Making a visualisation from multiple searches

Gjanger · October 30, 2015, 2:03pm

Hi,
I played with kibana for the past 5 days but I'm unable to find how to do what I want, I'm starting to think that it's not possible

I have a huge log file that look like data

A logstash forwarder is sending it to logstash and logstash is feeding it to Elasticsearch.
My logstash is configured this way :

multiline {
    pattern => "^%{GREEDYDATA}.%{GREEDYDATA}.%{GREEDYDATA}Exception:"
    what => "previous"
    }

grok {


    match => [
            #general
            "message", "<(?<log_date>%{TIMESTAMP_ISO8601})> <%{GREEDYDATA:sender}> <%{GREEDYDATA:level}> <%{GREEDYDATA:class}> <%{GREEDYDATA:id}> <%{GREEDYDATA:msg}>",
            #general stacktrace
            "message","<(?<log_date>%{TIMESTAMP_ISO8601})%{GREEDYDATA:sender}>%{GREEDYDATA:stacktrace}"
            ]
    }


date {
    match => ["log_date","YYYY-MM-dd HH:mm:ss,SSS"]
    target => "log_date"
    }

I'm interested in 3 lines of log
1 : msg = Sending to ELK
2 : msg = ELK failure - rejected
3 : msg = ELK failure due to us

I find them by searching for msg:"Sending to ELK" for example

So what I want to do is display a line graph with log_date on the x axis and this on the y axis :
(CountMsg1-(CountMsg2+CountMsg3))/(CountMsg1/100)

However in visualise it looks like I can only do one search, not multiple ones and not math operation.

Did I miss something?

Thanks

warkolm · October 31, 2015, 11:26pm

Nope, you can't do it this way yet.
You may be able to with a scripted field though.