SlideShare a Scribd company logo
FINDOLOGIC GmbH 
Boring Logfiles → Sexy Dashboards
Boring Logfiles 
178.236.7.219 - - [27/Oct/2014:06:43:13 +0100] "GET 
/ps/amazon.de/index.php?shopkey=DEADBEEF&shopurl=https 
%3A%2F%2Fwww.amazon.de 
%2F&multishop_id=0&userip=173.194.112.2&referer=https 
%3A%2F%2Fwww.amazon.de%2FTechnik 
%2FFernseher&count=0&group[]=2&service=search&query=le 
d HTTP/1.1" 200 12363 "-" "-"
Sexy Dashboards
Stack 
● Elasticsearch 
● Logstash 
● Kibana
Infrastruktur 
App 1 App 2 App 3 
Logstash 1 Logstash 2 Logstash 3 
ElasticSearch 
Kibana
Logstash Architektur 
Input Filter Output 
● Grok 
● Search / Replace 
● Split 
● GeoIP 
● DNS 
● URL-Decode 
● ... 
● ElasticSearch 
● Redis 
● CouchDB 
● ... 
● Pipe 
● Socket 
● File 
● ...
Logstash stand-alone 
● Logs zentralisieren 
● In DB speichern 
● Durchsuchbar machen
Setup 
● Logstash herunterladen, extrahieren 
● Elasticsearch installieren 
● fertig
Georg? 
● CTO bei FINDOLOGIC GmbH 
● http://www.findologic.com 
● g.sorst@findologic.com 
● @piefke_schorsch
Hands on 
● Grok 
● kv 
● Query 
● Endpoint 
● GeoIP
Logstash.conf 
input { 
file { 
path => "/home/georg/coding/logstash-apache/access.log" 
start_position => beginning 
} 
#pipe { 
# command => "ssh frontend1.findologic.com tail -f /var/log/apache2/access.log" 
#} 
} 
filter { 
grok { 
match => { "message" => "%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent}" } 
} 
# split the query string: query=test&count=0&first=10 → request_query: test, request_count: 0, request_first: 10 
kv { 
field_split => "&?" 
source => "request" 
prefix => "request_" 
} 
# urldecode does not decode the + into whitespace so do this manually 
mutate { 
gsub => [ 
"request_query", "+", " " 
] 
} 
# URL-decode the query so it is easier to read. We don't really about the other request_* parameters 
urldecode { 
field => "request_query" 
} 
# extract the script file, eg. index.php 
mutate { 
gsub => [ 
# Remove the query string including the ? : /path/index.php?key=value -> /path/index.php 
"request", "?.*$", "", 
# Remove everything up to the last / : /path/index.php -> index.php 
"request", "^.*/", "" 
] 
} 
# Default to index.php if no script file is given 
if [request] == "" { 
mutate { 
replace => [ "request", "index.php" ] 
} 
} 
# If the IP is syntactically valid resolve it geographically 
if [request_userip] =~ "^d+.d+.d+.d+$" { 
geoip { 
source => "request_userip" 
target => "client_geoip" 
} 
} 
} 
output { 
elasticsearch { 
host => localhost 
} 
#stdout { codec => rubydebug } 
}
Kibana Dashboard 
{ 
"title": "Logstash Search", 
"services": { 
"query": { 
"list": { 
"0": { 
"query": "*", 
"alias": "", 
"color": "#7EB26D", 
"id": 0, 
"pin": false, 
"type": "lucene", 
"enable": true 
}, 
"1": { 
"id": 1, 
"color": "#EAB839", 
"alias": "Suche", 
"pin": false, 
"type": "lucene", 
"enable": true, 
"query": "request:index.php" 
}, 
"2": { 
"id": 2, 
"color": "#6ED0E0", 
"alias": "Autocomplete", 
"pin": false, 
"type": "lucene", 
"enable": true, 
"query": "request:autocomplete.php" 
}, 
"3": { 
"id": 3, 
"color": "#EF843C", 
"alias": "", 
"pin": false, 
"type": "lucene", 
"enable": true, 
"query": "client_geoip.country_code2:DE OR client_geoip.country_code2:AT OR client_geoip.country_code2:CH" 
} 
}, 
"ids": [ 
0, 
1, 
2, 
3 
] 
}, 
"filter": { 
"list": { 
"0": { 
"type": "time", 
"field": "@timestamp", 
"from": "now-24h", 
"to": "now", 
"mandate": "must", 
"active": true, 
"alias": "", 
"id": 0 
}, 
"1": { 
"type": "time", 
"from": "2014-10-27T18:04:33.357Z", 
"to": "2014-10-27T19:18:47.459Z", 
"field": "@timestamp", 
"mandate": "must", 
"active": true, 
"alias": "", 
"id": 1 
} 
}, 
"ids": [ 
0, 
1 
] 
} 
}, 
"rows": [ 
{ 
"title": "Graph", 
"height": "350px", 
"editable": true, 
"collapse": false, 
"collapsable": true, 
"panels": [ 
{ 
"span": 12, 
"editable": true, 
"group": [ 
"default" 
], 
"type": "histogram", 
"mode": "count", 
"time_field": "@timestamp", 
