# I can't see diagrams from Mysql

**URL:** <https://discuss.elastic.co/t/i-cant-see-diagrams-from-mysql/123257>\
**Category:** Kibana\
**Created:** [March 9, 2018, 12:00pm UTC](https://discuss.elastic.co/t/i-cant-see-diagrams-from-mysql/123257 "2018-03-09T12:00:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcin.przybylek](https://avatars.discourse-cdn.com/v4/letter/m/67e7ee/32.png) [@marcin.przybylek](https://discuss.elastic.co/u/marcin.przybylek)\
**Post date:** [March 9, 2018, 12:00pm UTC](https://discuss.elastic.co/t/i-cant-see-diagrams-from-mysql/123257/1 "2018-03-09T12:00:15Z")

</div>

Hi,  
I'm new user of ES Stack.  
I've configure Kibana with Elasticsearch, Logstash and filebeat ( on host )

I have Nginx and MariaDB server which I would like to see in Kibana

I see all beats from server in Discover but I have a probolems with Dashboards  
Dashboard for Nginx works well but Mysql not working.

In "Discover" I see log from Mysql but in field message, there is no firled Mysql.xxxx like with Nginx:

Ive got information that grok parse failure

This is my ingest for mysql:

```auto
{
  "description": "Pipeline for parsing MySQL slow logs.",
  "processors": [{
    "grok": {
      "field": "message",
      "patterns":[
        "^# User@Host: %{USER:mysql.slowlog.user}(\\[[^\\]]+\\])? @ %{HOSTNAME:mysql.slowlog.host} \\[(%{IP:mysql.slowlog.ip})?\\](\\s*Id:\\s* %{NUMBER:mysql.slowlog.id})?\n# Query_time: %{
NUMBER:mysql.slowlog.query_time.sec}\\s* Lock_time: %{NUMBER:mysql.slowlog.lock_time.sec}\\s* Rows_sent: %{NUMBER:mysql.slowlog.rows_sent}\\s* Rows_examined: %{NUMBER:mysql.slowlog.rows_exa
mined}\n(SET timestamp=%{NUMBER:mysql.slowlog.timestamp};\n)?%{GREEDYMULTILINE:mysql.slowlog.query}"
        ],
      "pattern_definitions" : {
        "GREEDYMULTILINE" : "(.|\n)*"
      },
      "ignore_missing": true
    }
  }, {
    "remove":{
      "field": "message"
    }
  }, {
    "date": {
      "field": "mysql.slowlog.timestamp",
      "target_field": "@timestamp",
      "formats": ["UNIX"],
      "ignore_failure": true
    }
  }, {
    "gsub": {
      "field": "mysql.slowlog.query",
       "pattern": "\n# Time: [0-9]+ [0-9][0-9]:[0-9][0-9]:[0-9][0-9](\\.[0-9]+)?$",
       "replacement": "",
       "ignore_failure": true
    }
  }],
  "on_failure" : [{
    "set" : {
      "field" : "error.message",
      "value" : "{{ _ingest.on_failure_message }}"
    }
  }]
}

```

This is line of my mysql-slowlog:

//# Time: 180309 12:58:07  
//# User@Host: user[user] @ HOST [IP]  
//# Thread\_id: 91244 Schema: database QC\_hit: No  
//# Query\_time: 0.000603 Lock\_time: 0.000201 Rows\_sent: 1 Rows\_examined: 0  
// Rows\_affected: 0  
//SET timestamp=1520596687;  
//SELECT ................................FROM table;

What a problem is with it?

---

<div class="post-metadata">

**Author:** ![Andrew\_Cholakian1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrew_cholakian1/32/3612_2.png) [@Andrew\_Cholakian1](https://discuss.elastic.co/u/Andrew_Cholakian1)\
**Post date:** [March 9, 2018, 11:11pm UTC](https://discuss.elastic.co/t/i-cant-see-diagrams-from-mysql/123257/2 "2018-03-09T23:11:38Z")

</div>

Have you tried debugging the pattern with [https://grokdebug.herokuapp.com/](https://grokdebug.herokuapp.com/) ?

I'm not familiar with slowlogs, but if they're greater than one line you'll need to read [https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html) to learn how to handle them correctly.

---

<div class="post-metadata">

**Author:** ![yaauie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yaauie/32/23363_2.png) [@yaauie](https://discuss.elastic.co/u/yaauie)\
**Post date:** [March 9, 2018, 11:38pm UTC](https://discuss.elastic.co/t/i-cant-see-diagrams-from-mysql/123257/3 "2018-03-09T23:38:36Z")

</div>

Assuming that you have already configured Filebeat to treat the entirety of a [multiline message as a single event](https://www.elastic.co/guide/en/beats/filebeat/current/multiline-examples.html), I've noticed a couple problems with the grok pattern against that input:

- Perhaps just a side-effect of pasting the configuration in Discuss, but the literal newline characters in the pattern may be throwing things off (e.g., between `Query_time: %{` and `NUMBER:my`; between `rows_exa` and `mined}`
- The pattern expects your slowlog entry to start with the literal string `# User@Host:` (it is anchored by `^`, which in regular expressions and grok patterns is a beginning-of-input anchor), but it starts with `# Time:`; this could cause the message not to match the pattern.
- The pattern also doesn't seem to have a way of capturing the `Thread_id` line; it looks like it expects the `User@Host` line to be immediately followed by a `Query_time` line.
- The pattern doesn't account for the `Rows_affected` line, expecting the `Query_time` line to be immediately be followed by an optional `SET timestamp` line and the greedy-multiline.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2018, 11:38pm UTC](https://discuss.elastic.co/t/i-cant-see-diagrams-from-mysql/123257/4 "2018-04-06T23:38:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.