Clever Geek Handbook

Kibana renderings split boxes with dashes in them

I am creating visualizations in Kibana for AWS CloudWatch metrics and am facing the problem of creating metric tables .. Kibana is breaking my fields containing dashes (instance id, scope, etc.)

Instead of having a separate line with an instance id like i-7bb06dzz, it creates 2 lines: i and 7bb06dzz. "i" displays the cumulative count of all other fields. If I add a second region section, this will be duplicated for each character set in the region name, separated by a dash. (us, east and 1 instead of just us-east-1).

I tried to post a screenshot, but my reputation is not high enough to do so. Here are my render settings:

Metrics: Metric (Count)

Aggregations: 
Split Rows: Terms: InstanceID: Top 5: Order by metric:Count
Split Rows: Terms: Region: Top 5: Order by metric:Count

There are no additional settings. I was able to get a sane list by only specifying the InstanceID and excluding the "i" pattern ... however, this is not very useful when I cannot display an area next to it. Both values ​​are indexed as strings and written to ElasticSearch with double quotes around them.

Any advice on how to display the fields as intended would be much appreciated.

+3


source to share


1 answer


This is because Elasticsearch "parses" the field for the individual tokens in it. Logstash will store fields in fields fieldname

and fieldname.raw

- the latter is unparsed and will behave as you expect.



+5


source






More articles:


All Articles