How to query from Kibana or how to logstash my data

Hello ELK experts,

This is my log sample:

WARN [Service Thread] 2016-06-30 14:42:41,538 - G1 Young Generation GC in 211ms. G1 Eden Space: 16894656512 -> 0; G1 Old Gen: 13259744800 -> 13267292200;
My grok pattern using parse above log entry:
Grok Pattern:
CASS_GC_GRACE %{CASS_BASE} %{DATA:msg} in %{INT:time_ms}ms. %{DATA}: %{INT:eden_orig_bytes} -> %{INT:eden_new_bytes}; %{DATA}: %{INT:oldgen_orig_bytes} -> %{INT:oldgen_new_bytes};( %{DATA}: %{INT:survivor_orig_bytes} -> %{INT:survivor_new_bytes};|)

Kibana message showing as like below as I was parsing:

message : INFO [Service Thread] 2018-03-08 13:45:14,609 - G1 Young Generation GC in 288ms. G1 Eden Space: 7012876288 -> 0; G1 Old Gen: 3055767536 -> 3076930544;

My Goal:

I want to see only G1 Young Generation GC in 288ms as one field with name called gc_pause = 288 (this is my gc pause time) and I want to see this as a line graph in my kibana to observer when the gc pause went up.

I am fine to modify at grok pattern or kibana search (I will prefer this) level to achieve my goal.

My Environment details:

filebeat version 6.1.3

I really appreciate your help!


Hey @chandukreddi if you're only see a single field in your Elasticsearch index with the full-text, you'll want to double check your Logstash configuration. The Grok Debugger can help you figure out what might be wrong with your Grok Pattern.

Thanks Brandon! your right after correcting logstash and grok patterns it started working as expected!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.