"value_field": null, 
"auto_int": true, 
"resolution": 100, 
"interval": "30s", 
"fill": 3, 
"linewidth": 3, 
"timezone": "browser", 
"spyable": true, 
"zoomlinks": true, 
"bars": true, 
"stack": true, 
"points": false, 
"lines": false, 
"legend": true, 
"x-axis": true, 
"y-axis": true, 
"percentage": false, 
"interactive": true, 
"queries": { 
"mode": "selected", 
"ids": [ 
1, 
2 
] 
}, 
"title": "Events over time", 
"intervals": [ 
"auto", 
"1s", 
"1m", 
"5m", 
"10m", 
"30m", 
"1h", 
"3h", 
"12h", 
"1d", 
"1w", 
"1M", 
"1y" 
], 
"options": true, 
"tooltip": { 
"value_type": "cumulative", 
"query_as_alias": true 
}, 
"scale": 1, 
"y_format": "none", 
"grid": { 
"max": null, 
"min": 0 
}, 
"annotate": { 
"enable": false, 
"query": "*", 
"size": 20, 
"field": "_type", 
"sort": [ 
"_score", 
"desc" 
] 
}, 
"pointradius": 5, 
"show_query": true, 
"legend_counts": true, 
"zerofill": true, 
"derivative": false 
} 
], 
"notice": false 
}, 
{ 
"title": "", 
"height": "350px", 
"editable": true, 
"collapse": false, 
"collapsable": true, 
"panels": [ 
{ 
"error": false, 
"span": 6, 
"editable": true, 
"type": "terms", 
"loadingEditor": false, 
"field": "request_query", 
"exclude": [], 
"missing": false, 
"other": false, 
"size": 10, 
"order": "count", 
"style": { 
"font-size": "10pt" 
}, 
"donut": false, 
"tilt": false, 
"labels": true, 
"arrangement": "horizontal", 
"chart": "pie", 
"counter_pos": "above", 
"spyable": true, 
"queries": { 
"mode": "all", 
"ids": [ 
0, 
1, 
2, 
3 
] 
}, 
"tmode": "terms", 
"tstat": "total", 
"valuefield": "" 
}, 
{ 
"error": false, 
"span": 6, 
"editable": true, 
"type": "bettermap", 
"loadingEditor": false, 
"field": "client_geoip.location", 
"size": 1000, 
"spyable": true, 
"tooltip": "_id", 
"queries": { 
"mode": "selected", 
"ids": [ 
3 
] 
} 
} 
], 
"notice": false 
}, 
{ 
"title": "Events", 
"height": "350px", 
"editable": true, 
"collapse": false, 
"collapsable": true, 
"panels": [ 
{ 
"title": "All events", 
"error": false, 
"span": 12, 
"editable": true, 
"group": [ 
"default" 
], 
"type": "table", 
"size": 100, 
"pages": 5, 
"offset": 0, 
"sort": [ 
"@timestamp", 
"desc" 
], 
"style": { 
"font-size": "9pt" 
}, 
"overflow": "min-height", 
"fields": [], 
"localTime": true, 
"timeField": "@timestamp", 
"highlight": [], 
"sortable": true, 
"header": true, 
"paging": true, 
"spyable": true, 
"queries": { 
"mode": "all", 
"ids": [ 
0, 
1, 
2, 
3 
] 
}, 
"field_list": true, 
"status": "Stable", 
"trimFactor": 300, 
"normTimes": true, 
"all_fields": false 
} 
], 
"notice": false 
} 
], 
"editable": true, 
"failover": false, 
"index": { 
"interval": "day", 
"pattern": "[logstash-]YYYY.MM.DD", 
"default": "NO_TIME_FILTER_OR_INDEX_PATTERN_NOT_MATCHED", 
"warm_fields": true 
}, 
"style": "light", 
"panel_hints": true, 
"pulldowns": [ 
{ 
"type": "query", 
"collapse": false, 
"notice": false, 
"query": "*", 
"pinned": true, 
"history": [ 
"client_geoip.country_code2:DE OR client_geoip.country_code2:AT OR client_geoip.country_code2:CH", 
"request:autocomplete.php", 
"request:index.php", 
"*" 
], 
"remember": 10, 
"enable": true 
}, 
{ 
"type": "filtering", 
"collapse": false, 
"notice": true, 
"enable": true 
} 
], 
"nav": [ 
{ 
"type": "timepicker", 
"collapse": false, 
"notice": false, 
"status": "Stable", 
"time_options": [ 
"5m", 
"15m", 
"1h", 
"6h", 
"12h", 
"24h", 
"2d", 
"7d", 
"30d" 
], 
"refresh_intervals": [ 
"5s", 
"10s", 
"30s", 
"1m", 
"5m", 
"15m", 
"30m", 
"1h", 
"2h", 
"1d" 
], 
"timefield": "@timestamp", 
"now": false, 
"filter_id": 0, 
"enable": true 
} 
], 
"loader": { 
"save_gist": false, 
"save_elasticsearch": true, 
"save_local": true, 
"save_default": true, 
"save_temp": true, 
"save_temp_ttl_enable": true, 
"save_temp_ttl": "30d", 
"load_gist": true, 
"load_elasticsearch": true, 
"load_elasticsearch_size": 20, 
"load_local": true, 
"hide": false 
}, 
"refresh": false 
} 
Vergrößern zum Anzeigen

