Truncated String field is not showing in kibana visalisation


(Jones Thomas) #1

i trucated the string format in kibana, but the field is not showing in visualisation..
my example log file:
{"LogLevel":"ERROR","Msg":"{\"itemId\":0,\"module\":\"/curie/attendance\",\"action\":\"/getByDate/{organizationId}/{facilityId}/{date}\",\"errorMessage\":\"systems.ellora.core.exception.UnhandledRuntimeException: org.eclipse.jetty.server.handler.gzip.GzipHandler.handle(GzipHandler.java:561)\\r\\n\\tat io.dropwizard.jetty.BiDiGzipHandler.handle(BiDiGzipHandler.java:68)\\r\\n\\tat org.eclipse.jetty.server.handler.RequestLogHandler.handle(RequestLogHandler.java:56)\\r\\n\\tat org.eclipse.jetty.server.handler.StatisticsHandler.handle(StatisticsHandler.java:169)\\r\\n\\tat org.eclipse.jetty.server.handler.HandlerWrapper.handle(HandlerWrapper.java:132)\\r\\n\\tat org.eclipse.jetty.server.Server.handle(Server.java:564)\\r\\n\\tat org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:320)\\r\\n\\tat org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:251)\\r\\n\\tat org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:279)\\r\\n\\tat org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:110)\\r\\n\\tat org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:124)\\r\\n\\tat org.eclipse.jetty.util.thread.Invocable.invokePreferred(Invocable.java:122)\\r\\n\\tat org.eclipse.jetty.util.thread.strategy.ExecutingExecutionStrategy.invoke(ExecutingExecutionStrategy.java:58)\\r\\n\\tat org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.produceConsume(ExecuteProduceConsume.java:201)\\r\\n\\tat org.eclipse.jetty.util.thread.strategy.ExecuteProduceConsume.run(ExecuteProduceConsume.java:133)\\r\\n\\tat org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:672)\\r\\n\\tat org.eclipse.jetty.util.thread.QueuedThreadPool$2.run(QueuedThreadPool.java:590)\\r\\n\\tat java.lang.Thread.run(Thread.java:748)\\r\\nCaused by: org.apache.ibatis.exceptions.PersistenceException: \\r\\n### Error querying database. Cause: java.sql.SQLSyntaxErrorException: Unknown column \\u0027e.uid\\u0027 in \\u0027field list\\u0027\\r\\n### The error may exist in AttendanceMapper.xml\\r\\n### The error may involve AttendanceMapper.selectByDate-Inline\\r\\n### The error occurred while setting parameters\\r\\n### SQL: SELECT e.employeeId, e.uid, e.photoUrl, e.name, e.designation, e.joiningDate, e.salary, e.department, ar.entryId, ar.employeeId, ar.date, ar.inTime, ar.outTime, ar.leaveCapture, ar.reason FROM employee e, attendanceEntry ar,facility f, employeeFacility ef WHERE e.employeeId \\u003d ar.employeeId AND ar.date \\u003d ? AND f.facilityId \\u003d org.apache.ibatis.executor.statement.RoutingStatementHandler.query(RoutingStatementHandler.java:79)\\r\\n\\tat org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:63)\\r\\n\\tat org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:324)\\r\\n\\tat org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:156)\\r\\n\\tat org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:109)\\r\\n\\tat org.apache.ibatis.executor.CachingExecutor.query(CachingExecutor.java:83)\\r\\n\\tat org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:148)\\r\\n\\t... 69 more\\r\\n\",\"parameter\":\"1/1/2015-05-05\"}","Time":"2017-08-18_05:24:38.678"}

i truncated the errorMessage field_length =5 . In kibana discover its showing correctly but in visualization data is not showing...


(CJ Cenizal) #2

Would you mind sharing some screenshots of what you're seeing in Discover and in your visualization?

Thanks,
CJ


(Jones Thomas) #3

Thanks @cjcenizal ,I figured this out..In my case i used Truncate filter. to set length of my string field..

This is my filter:
truncate {
fields => "errorMessage"
length_bytes => 100
}

Thanks,
Jones Thomas


(CJ Cenizal) #4

Thanks for sharing your solution!


(Jones Thomas) #5

Your welcome @cjcenizal.:v:


(system) #6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.