Unable to use TSVB visualization even after specifying index

Elastic Stack Kibana
1

I'm trying out TSVB viz on kibana, and the visualization doesnt work as expected . Are there any rules to creating a TSVB viz ? like use a particular date format or visualize only a certain data pattern ?

Screen Shot 2021-07-22 at 1.53.32 AM
Screen Shot 2021-07-22 at 1.53.32 AM2846×1234 166 KB

2

Hi, does it renders data if the interval is set to auto?

3

Unfortunately it doesn't render data ,even if the interval is set at auto . Should the interval be reduced ? or increased ?

4

okay fixed it , it came once i added the @timestamp back in logstash . Can we replace the value in @timestamp to the timestamp on the log ?

5

I think so, but depends if the field is mapped correctly as date
can you share the output of curl -XGET <es_url>/logstash_viz/_mappings so we can check the correct type for theTime_UTC field
Can you also please send an example value from that field?

6

I changed the mapping a few minutes ago and now able to redirect the value to @timestamp using date filter .

 curl -XGET http://172.26.207.164:9200/logstash_viz/_mappings 
{"logstash_viz":{"mappings":{"properties":{"@timestamp":{"type":"date"},
"GM_CPU_Percentage":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},
"GM_Hour:Min:Sec":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"GM_Month/Day":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"GM_Suspend_Flag":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"GM_month/Day":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}},"Ghostmon_log_filename":{"type":"text","fields":{"keyword":{"type":"keyword","ignore_above":256}}}}}}}

checked output here

{
              "GM_Time" => "07/22 09:07:40",
    "GM_CPU_Percentage" => "81.5",
           "@timestamp" => 2021-07-22T09:07:40.000Z
}

the log line that was parsed :-

[07-22 09:07:40 I    systeminfo.cpp: 394] cpu usage = 81.5%
7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.