More Related Content

What's hot

The Aggregation Framework
The Aggregation FrameworkThe Aggregation Framework
The Aggregation Framework
MongoDB
 
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
MongoDB
 
IE9에서 HTML5 개발하기
IE9에서 HTML5 개발하기IE9에서 HTML5 개발하기
IE9에서 HTML5 개발하기
Reagan Hwang
 
JQuery Flot
JQuery FlotJQuery Flot
JQuery Flot
Arshavski Alexander
 
Joins and Other Aggregation Enhancements Coming in MongoDB 3.2
Joins and Other Aggregation Enhancements Coming in MongoDB 3.2Joins and Other Aggregation Enhancements Coming in MongoDB 3.2
Joins and Other Aggregation Enhancements Coming in MongoDB 3.2
MongoDB
 
Using a mobile phone as a therapist - Superweek 2018
Using a mobile phone as a therapist - Superweek 2018Using a mobile phone as a therapist - Superweek 2018
Using a mobile phone as a therapist - Superweek 2018
Peter Meyer
 
CS442 - Rogue: A Scala DSL for MongoDB
CS442 - Rogue: A Scala DSL for MongoDBCS442 - Rogue: A Scala DSL for MongoDB
CS442 - Rogue: A Scala DSL for MongoDB
jorgeortiz85
 
Elasticsearch
ElasticsearchElasticsearch
Elasticsearch
Michal Vrchota
 
O que há de novo no Xamarin.Forms
O que há de novo no Xamarin.FormsO que há de novo no Xamarin.Forms
O que há de novo no Xamarin.Forms
akamud
 
ChContext
ChContextChContext
ChContext
Marco Montanari
 
Example-driven Web API Specification Discovery
Example-driven Web API Specification DiscoveryExample-driven Web API Specification Discovery
Example-driven Web API Specification Discovery
Javier Canovas
 
The Ring programming language version 1.3 book - Part 33 of 88
The Ring programming language version 1.3 book - Part 33 of 88The Ring programming language version 1.3 book - Part 33 of 88
The Ring programming language version 1.3 book - Part 33 of 88
Mahmoud Samir Fayed
 
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
MongoDB
 
The Ring programming language version 1.9 book - Part 52 of 210
The Ring programming language version 1.9 book - Part 52 of 210The Ring programming language version 1.9 book - Part 52 of 210
The Ring programming language version 1.9 book - Part 52 of 210
Mahmoud Samir Fayed
 
Building Single Page Apps with Backbone.js, Coffeescript and Rails 3.1
Building Single Page Apps with Backbone.js, Coffeescript and Rails 3.1Building Single Page Apps with Backbone.js, Coffeescript and Rails 3.1
Building Single Page Apps with Backbone.js, Coffeescript and Rails 3.1
Vagmi Mudumbai
 
MongoDB Europe 2016 - Graph Operations with MongoDB
MongoDB Europe 2016 - Graph Operations with MongoDBMongoDB Europe 2016 - Graph Operations with MongoDB
MongoDB Europe 2016 - Graph Operations with MongoDB
MongoDB
 
Railson dickinson 5 mil seguidores
Railson dickinson 5 mil seguidoresRailson dickinson 5 mil seguidores
Railson dickinson 5 mil seguidores
Railson Dickinson
 
