Log Data Analysis

[Amol_Singh]

Hi,

I had an issue regarding visualization in Kibana,

1. I had raise time and clear time for log so how can I plot on same time axis
2. And also I want this visualization in window form

for eg :- Raise Time : November 1st 2018, 15:35:52
Clear Time :- November 1st 2018, 15:37:56
for this instance i have a window of 00:02:04

[spalger (Spencer Alger)]

I'm not 100% sure this will work in Kibana, but have you tried indexing the raise/clear times as a date_range type field? https://www.elastic.co/guide/en/elasticsearch/reference/current/range.html

[Amol_Singh]

Hi Spencer,

I had tried but it didn't work ,
Below i had the data which is in csv file had column name :- Raise Time, Clear Time, Node Name and Alarm

In alarm column we have different value, I want to plot this in Kibana but unable to.
I want to plot in such a way
i) On X- axis the Raise time and clear time should be there
II) This should match with our alarm that has raised and cleared

|Raise Time |Clear Time |Node_Name |Alarm|

|2018-11-01 00:31:48|2018-11-01 00:32:28|VNG |OSC OSPF Adjacency Loss|
|2018-11-01 00:31:49|2018-11-01 00:32:01|AID |Optical Line Fail|
|2018-11-01 00:32:21|2018-11-01 00:32:28|AID |OSC OSPF Adjacency Loss|
|2018-11-01 00:39:50|2018-11-01 00:40:14|AID |Gauge Threshold Crossing Alert|
|2018-11-01 00:39:57|2018-11-01 00:40:07|VNG |Gauge Threshold Crossing Alert|
|2018-11-01 00:45:24|2018-11-01 00:46:00|AID |Gauge Threshold Crossing Alert|
|2018-11-01 02:59:03|2018-11-01 02:59:24|DME |Gauge Threshold Crossing Alert |
|2018-11-01 02:59:05|2018-11-01 02:59:14|AID |OSC OSPF Adjacency Loss|
|2018-11-01 02:59:06|2018-11-01 02:59:27|AID |Gauge Threshold Crossing Alert|
|2018-11-01 02:59:39|2018-11-01 03:00:11|AID |Gauge Threshold Crossing Alert|
|2018-11-01 03:05:52|2018-11-01 03:07:56|YPN |OTDR Trace In Progress|
|2018-11-01 03:06:16|2018-11-01 03:07:56|YPN |OSC RFI|
|2018-11-01 03:07:56|2018-11-01 03:08:06|YPN |OSC OSPF Adjacency Loss|
|2018-11-01 03:15:54|2018-11-01 03:16:32|YPN |Gauge Threshold Crossing Alert|
|2018-11-01 03:16:30|2018-11-01 05:42:30|NMM |Loss Of Signal|
|2018-11-01 03:16:38|2018-11-01 03:16:57|YPN |Gauge Threshold Crossing Alert|
|2018-11-01 04:56:27|2018-11-01 04:56:48|DME |Gauge Threshold Crossing Alert |
|2018-11-01 05:04:55|2018-11-01 05:04:56|DME |OSC OSPF Adjacency Loss|
|2018-11-01 05:04:56|2018-11-01 05:04:56|VNG |Loss Of Signal|