Kibana issues on showing results


(Kennedy Kan) #1

I have been making some visualizations on kibana, it runs smooth at first; however, when time goes on, some graphs displayed something not in sense. It displays the message that "No results displayed because all values equal 0".

The problem is it did receives input but can only show results for not raw field.

Figure 1: With raw field for hostname

Figure 2: Without raw field for hostname, however, my machine hostname is called Win-07llqen2sjb, but not 2 machines.


(Lukas Olson) #2

Do you have any filters or searches that would limit the number of results?


(Kennedy Kan) #3

Here is my conf file

input {
  jdbc {
    jdbc_driver_library => "C:\Users\Administrator\Downloads\Microsoft JDBC Driver 4.2 for SQL Server\sqljdbc_4.2\enu\sqljdbc42.jar"
    jdbc_driver_class => "com.microsoft.sqlserver.jdbc.SQLServerDriver"
    jdbc_connection_string => "jdbc:sqlserver://WIN-07LLQEN2SJB\SQLEXPRESS:1433;user=sa;password=********"
    jdbc_user => "sa"
    jdbc_password => "********"
    schedule => "* * * * *"
    statement => "Select servername, total_memory_mb, sql_memory_mb, (sql_memory_mb*100/total_memory_mb) as sql_memory_p from DISK.dbo.memory_activity"
	jdbc_paging_enabled => "true"
    jdbc_page_size => "50000"
  }
}
filter {
}
output {
  stdout {
    codec => rubydebug
  }
  elasticsearch {
    hosts => "172.16.1.209:9200"
    index => "mssql-%{+YYYY.MM.dd}"
    template => "C:/logstash/sql.json"
    template_overwrite => true
  }
}

As seen, I did not make any filtering option.
What does it mean by limitation on searches?


(Lukas Olson) #4

Sorry, I meant to ask if, inside Kibana, you are using the search bar or filters to limit the results that are shown inside the visualization. For example, the following shows me searching for all records that match "lukas" and where the metricset.name is "process":


(Kennedy Kan) #5

No, there still aren't any results. Any filters or searches only work on analyzed field but not raw field.
Is there any limitation on raw field?


(Lukas Olson) #6

If you want to be able to search against your "raw" field, you have to search for the exact text of the raw field, since it isn't analyzed. See this guide for more information:

https://www.elastic.co/guide/en/elasticsearch/guide/current/multi-fields.html


(Kennedy Kan) #7

I have already tried to search for the exact text, but it seems still could not give a proper output.

How about if there is a way that I can trick Kibana to consider the string as a whole word but not separate the whole string into pieces of words?


(Lukas Olson) #8

You would also have to type in the name of the field, like this:

hostname.raw: "07llqen2sjb"


(Kennedy Kan) #9

Yes, I have tried that also, but still not solved


(system) #10