**URL:** https://discuss.elastic.co/t/how-to-create-new-visualisation-component-from-fields-dissected-from-log-in-logstash/280381
**Category:** Kibana
**Tags:** elastic-stack-monitoring, docker
**Created:** [August 4, 2021, 4:16am UTC](https://discuss.elastic.co/t/how-to-create-new-visualisation-component-from-fields-dissected-from-log-in-logstash/280381 "2021-08-04T04:16:43Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![ckong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ckong/32/76928_2.png) [@ckong](https://discuss.elastic.co/u/ckong)
#### Post date: [August 4, 2021, 4:16am UTC](https://discuss.elastic.co/t/how-to-create-new-visualisation-component-from-fields-dissected-from-log-in-logstash/280381/1 "2021-08-04T04:16:43Z")

</div>

Hi, I am currently into Elasticsearch.  
I created a filter inside logstash.conf to extract several fields from log message.

**File path:**  
/usr/share/logstash/pipeline/logstash.conf:

Configuration:

```auto
input { 
	beats {
	    port => 5044
  	}
} 
filter {
    if [container][name] =~ "docker-elk" or [container][name] =~ "docker-jenkins" or [container][name] =~ "rabbitmq" {
        drop { }
    }
    dissect {
        mapping => { "message" => "%{?ts} %{log_level} %{component_name} %{guid} %{msg}" }
    }
}
output { 
	elasticsearch { 
		hosts => "elasticsearch:9200"
		manage_template => false
    	index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
	} 
	
    stdout { codec => rubydebug }
}

```

The fields are available on the discover page.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/0/e010582f57cc76137b80e8d225a78723d30af72d.png)

However , I cannot search those fields on "Dashboard" page when trying to create a new visualisation diagram from those fields.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/8/48ebb98442a760ba9ee0eb45faea96c4b5b8c60c.png)

What should I do to have the fields available when I want to create a new visualisation diagram?

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 4, 2021, 5:58am UTC](https://discuss.elastic.co/t/how-to-create-new-visualisation-component-from-fields-dissected-from-log-in-logstash/280381/2 "2021-08-04T05:58:31Z")

</div>

Hi @ckong welcome to the community.

Quick question what version are you on?

2nd I noticed that your visualization time picker says last 15 minutes, Is the data from the last 15 minutes? If not it would be outside of the visualization time frame and therefore you wouldn't see any fields or data? Make sure your time picker includes the time of your data.

Also it looks like they're using a default mapping meaning you did not define a mapping So your fields we'll have the default mapping which will create both a `text` and `keyword` field.

---

<div class="post-metadata">

### Author: ![ckong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ckong/32/76928_2.png) [@ckong](https://discuss.elastic.co/u/ckong)
#### Post date: [August 4, 2021, 6:14am UTC](https://discuss.elastic.co/t/how-to-create-new-visualisation-component-from-fields-dissected-from-log-in-logstash/280381/3 "2021-08-04T06:14:17Z")

</div>

The version of my elk stack is 7.10.2.

I haved tried different time period and I still can't get those fields.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/4/74afaf3600138a0d20e7cef6857ee6759c85479d.png)

How can I create a mapping for those fields?

---

<div class="post-metadata">

### Author: ![ckong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ckong/32/76928_2.png) [@ckong](https://discuss.elastic.co/u/ckong)
#### Post date: [August 4, 2021, 10:32am UTC](https://discuss.elastic.co/t/how-to-create-new-visualisation-component-from-fields-dissected-from-log-in-logstash/280381/4 "2021-08-04T10:32:26Z")

</div>

After I refresh "Refresh field list", the fields are available.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/3/a3dc5e457848df48b3dee0abc886bd6b1d6c1649.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/2/a2f05c1e1a21e814c7a16d63e973ef1ff96453a2.png)

Thanks for your support @stephenb

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 1, 2021, 10:32am UTC](https://discuss.elastic.co/t/how-to-create-new-visualisation-component-from-fields-dissected-from-log-in-logstash/280381/5 "2021-09-01T10:32:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.