# How to query from Kibana or how to logstash my data

**URL:** <https://discuss.elastic.co/t/how-to-query-from-kibana-or-how-to-logstash-my-data/123445>\
**Category:** Kibana\
**Created:** [March 11, 2018, 7:22pm UTC](https://discuss.elastic.co/t/how-to-query-from-kibana-or-how-to-logstash-my-data/123445 "2018-03-11T19:22:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![chandukreddi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chandukreddi/32/29241_2.png) [@chandukreddi](https://discuss.elastic.co/u/chandukreddi)\
**Post date:** [March 11, 2018, 7:22pm UTC](https://discuss.elastic.co/t/how-to-query-from-kibana-or-how-to-logstash-my-data/123445/1 "2018-03-11T19:22:35Z")

</div>

Hello ELK experts,

**This is my log sample:**

WARN [Service Thread] 2016-06-30 14:42:41,538 GCInspector.java:256 - G1 Young Generation GC in 211ms. G1 Eden Space: 16894656512 -\> 0; G1 Old Gen: 13259744800 -\> 13267292200;  
My grok pattern using parse above log entry:  
**Grok Pattern:**  
CASS\_GC\_GRACE %{CASS\_BASE} %{DATA:msg} in %{INT:time\_ms}ms. %{DATA}: %{INT:eden\_orig\_bytes} -\> %{INT:eden\_new\_bytes}; %{DATA}: %{INT:oldgen\_orig\_bytes} -\> %{INT:oldgen\_new\_bytes};( %{DATA}: %{INT:survivor\_orig\_bytes} -\> %{INT:survivor\_new\_bytes};|)

**Kibana message showing as like below as I was parsing:**

message : INFO [Service Thread] 2018-03-08 13:45:14,609 GCInspector.java:284 - G1 Young Generation GC in 288ms. G1 Eden Space: 7012876288 -\> 0; G1 Old Gen: 3055767536 -\> 3076930544;

**My Goal:**

I want to see only G1 Young Generation GC in 288ms as one field with name called gc\_pause = 288 (this is my gc pause time) and I want to see this as a line graph in my kibana to observer when the gc pause went up.

_I am fine to modify at grok pattern or kibana search (I will prefer this) level to achieve my goal._

**My Environment details:**

elasticsearch-6.1.1  
kibana-6.1.3-linux-x86\_64  
logstash-6.1.3  
filebeat version 6.1.3

I really appreciate your help!

Thanks  
Chandra

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [March 12, 2018, 1:45pm UTC](https://discuss.elastic.co/t/how-to-query-from-kibana-or-how-to-logstash-my-data/123445/2 "2018-03-12T13:45:42Z")

</div>

Hey @chandukreddi if you're only see a single field in your Elasticsearch index with the full-text, you'll want to double check your Logstash configuration. The [Grok Debugger](https://www.elastic.co/guide/en/kibana/current/grokdebugger-getting-started.html) can help you figure out what might be wrong with your Grok Pattern.

---

<div class="post-metadata">

**Author:** ![chandukreddi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chandukreddi/32/29241_2.png) [@chandukreddi](https://discuss.elastic.co/u/chandukreddi)\
**Post date:** [March 14, 2018, 3:18pm UTC](https://discuss.elastic.co/t/how-to-query-from-kibana-or-how-to-logstash-my-data/123445/3 "2018-03-14T15:18:14Z")

</div>

Thanks Brandon! your right after correcting logstash and grok patterns it started working as expected!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2018, 3:18pm UTC](https://discuss.elastic.co/t/how-to-query-from-kibana-or-how-to-logstash-my-data/123445/4 "2018-04-11T15:18:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.