HTML5 and CSS3 Refresher
HTML5 and CSS3 RefresherHTML5 and CSS3 Refresher
HTML5 and CSS3 Refresher
Ivano Malavolta
 
Querying Nested JSON Data Using N1QL and Couchbase
Querying Nested JSON Data Using N1QL and CouchbaseQuerying Nested JSON Data Using N1QL and Couchbase
Querying Nested JSON Data Using N1QL and Couchbase
Brant Burnett
 
Full-Text Search Explained - Philipp Krenn - Codemotion Rome 2017
Full-Text Search Explained - Philipp Krenn - Codemotion Rome 2017Full-Text Search Explained - Philipp Krenn - Codemotion Rome 2017
Full-Text Search Explained - Philipp Krenn - Codemotion Rome 2017
Codemotion
 

What's hot (20)

The Aggregation Framework
The Aggregation FrameworkThe Aggregation Framework
The Aggregation Framework
 
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
 
IE9에서 HTML5 개발하기
IE9에서 HTML5 개발하기IE9에서 HTML5 개발하기
IE9에서 HTML5 개발하기
 
JQuery Flot
JQuery FlotJQuery Flot
JQuery Flot
 
Joins and Other Aggregation Enhancements Coming in MongoDB 3.2
Joins and Other Aggregation Enhancements Coming in MongoDB 3.2Joins and Other Aggregation Enhancements Coming in MongoDB 3.2
Joins and Other Aggregation Enhancements Coming in MongoDB 3.2
 
Using a mobile phone as a therapist - Superweek 2018
Using a mobile phone as a therapist - Superweek 2018Using a mobile phone as a therapist - Superweek 2018
Using a mobile phone as a therapist - Superweek 2018
 
CS442 - Rogue: A Scala DSL for MongoDB
CS442 - Rogue: A Scala DSL for MongoDBCS442 - Rogue: A Scala DSL for MongoDB
CS442 - Rogue: A Scala DSL for MongoDB
 
Elasticsearch
ElasticsearchElasticsearch
Elasticsearch
 
O que há de novo no Xamarin.Forms
O que há de novo no Xamarin.FormsO que há de novo no Xamarin.Forms
O que há de novo no Xamarin.Forms
 
ChContext
ChContextChContext
ChContext
 
Example-driven Web API Specification Discovery
Example-driven Web API Specification DiscoveryExample-driven Web API Specification Discovery
Example-driven Web API Specification Discovery
 
The Ring programming language version 1.3 book - Part 33 of 88
The Ring programming language version 1.3 book - Part 33 of 88The Ring programming language version 1.3 book - Part 33 of 88
The Ring programming language version 1.3 book - Part 33 of 88
 
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
MongoDB Analytics: Learn Aggregation by Example - Exploratory Analytics and V...
 
The Ring programming language version 1.9 book - Part 52 of 210
The Ring programming language version 1.9 book - Part 52 of 210The Ring programming language version 1.9 book - Part 52 of 210
The Ring programming language version 1.9 book - Part 52 of 210
 
Building Single Page Apps with Backbone.js, Coffeescript and Rails 3.1
Building Single Page Apps with Backbone.js, Coffeescript and Rails 3.1Building Single Page Apps with Backbone.js, Coffeescript and Rails 3.1
Building Single Page Apps with Backbone.js, Coffeescript and Rails 3.1
 
MongoDB Europe 2016 - Graph Operations with MongoDB
MongoDB Europe 2016 - Graph Operations with MongoDBMongoDB Europe 2016 - Graph Operations with MongoDB
MongoDB Europe 2016 - Graph Operations with MongoDB
 
Railson dickinson 5 mil seguidores
Railson dickinson 5 mil seguidoresRailson dickinson 5 mil seguidores
Railson dickinson 5 mil seguidores
 
HTML5 and CSS3 Refresher
HTML5 and CSS3 RefresherHTML5 and CSS3 Refresher
HTML5 and CSS3 Refresher
 
Querying Nested JSON Data Using N1QL and Couchbase
Querying Nested JSON Data Using N1QL and CouchbaseQuerying Nested JSON Data Using N1QL and Couchbase
Querying Nested JSON Data Using N1QL and Couchbase
 
Full-Text Search Explained - Philipp Krenn - Codemotion Rome 2017
Full-Text Search Explained - Philipp Krenn - Codemotion Rome 2017Full-Text Search Explained - Philipp Krenn - Codemotion Rome 2017
Full-Text Search Explained - Philipp Krenn - Codemotion Rome 2017
 

