How to exclude same consumer groups from Kibana dashboard

Hi Elastic Team/Members,

I have almost 60 Logstash consumers (with unique consumers ID) in my PROD environment which are consuming from Kafka and sending to cloud, Big data lake and Splunk.

I have created a Kibana dashboard in which I wanted to see only consumers ID which are sending it only to Splunk (in numbers for quick reference and leadership updates) , not to cloud or Big data lake.

Currently it showing all consumers ID with details. I would like to see only consumer id which are sending to Splunk.

I will list out some Consumer ID

connect-kaka-connect-splunk-log source A
connect-kaka-connect-splunk-log source B
connect-kaka-connect-splunk-log source C
connect-kaka-connect-splunk-log source D
connect-kaka-connect-splunk-log source E
connect-kaka-connect-splunk-log source F
connect-kaka-connect-splunk-log source G
connect-kaka-connect-splunk-log source H
connect-kaka-connect-splunk-log source J

spark-352635-bdef- A
spark-352635-bdef- B
spark-352635-bdef- C
spark-352635-bdef- D
spark-352635-bdef- E
spark-352635-bdef- G

slt-archive-consumer group 1
slt-archive-consumer group 2
slt-archive-consumer group 3
slt-archive-consumer group 4
slt-archive-consumer group 5
slt-archive-consumer group 6
slt-archive-consumer group 7
slt-archive-consumer group 8
slt-archive-consumer group 9

Now I want to see only consumer ID that are starting with "connect-kaka-connect-splunk-log source" and would like to exclude "spark-352635-bdef' and "slt-archive-consumer group ".

Kindly help me how can I filter or exclude etc.



Welcome to our community! :smiley:

Generally you would setup Spaces to handle this for you -Spaces | Kibana Guide [8.5] | Elastic

1 Like

Hi Mark,

Here I am not looking for space creation. I do have space for my prod environment and have almost 12 different dashboards for monitoring etc.

As I mentioned earlier I am looking to exclude some consumers. Currently all of them are populating and I wanted to see only splunk consumer ids.

So here I would like to know how to exclude rest of them so I see numbers only for splunk.

Will the filter or query be like - NOT consumer.groupid : splunk or something else

Kindly help

Any help would be much appreciated? Thanks.

Take a look at Kibana Query Language | Kibana Guide [8.5] | Elastic.

consumer.groupid: slt-archive-* will only show things that match that. or Kibana Query Language | Kibana Guide [8.5] | Elastic - NOT consumer.groupid: slt-archive-*