Statisticals problem

[Sam67000 (Samir)]

Hello EveryOne,

I need your help.
I work on logs telephony and I would like to do statistics with kibana to know the percentage of successful call.

When a call is passed, this line appears :

And when a call doesn't pass, this line appears :

For now I managed to extract all the lines of past calls and put them in a variable. Same for unanswered calls.
But now I don't know how to make statistics.

Please help, THannnks !

[warkolm (Mark Walkom)]

Please don't post pictures of text, they are difficult to read and some people may not be even able to see them.

[Sam67000 (Samir)]

When a call is passed, this line appears :

2017-04-13T10:32:02.546 Int 22000 ##### EI_COF_SICRC04_DistriSortant_STR-v1 - 0071029d90c9b5bf - Appel Campagne : C_PREREC_GLOBAL@AG_PREREC_GLOB Appel : 972826533 Chain ID : 175079311 Ditribution : OK

And when a call doesn't pass, this line appears :

2017-04-13T10:32:16.055 Int 22000 ##### EI_COF_SICRC04_DistriSortant_STR-v1 - 0071029d90c9b643 - Appel Campagne : C_PREREC_GLOBAL@AG_PREREC_GLOB Appel : 617595782 Chain ID : 166259911 Ditribution : KO

[Christian_Dahlqvist]

What do the records in Elasticsearch look like? Which fields have you parsed out?

[Sam67000 (Samir)]

I'm working on logs that looks like this :

I use a multiline filter that parses the documents on each new date.

Then I use a grok filter that stores only the lines that indicate whether the call is OK or KO and which stores them in two variables DAS1 and DAS2.

Here is an example :

[Christian_Dahlqvist]

As Mark mentioned earlier, please do not post images of text. In order to easily analyse this in Cabana, you need to extract the relevant parts of the log message in Logstash. If you e.g. parsed out the OK/KO status into a field called call_status you would be able to build visualisations and dashboards around this.

I would therefore recommend you perform a bit more parsing of your log messages in Logstash.

[Sam67000 (Samir)]

Ok. Soory. This is a part of the log :

2017-04-13T10:31:59.691 Int 22000 ##### EI_COF_SICRC04_DistriSortant_STR-v1 - 0071029d90c9b5bd - Appel Campagne : C_F300@AG_F300 Appel : 648666576 Chain ID : 140197011 Ditribution : OK
_I_I_0071029d90c9b5bd [09:04] OP_XCALL_NO_RESULT: func Exit returns INTERP_STOP(0), go to stop handling
_I_I_0071029d90c9b5bd [01:0a] <<<<<<<<<<<<stop interp
2017-04-13T10:31:59.691 _M_I_0071029d90c9b5bd [10:2f] RStatCallsInQueue update: object <21097>(3908), type CfgDN value 0+0+0, reason
2017-04-13T10:31:59.691_M_I_0071029d90c9b5bd [10:2f] RStatCallsInQueue update: object <1223_CO11740>(1617), type CfgPerson value 0+0+0, reason
2017-04-13T10:31:59.691_M_I_0071029d90c9b5bd [10:2f] RStatCallsInQueue update: object <Place_ES_21097>(1145), type CfgPlace value 0+0+0, reason
2017-04-13T10:31:59.691_I_I_0071029d90c9b5bd [01:08] call (4267125-0000000006ffb890) deleting truly
2017-04-13T10:31:57.195 Int 22000 ##### EI_COF_SICRC04_DistriSortant_STR-v1 - 0071029d90c9b5c0 - Appel Campagne : C_PREREC_GLOBAL@AG_PREREC_GLOB Appel : 972825082 Chain ID : 174568111 Ditribution : OK
_I_I_0071029d90c9b5c0 [09:04] OP_XCALL_NO_RESULT: func Exit returns INTERP_STOP(0), go to stop handling
_I_I_0071029d90c9b5c0 [01:0a] <<<<<<<<<<<<stop interp
2017-04-13T10:31:57.195_M_I_0071029d90c9b5c0 [10:2f] RStatCallsInQueue update: object <1760_CO05077>(827), type CfgPerson value 0+0+0, reason <no cal

[Christian_Dahlqvist]

You will need to define parsing of these events in your Logstash config, e.g. by using a grok filter, so you may want to continue the discussion and follow Magnus' advice in the topic you have open under the Logstash category.