0

I have an application log file consists of following log levels: INFO, WARN, ERROR, DEBUG. Following filter criteria works fine in logstash config file:

filter {
    grok {
        match => { "message" => "%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log-level}  \[%{DATA:thread_name}\]?-\[%{DATA:class}\] %{GREEDYDATA:message}" }
    }
    date {
        match => ["timestamp", "yyyy-MM-dd HH:mm:ss,SSS"]
        target => "@timestamp"
    }
}

output {
    elasticsearch { hosts => ["localhost:9200"] }
    stdout { codec => rubydebug }
}

I can see log-level field in "Discover" view of Kibana. However, I would like to visualize my app log as following: Split a vertical bar at a given moment to show how many ERROR logs, how many INFO logs, etc. are hit at a given moment. When I go to "Visualize" tab and try to do "Add sub-buckets", "split bars" on X-axis, sub-aggregation="Terms"; I cannot see the field: "log-level" under the selectable "Field" options. Could you please help me to split the bars based on log-level? Thanks.

Murat
  • 335
  • 4
  • 15

1 Answers1

0

After refreshing the field list, it worked. On Kibana UI: Management -> Index Patterns -> click on "Refresh field list" button

Murat
  • 335
  • 4
  • 15