Similar to ELK Stack - Turn boring logfiles into sexy dashboard

Peggy elasticsearch應用
Peggy elasticsearch應用Peggy elasticsearch應用
Peggy elasticsearch應用
LearningTech
 
Real-Time Analytics with Solr: Presented by Yonik Seeley, Cloudera
Real-Time Analytics with Solr: Presented by Yonik Seeley, ClouderaReal-Time Analytics with Solr: Presented by Yonik Seeley, Cloudera
Real-Time Analytics with Solr: Presented by Yonik Seeley, Cloudera
Lucidworks
 
Elasticsearch intro output
Elasticsearch intro outputElasticsearch intro output
Elasticsearch intro output
Tom Chen
 
Streaming Operational Data with MariaDB MaxScale
Streaming Operational Data with MariaDB MaxScaleStreaming Operational Data with MariaDB MaxScale
Streaming Operational Data with MariaDB MaxScale
MariaDB plc
 
MongoDB and RDBMS
MongoDB and RDBMSMongoDB and RDBMS
MongoDB and RDBMS
francescapasha
 
Real-time search in Drupal with Elasticsearch @Moldcamp
Real-time search in Drupal with Elasticsearch @MoldcampReal-time search in Drupal with Elasticsearch @Moldcamp
Real-time search in Drupal with Elasticsearch @Moldcamp
Alexei Gorobets
 
Making your elastic cluster perform - Jettro Coenradie - Codemotion Amsterdam...
Making your elastic cluster perform - Jettro Coenradie - Codemotion Amsterdam...Making your elastic cluster perform - Jettro Coenradie - Codemotion Amsterdam...
Making your elastic cluster perform - Jettro Coenradie - Codemotion Amsterdam...
Codemotion
 
Monitoring Your ISP Using InfluxDB Cloud and Raspberry Pi
Monitoring Your ISP Using InfluxDB Cloud and Raspberry PiMonitoring Your ISP Using InfluxDB Cloud and Raspberry Pi
Monitoring Your ISP Using InfluxDB Cloud and Raspberry Pi
InfluxData
 
Online | MongoDB Atlas on GCP Workshop
Online | MongoDB Atlas on GCP Workshop Online | MongoDB Atlas on GCP Workshop
Online | MongoDB Atlas on GCP Workshop
Natasha Wilson
 
MongoDB dla administratora
MongoDB dla administratora MongoDB dla administratora
MongoDB dla administratora
3camp
 
Webinar: Strongly Typed Languages and Flexible Schemas
Webinar: Strongly Typed Languages and Flexible SchemasWebinar: Strongly Typed Languages and Flexible Schemas
Webinar: Strongly Typed Languages and Flexible Schemas
MongoDB
 
Parallel SQL and Analytics with Solr: Presented by Yonik Seeley, Cloudera
Parallel SQL and Analytics with Solr: Presented by Yonik Seeley, ClouderaParallel SQL and Analytics with Solr: Presented by Yonik Seeley, Cloudera
Parallel SQL and Analytics with Solr: Presented by Yonik Seeley, Cloudera
Lucidworks
 
d3sparql.js demo at SWAT4LS 2014 in Berlin
d3sparql.js demo at SWAT4LS 2014 in Berlind3sparql.js demo at SWAT4LS 2014 in Berlin
d3sparql.js demo at SWAT4LS 2014 in Berlin
Toshiaki Katayama
 
Webinar: Applikationsentwicklung mit MongoDB : Teil 5: Reporting & Aggregation
Webinar: Applikationsentwicklung mit MongoDB: Teil 5: Reporting & AggregationWebinar: Applikationsentwicklung mit MongoDB: Teil 5: Reporting & Aggregation
Webinar: Applikationsentwicklung mit MongoDB : Teil 5: Reporting & Aggregation
MongoDB
 
ELK - What's new and showcases
ELK - What's new and showcasesELK - What's new and showcases
ELK - What's new and showcases
Andrii Gakhov
 
PyData Berlin Meetup
PyData Berlin MeetupPyData Berlin Meetup
PyData Berlin Meetup
Steffen Wenz
 
Large Scale Log Analytics with Solr (from Lucene Revolution 2015)
Large Scale Log Analytics with Solr (from Lucene Revolution 2015)Large Scale Log Analytics with Solr (from Lucene Revolution 2015)
Large Scale Log Analytics with Solr (from Lucene Revolution 2015)
Sematext Group, Inc.
 
