Need help to build visualisation in kibana

Hi Team,
I am new to ELK stack. Need help to build visualisation in kibana.

Example of logs:-

[13.09.19 12:56:09:824 CEST] 0000005c SystemOut 12:56:09.824 [Default Executor-thread-31] INFO AdapterImpl - {
"type" : "RESPONSE_TIME",
"message" : null,
"userId" : "1456456",
"userName" : "user",
"customerId" : "1234123",
"serviceEndpoint" : "http://abc.com",
"serviceMethod" : "findproduct",
"status" : "success",
"duration" : "143 ms"
}

I have inserted custom logs in my application for response of different web services. I need to build a visualisation having count of all logs with status "success" and "fail" corresponding to particular serviceEndpoint.

For example:

Service End Point Success Fail

http://abc.com 10 2

Kindly help how to proceed with this.

Hi @Vikas_Thakur,

The most straight-forward way to do that is to create a table visualization with 3 columns: service endpoint, status, document cound. You can do that with the "Data table" visualization. Just go to "Visualize" and create a new data table visualization there. Then add a terms aggregation in the buckets section for the split by service end point and another terms aggregation for split by status.

The resulting data table will look like this:

"Service End Point" "Status" "Count"

http://abc.com success 10
http://abc.com fail 2

While using term aggregation in bucket section, the specific value serviceEndPoint and status are not available. Can you please expand the view and send show me.

If you are using the default mapping, then serviceEndpoint and status are indexed as text fields, but the terms aggregation only works on keyword-indexed fields. You should be able to use serviceEndpoint.keyword and status.keyword for the terms aggregation though - These fields are automatically generated by elasticsearch and are the keyword-indexed version of the actual field of your ingested data.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.