Hello,
I integrated my syslog-ng with Elasticsearch + Kibana and I want to show the count of denied and allowed connections in a pie.
So I created a new visualization for a pie, then splitted the slice twice and selecting a filter.
The first slice should filter the following entries:
SOURCE:router and MESSAGE:*DENY*The second slice should filter this:
SOURCE:router and MESSAGE:*ALLOW*The problem is, only the count for the first query is being displayed. No matter how I order things, just the first query entered in a freshly created visualization is being displayed.
On the Discover page I can find hundreds of entries for both queries.
How to debug this kind of problem?
