Visualizing fields extracted from logs

Elastic Stack Kibana
1

So I have logs successfully coming in from a remote server into elasticsearch through logstash agents and I am trying to visualize it on kibana.

In the discover tab I see the fields that I have extracted using grok filter --good
However, when i click on visualize tab Piechart -> new search -> split slices -> aggregation -> terms -> field -> ???

I do not the see the fields I have extracted to be able to visualize them.
This is the discover tab

kibana_discovertab.PNG468×721 17.5 KB

this is the visualize tab
image1.JPG2419×3225 2.03 MB

Please help! I am trying to visualize fields i have extracted..

2

The type for your fields hasn't been set correctly. when you look at the fields in discover you see they have '?' next to them which means that the type for those fields isn't set and couldn't be interpreted, or perhaps you have different value types for those fields spread throughout your index.

If you look into properly setting field types using logstash and grok that should give you guidance.

Peace,
Khalah

3

Hi, Thanks for your reply.
the log looks like this:
2016-03-22 00:4110|mayan|searchVendor|2509

below is the grok filter I applied

grok {
match => [ "message", "%{DATE:todaysdate} %{SECOND:seconds}%{NOTSPACE}%{WORD:Username}%{NOTSPACE}%{WORD:Vendorname}%{NOTSPACE}%{BASE16NUM:bytes}" ]
}

I'm not sure how it doesn't match the type?

4

I fixed the problem by refreshing the fields.
Steps:
Kibana.
Settings
Reload field list.