Scripted fields in kibana for regex

Elastic Stack Kibana
1

doc1:
message: Reconciliation for plan 141 - Line 3 is completed

This is my case in a index
doc2:
message: Reconciliation for plan 141 - Line 3 is started

doc3:
message: Reconciliation for plan 141 - Line 3 is Failed

Each document will be having a "message" field with messages as described above.
In this case, I need to use scripted field in kibana to distinguish between which line is started and which lines are failed and which line is competed so that I can visualize and identify.

SO I need to write a query in scripted field in order to visualize. How to aggregate and how can i visualize it?

2

I would recommend extracting this into a separate fields at index time as it will require you to do much less work for every query and therefore scale and perform much better.

3

Could you elaborate a bit with an example?

4

It depends on how you are indexing data, but you could use Logstash to parse out this data.

5

Eventhough if i split the data into two pieces, for example

doc1:

message1: Reconciliation for plan 141 
message2: Line 3 is completed

doc2:

message1: Reconciliation for plan 141 
message2: Line 3 is started

doc3:

message1: Reconciliation for plan 141 
message2: Line 3 is failed

In this case how can i compare and how can i visualize?

6

Parse our the status (‘started’, ‘failed’, ‘completed’) into a separate field and then aggregate on this.

7

Nope.. There will be multiple documents that contain different Line. for example line 4, line 5, line 6 and so on. So I need to check which line has started, failed and completed.

8

It might help if you can provide a complete example of what the data looks like and what you are looking to do.

9

doc1:

message: Reconciliation for plan 141 Line 3 is completed

doc2:

message: Reconciliation for plan 141 Line 3 is started

doc3:

message: Reconciliation for plan 141 Line 3 is failed

doc4:

message: Reconciliation for plan 190  Line 10 is failed

doc5:

message: Reconciliation for plan 200 Line 17 is completed

.
.
.
It will keep on going like this.
In the above you can see that Line number and Plan id varies.
This is my case. When the "Line number" and "plan id" varies for every document and for every line number , it will show the the status as line 15 started, line 15 failed and similarly line 120 started, line 120 completed as you can see above in the message field.
In this case how can i aggregate all line numbers and how can i find the respective status?.

How can i visualize and differentiate?

10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.