Visualization in Elasticsearch

[Karrie_Koo]

abc-log-2019.11.12
abc-log-2019.11.11
abc-log-2019.11.13
abc-log-2019.11.10
abc-log-2019.11.09

If i want to group these logs into abc-log* and show in data table
How could I do?

[Liza_Katz]

Hi Karrie,

This is a classic use case, so that shouldn't be too hard.

In Kibana, you can go to Management and create an Index Pattern with the pattern you specified abc-log*, specifying a timefield (if you have one).
Then you would go ahead to the Visualize application and create a Table visualization where you can construct meaningful aggregations to suit your needs.

Hope this helps.

[Karrie_Koo]

hi Liza,

Thanks for your reply. As there are different kinds of logs, not just abc-log* , it will be complicated for me to create many index patterns.

Indices StoreSize

abc-log-2019.11.12 1234536
abc-log-2019.11.11 123
abc-log-2019.11.13
abc-log-2019.11.10
abc-log-2019.11.09
happy-log-2019.11.12
happy-log-2019.11.11
happy-log-2019.11.13
happy-log-2019.11.10
happy-log-2019.11.09
def-log-2019.11.12
def-log-2019.11.11
def-log-2019.11.13
def-log-2019.11.10
def-log-2019.11.09

I would like to change this to

Indices StoreSize

abc-log* 1234536
happy-log* 45345
def-log* 45674

[Karrie_Koo]

Do u have any ideas for me to fix this problem?