Visual Exploration of Large Data sets with D3, crossfilter and dc.js
Visual Exploration of Large Data sets with D3, crossfilter and dc.jsVisual Exploration of Large Data sets with D3, crossfilter and dc.js
Visual Exploration of Large Data sets with D3, crossfilter and dc.js
Florian Georg
 
Edição de Texto Rico com React e Draft.js
Edição de Texto Rico com React e Draft.jsEdição de Texto Rico com React e Draft.js
Edição de Texto Rico com React e Draft.js
Guilherme Vierno
 
CouchDB-Lucene
CouchDB-LuceneCouchDB-Lucene
CouchDB-Lucene
Martin Rehfeld
 

Similar to ELK Stack - Turn boring logfiles into sexy dashboard (20)

Peggy elasticsearch應用
Peggy elasticsearch應用Peggy elasticsearch應用
Peggy elasticsearch應用
 
Real-Time Analytics with Solr: Presented by Yonik Seeley, Cloudera
Real-Time Analytics with Solr: Presented by Yonik Seeley, ClouderaReal-Time Analytics with Solr: Presented by Yonik Seeley, Cloudera
Real-Time Analytics with Solr: Presented by Yonik Seeley, Cloudera
 
Elasticsearch intro output
Elasticsearch intro outputElasticsearch intro output
Elasticsearch intro output
 
Streaming Operational Data with MariaDB MaxScale
Streaming Operational Data with MariaDB MaxScaleStreaming Operational Data with MariaDB MaxScale
Streaming Operational Data with MariaDB MaxScale
 
MongoDB and RDBMS
MongoDB and RDBMSMongoDB and RDBMS
MongoDB and RDBMS
 
Real-time search in Drupal with Elasticsearch @Moldcamp
Real-time search in Drupal with Elasticsearch @MoldcampReal-time search in Drupal with Elasticsearch @Moldcamp
Real-time search in Drupal with Elasticsearch @Moldcamp
 
Making your elastic cluster perform - Jettro Coenradie - Codemotion Amsterdam...
Making your elastic cluster perform - Jettro Coenradie - Codemotion Amsterdam...Making your elastic cluster perform - Jettro Coenradie - Codemotion Amsterdam...
Making your elastic cluster perform - Jettro Coenradie - Codemotion Amsterdam...
 
Monitoring Your ISP Using InfluxDB Cloud and Raspberry Pi
Monitoring Your ISP Using InfluxDB Cloud and Raspberry PiMonitoring Your ISP Using InfluxDB Cloud and Raspberry Pi
Monitoring Your ISP Using InfluxDB Cloud and Raspberry Pi
 
Online | MongoDB Atlas on GCP Workshop
Online | MongoDB Atlas on GCP Workshop Online | MongoDB Atlas on GCP Workshop
Online | MongoDB Atlas on GCP Workshop
 
MongoDB dla administratora
MongoDB dla administratora MongoDB dla administratora
MongoDB dla administratora
 
Webinar: Strongly Typed Languages and Flexible Schemas
Webinar: Strongly Typed Languages and Flexible SchemasWebinar: Strongly Typed Languages and Flexible Schemas
Webinar: Strongly Typed Languages and Flexible Schemas
 
Parallel SQL and Analytics with Solr: Presented by Yonik Seeley, Cloudera
Parallel SQL and Analytics with Solr: Presented by Yonik Seeley, ClouderaParallel SQL and Analytics with Solr: Presented by Yonik Seeley, Cloudera
Parallel SQL and Analytics with Solr: Presented by Yonik Seeley, Cloudera
 
d3sparql.js demo at SWAT4LS 2014 in Berlin
d3sparql.js demo at SWAT4LS 2014 in Berlind3sparql.js demo at SWAT4LS 2014 in Berlin
d3sparql.js demo at SWAT4LS 2014 in Berlin
 
Webinar: Applikationsentwicklung mit MongoDB : Teil 5: Reporting & Aggregation
Webinar: Applikationsentwicklung mit MongoDB: Teil 5: Reporting & AggregationWebinar: Applikationsentwicklung mit MongoDB: Teil 5: Reporting & Aggregation
Webinar: Applikationsentwicklung mit MongoDB : Teil 5: Reporting & Aggregation
 
ELK - What's new and showcases
ELK - What's new and showcasesELK - What's new and showcases
ELK - What's new and showcases
 
PyData Berlin Meetup
PyData Berlin MeetupPyData Berlin Meetup
PyData Berlin Meetup
 
Large Scale Log Analytics with Solr (from Lucene Revolution 2015)
Large Scale Log Analytics with Solr (from Lucene Revolution 2015)Large Scale Log Analytics with Solr (from Lucene Revolution 2015)
Large Scale Log Analytics with Solr (from Lucene Revolution 2015)
 
Visual Exploration of Large Data sets with D3, crossfilter and dc.js
Visual Exploration of Large Data sets with D3, crossfilter and dc.jsVisual Exploration of Large Data sets with D3, crossfilter and dc.js
Visual Exploration of Large Data sets with D3, crossfilter and dc.js
 
Edição de Texto Rico com React e Draft.js
Edição de Texto Rico com React e Draft.jsEdição de Texto Rico com React e Draft.js
Edição de Texto Rico com React e Draft.js
 
CouchDB-Lucene
CouchDB-LuceneCouchDB-Lucene
CouchDB-Lucene
 

More from Georg Sorst

Psychological safety how to become a team that learns
Psychological safety   how to become a team that learnsPsychological safety   how to become a team that learns
Psychological safety how to become a team that learns
Georg Sorst
 
Interactive Data Science Notebooks with Apache Zeppelin
Interactive Data Science Notebooks with Apache ZeppelinInteractive Data Science Notebooks with Apache Zeppelin
Interactive Data Science Notebooks with Apache Zeppelin
Georg Sorst
 
JS Error Logging with Sentry
JS Error Logging with SentryJS Error Logging with Sentry
JS Error Logging with Sentry
Georg Sorst
 
Infrastructure = Code
Infrastructure = CodeInfrastructure = Code
Infrastructure = Code
Georg Sorst
 
Das bedingungslose Grundeinkommen
Das bedingungslose GrundeinkommenDas bedingungslose Grundeinkommen
Das bedingungslose Grundeinkommen
Georg Sorst
 
Der FINDOLOGIC Entwicklungsprozess
Der FINDOLOGIC EntwicklungsprozessDer FINDOLOGIC Entwicklungsprozess
Der FINDOLOGIC Entwicklungsprozess
Georg Sorst
 
Salzburg WebDev Meetup PHP Symfony
Salzburg WebDev Meetup PHP SymfonySalzburg WebDev Meetup PHP Symfony
Salzburg WebDev Meetup PHP Symfony
Georg Sorst
 

More from Georg Sorst (7)

Psychological safety how to become a team that learns
Psychological safety   how to become a team that learnsPsychological safety   how to become a team that learns
Psychological safety how to become a team that learns
 
Interactive Data Science Notebooks with Apache Zeppelin
Interactive Data Science Notebooks with Apache ZeppelinInteractive Data Science Notebooks with Apache Zeppelin
Interactive Data Science Notebooks with Apache Zeppelin
 
JS Error Logging with Sentry
JS Error Logging with SentryJS Error Logging with Sentry
JS Error Logging with Sentry
 
Infrastructure = Code
Infrastructure = CodeInfrastructure = Code
Infrastructure = Code
 
Das bedingungslose Grundeinkommen
Das bedingungslose GrundeinkommenDas bedingungslose Grundeinkommen
Das bedingungslose Grundeinkommen
 
Der FINDOLOGIC Entwicklungsprozess
Der FINDOLOGIC EntwicklungsprozessDer FINDOLOGIC Entwicklungsprozess
Der FINDOLOGIC Entwicklungsprozess
 
Salzburg WebDev Meetup PHP Symfony
Salzburg WebDev Meetup PHP SymfonySalzburg WebDev Meetup PHP Symfony
Salzburg WebDev Meetup PHP Symfony
 

Recently uploaded

Energy consumption of Database Management - Florina Jonuzi
Energy consumption of Database Management - Florina JonuziEnergy consumption of Database Management - Florina Jonuzi
Energy consumption of Database Management - Florina Jonuzi
Green Software Development
 
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Crescat
 
A Study of Variable-Role-based Feature Enrichment in Neural Models of Code
A Study of Variable-Role-based Feature Enrichment in Neural Models of CodeA Study of Variable-Role-based Feature Enrichment in Neural Models of Code
A Study of Variable-Role-based Feature Enrichment in Neural Models of Code
Aftab Hussain
 
Webinar On-Demand: Using Flutter for Embedded
Webinar On-Demand: Using Flutter for EmbeddedWebinar On-Demand: Using Flutter for Embedded
Webinar On-Demand: Using Flutter for Embedded
ICS
 
SWEBOK and Education at FUSE Okinawa 2024
SWEBOK and Education at FUSE Okinawa 2024SWEBOK and Education at FUSE Okinawa 2024
SWEBOK and Education at FUSE Okinawa 2024
Hironori Washizaki
 
KuberTENes Birthday Bash Guadalajara - Introducción a Argo CD
KuberTENes Birthday Bash Guadalajara - Introducción a Argo CDKuberTENes Birthday Bash Guadalajara - Introducción a Argo CD
KuberTENes Birthday Bash Guadalajara - Introducción a Argo CD
rodomar2
 
