The Test area within my organisation has implemented ELK. The main purpose is to capture, analyse and visualise logs produced by an in-house load tool. There are also other 'applications' which feed logs.
I have mainly got by using Dashboards produced by various people, and have also ventured into Discover. My low level of knowledge is pretty much clicking on +/- to add a filter.
I have also managed some basic filters in the Search bar (KQL?), and I am now venturing into Visualize.
My initial attempt is a pie chart, but I have quickly found I need to 'split' the slices using two different fields, those being HTTP.FAIL and HTTPS.FAIL.
NB When there is a failure, these simply contain '1'.
What I want/need to do, is to show the failure reason on the outer ring (fields HTTP_REASON and HTTPS_REASON).
My inner ring is the environment, so I would like a split chart showing;
environment > HTTP/HTTPS Fail > Reason for failure.
Hopefully that makes sense.
I believe I need to aggregate my second split, ie HTTP.FAIL and HTTPS.FAIL, before I can proceed to 'reason'.
I am trying to follow
but the very first line of the example, PUT /logs/_bulk?refresh, illustrates I have no idea what I am doing!
/logs/_bulk looks like a path, and so my basic question is ...how do I identify the path of the data?
If I view Stack Monitoring, I can see that Logstash and Beats are running. I would guess that these have a number of scheduled tasks which have a configuration to determine where the logs are stored????
Is it a clue that within Discover, there is a drop down box that allows me to select different 'sets' of data (I don't know what to call this, as there is no prompt next to the drop down). The choices include filebeat-auditor-, filebeat-functional-, logstash-report-* etc.
I am fairly sure these directly relate to the logs for each 'function', the load test tool being logstash-report, and the functional test logging being filebeat-functional ...but how do I identify the path I need in the PUT statement?
Hopefully the question makes sense!
(I also have no idea what ?refresh does, but I expect I will need additional help with the whole example/query)
NB we are running Version 7.1.1