Set up Discover to mimic the look of journal

[sasser (David Bozovic)]

Hi guys. Is it possible to set Kibana up in a way that resembles the way journalctl displays logs? So rather than showing the latest ones at the top, it shows them at the bottom? Also, is it possible to make the "boxes" or "cards" surrounding each log record disappear, making the logs have that journalctl look to them? Many people at the company cannot get used to Elastic, so I am trying to see if it's possible to make it at least resemble journalctl in some way.

Thanks in advance,
David

[RainTown (Kevin Maguire)]

welcome to the forum David. You didn't mention which version you are on.

In kibana --> Discover you can choose which field it sorts on, and in which direction. In my standard view, I am using 9.x, there is "New-Old" and "Old-New", with a up and down arrow icon, see:

As to the journalctl comparison, maybe a screenshot here might help. I dont really understand what you want. Maybe it's clearer for others?

For me jornalctl is a terminal tool, typically used as input into a pipe to ... well, other shell commands to look for/select/sort stuff. e.g. here's my last 10 lines for one of linux systems:

Note the columns aren't aligned after the first couple, it's B&W as thats my terminal theme, ... With bit of effort you can get the Kibana columns in the same order, but I doubt its ever going to really "feel" like its a terminal output.

[sasser (David Bozovic)]

Hi Rain,
I am running version 9.0.2. I just discovered that some of the requirements I wanted I was able to apply via the stack management > advanced under Discover tab, where I was able to put the default order as Ascending and default page being 500 rows. That kind of gives it a journal-like feeling. When I say journal-like feeling I mean that the way the output appears, we have logging in our app which gets sent to journal and they access them as such. Granted, elastic doesn't provide real-time updates, but it will make them that much more comfortable if at least the output comes out in a similar way (They couldn't get used to the newest entries being on top, and the @timestamp field that I wasn't able to hide until I found the option in the aforementioned path).

My last question is:

Take a look at the image. There is this border around each entry that I hover over. Is it possible to make it so that these borders do not exist, and maybe have less empty space around them? Putting "Body cell lines" to 1 seems to give nice results, but is this change persistent if I for example save the discover session with this or will I or someone else have to set it up every time they use Discover?

Thank you in advance,

[RainTown (Kevin Maguire)]

Thanks for clarifying David.

Seems your users want a very specific, clean terminal-style look. Good luck.

[Davis_McPhee]

Hi @sasser, closely mimicking the terminal look and feel isn't very feasible given the differences in the tools, but as you've found, you can customize some of the defaults to get a bit closer to what you want. There also isn't really a good way to disable the border on hover without something hacky like custom CSS overrides in the browser. It's a default data grid style in Kibana and exists for usability and accessibility.

Regarding your other question about row heights:

Putting "Body cell lines" to 1 seems to give nice results, but is this change persistent if I for example save the discover session with this

Yes this is possible. If you change the row height for a search and save it as a Discover session, other users will get the same height by default when opening it.

Similar to some of the other settings you found, you can also change the default for this in Advanced Settings with discover:rowHeightOption. This will set the default row height for all users in Discover, except when opening a Discover session that has a custom row height saved: