Hi,
I'm using the ELK stack to do some performance monitoring on java methods inside my app. I'm also trying to do some execution time profiling. Thus, I'm storing events in which I have current method name and also some stack trace in form of a path.
ELK stack version: 6.4.1
I'm storing events of this kind for first level methods' calls:
{
"@timestamp": "2018-11-14 14:55:40,674",
"message": {
"current": "iecsmas.Service4Test.doSomething",
"parent": {
"path": "null",
"success": true
},
"executionTime": [40],
"executionTimeSum": 40,
"samples": 1,
"success": true,
"eventType": "apiMonitor"
}
}
where:
- parent.path is always null
- current is current method name (with shortened package name and full class name)
The same event is also used to store callee informations (when available).
The same model can assume these values for callee methods:
{
"@timestamp": "2018-11-14 14:55:40,690",
"message": {
"current": "iecsmas.SubService4Test.doSomethingCorrect",
"parent": {
"path": "iecsmas.Service4Test.doSomething",
"success": true
},
"executionTime": [16, 8],
"executionTimeSum": 24,
"samples": 2,
"success": true,
"eventType": "apiMonitor"
}
}
where:
- parent.path is the caller method or a path o caller methods (with shortened package name and full class name)
- current is current method name (with shortened package name and full class name)
As you can see, the second event is a callee of the first event.
I'm taking in account multiple callee invocations in the same caller execution, within the array of executionTime.
Now, I'm trying to build a dashboard to show single methods' trends and enable some drill down.
First visualization is something like a pie for topmost called methods, usually on first level (ie. with parent.path = null). This should be easily done with a filter on parent.path field and a pie on a terms aggregation on current field.
What I'm failing to achieve is to update parent.path filter by clicking on a pie slice, since slices are populated with current field values. Moreover, for a further drill down I would like to combine parent.path value with current value.
Filter values should be as follow:
First call:
- parent.path = null
Second call, after clicking on iecsmas.Service4Test.doSomething slice
- parent.path = iecsmas.Service4Test.doSomething
Thirc call, after clicking on iecsmas.SubService4Test.doSomethingCorrect
- parent.path = iecsmas.Service4Test.doSomething/iecsmas.SubService4Test.doSomethingCorrect
Is it possible to apply a calculated value in a field filter?