# Kibana queries and Dashboard for rsyslog data

**URL:** <https://discuss.elastic.co/t/kibana-queries-and-dashboard-for-rsyslog-data/163982>\
**Category:** Kibana\
**Created:** [January 12, 2019, 7:07am UTC](https://discuss.elastic.co/t/kibana-queries-and-dashboard-for-rsyslog-data/163982 "2019-01-12T07:07:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![velpulap](https://avatars.discourse-cdn.com/v4/letter/v/4da419/32.png) [@velpulap](https://discuss.elastic.co/u/velpulap)\
**Post date:** [January 12, 2019, 7:07am UTC](https://discuss.elastic.co/t/kibana-queries-and-dashboard-for-rsyslog-data/163982/1 "2019-01-12T07:07:59Z")

</div>

Hi,

I'm new baby for ELK.

We have demo to show case the central logging using ELK Solution.

We have been provided with a small demo environment.

And our monitoring solution is Check\_MK.

There are some machines like VMware and Nexenta Storage which don't have Check\_MK agent installed, so these machines logs are forwarded to Logstash using rsyslog and we are able to see the indexes in Kibana.

There are some windows machines which have Check\_MK agent, for which CMKbeat is used to get the info from Check\_MK.

I'm trying to show case a demo to the team for all technologies mentioned above.

I'm have created couple of basic dashboards with sample search like error, warnings.

I think we still have more to fine tune this search and create dashboards.

Could you please help/guide me with sample use cases and example, so that i can try and replicate the same.

Thank you understanding.

---

<div class="post-metadata">

**Author:** ![stiltz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stiltz/32/39714_2.png) [@stiltz](https://discuss.elastic.co/u/stiltz)\
**Post date:** [January 12, 2019, 6:17pm UTC](https://discuss.elastic.co/t/kibana-queries-and-dashboard-for-rsyslog-data/163982/2 "2019-01-12T18:17:16Z")

</div>

If you're looking for some examples there are some on github if you search around. One of the nice examples with the code to support it is the arcsight module in x-pack.  
Code: [https://github.com/elastic/logstash/tree/master/x-pack/modules/arcsight/configuration/kibana/6.x](https://github.com/elastic/logstash/tree/master/x-pack/modules/arcsight/configuration/kibana/6.x)  
Screenshots: [https://www.elastic.co/arcsight](https://www.elastic.co/arcsight)

I used these examples and code to get a better idea of how some of the "advanced" visualizations worked. Your data won't map exactly but it might help give you some ideas and place to start.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 9, 2019, 6:17pm UTC](https://discuss.elastic.co/t/kibana-queries-and-dashboard-for-rsyslog-data/163982/3 "2019-02-09T18:17:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.