Need help to build visualisation in kibana

[Vikas_Thakur]

Hi Team,
I am new to ELK stack. Need help to build visualisation in kibana.

Example of logs:-

[13.09.19 12:56:09:824 CEST] 0000005c SystemOut 12:56:09.824 [Default Executor-thread-31] INFO AdapterImpl - {
"type" : "RESPONSE_TIME",
"message" : null,
"userId" : "1456456",
"userName" : "user",
"customerId" : "1234123",
"serviceEndpoint" : "http://abc.com",
"serviceMethod" : "findproduct",
"status" : "success",
"duration" : "143 ms"
}

I have inserted custom logs in my application for response of different web services. I need to build a visualisation having count of all logs with status "success" and "fail" corresponding to particular serviceEndpoint.

For example:

Service End Point Success Fail

http://abc.com 10 2

Kindly help how to proceed with this.

[flash1293 (Joe Reuter)]

Hi @Vikas_Thakur,

The most straight-forward way to do that is to create a table visualization with 3 columns: service endpoint, status, document cound. You can do that with the "Data table" visualization. Just go to "Visualize" and create a new data table visualization there. Then add a terms aggregation in the buckets section for the split by service end point and another terms aggregation for split by status.

The resulting data table will look like this:

"Service End Point" "Status" "Count"

http://abc.com success 10
http://abc.com fail 2

[Vikas_Thakur]

While using term aggregation in bucket section, the specific value serviceEndPoint and status are not available. Can you please expand the view and send show me.

[flash1293 (Joe Reuter)]

If you are using the default mapping, then serviceEndpoint and status are indexed as text fields, but the terms aggregation only works on keyword-indexed fields. You should be able to use serviceEndpoint.keyword and status.keyword for the terms aggregation though - These fields are automatically generated by elasticsearch and are the keyword-indexed version of the actual field of your ingested data.