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
mz5nrf0n
 
GraphSummit Paris - The art of the possible with Graph Technology
GraphSummit Paris - The art of the possible with Graph TechnologyGraphSummit Paris - The art of the possible with Graph Technology
GraphSummit Paris - The art of the possible with Graph Technology
Neo4j
 
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Need for Speed: Removing speed bumps from your Symfony projects ⚡️Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Łukasz Chruściel
 
Oracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers.pptxOracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers.pptx
Remote DBA Services
 
ALGIT - Assembly Line for Green IT - Numbers, Data, Facts
ALGIT - Assembly Line for Green IT - Numbers, Data, FactsALGIT - Assembly Line for Green IT - Numbers, Data, Facts
ALGIT - Assembly Line for Green IT - Numbers, Data, Facts
Green Software Development
 
Why Choose Odoo 17 Community & How it differs from Odoo 17 Enterprise Edition
Why Choose Odoo 17 Community & How it differs from Odoo 17 Enterprise EditionWhy Choose Odoo 17 Community & How it differs from Odoo 17 Enterprise Edition
Why Choose Odoo 17 Community & How it differs from Odoo 17 Enterprise Edition
Envertis Software Solutions
 
How to write a program in any programming language
How to write a program in any programming languageHow to write a program in any programming language
How to write a program in any programming language
Rakesh Kumar R
 
Empowering Growth with Best Software Development Company in Noida - Deuglo
Empowering Growth with Best Software  Development Company in Noida - DeugloEmpowering Growth with Best Software  Development Company in Noida - Deuglo
Empowering Growth with Best Software Development Company in Noida - Deuglo
Deuglo Infosystem Pvt Ltd
 
Graspan: A Big Data System for Big Code Analysis
Graspan: A Big Data System for Big Code AnalysisGraspan: A Big Data System for Big Code Analysis
Graspan: A Big Data System for Big Code Analysis
Aftab Hussain
 
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j - Product Vision and Knowledge Graphs - GraphSummit ParisNeo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j
 
socradar-q1-2024-aviation-industry-report.pdf
socradar-q1-2024-aviation-industry-report.pdfsocradar-q1-2024-aviation-industry-report.pdf
socradar-q1-2024-aviation-industry-report.pdf
SOCRadar
 
GreenCode-A-VSCode-Plugin--Dario-Jurisic
GreenCode-A-VSCode-Plugin--Dario-JurisicGreenCode-A-VSCode-Plugin--Dario-Jurisic
GreenCode-A-VSCode-Plugin--Dario-Jurisic
Green Software Development
 
E-commerce Application Development Company.pdf
E-commerce Application Development Company.pdfE-commerce Application Development Company.pdf
E-commerce Application Development Company.pdf
Hornet Dynamics
 
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j - Product Vision and Knowledge Graphs - GraphSummit ParisNeo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j
 

Recently uploaded (20)

Energy consumption of Database Management - Florina Jonuzi
Energy consumption of Database Management - Florina JonuziEnergy consumption of Database Management - Florina Jonuzi
Energy consumption of Database Management - Florina Jonuzi
 
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
 
A Study of Variable-Role-based Feature Enrichment in Neural Models of Code
A Study of Variable-Role-based Feature Enrichment in Neural Models of CodeA Study of Variable-Role-based Feature Enrichment in Neural Models of Code
A Study of Variable-Role-based Feature Enrichment in Neural Models of Code
 
Webinar On-Demand: Using Flutter for Embedded
Webinar On-Demand: Using Flutter for EmbeddedWebinar On-Demand: Using Flutter for Embedded
Webinar On-Demand: Using Flutter for Embedded
 
SWEBOK and Education at FUSE Okinawa 2024
SWEBOK and Education at FUSE Okinawa 2024SWEBOK and Education at FUSE Okinawa 2024
SWEBOK and Education at FUSE Okinawa 2024
 
KuberTENes Birthday Bash Guadalajara - Introducción a Argo CD
KuberTENes Birthday Bash Guadalajara - Introducción a Argo CDKuberTENes Birthday Bash Guadalajara - Introducción a Argo CD
KuberTENes Birthday Bash Guadalajara - Introducción a Argo CD
 
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
原版定制美国纽约州立大学奥尔巴尼分校毕业证学位证书原版一模一样
 
GraphSummit Paris - The art of the possible with Graph Technology
GraphSummit Paris - The art of the possible with Graph TechnologyGraphSummit Paris - The art of the possible with Graph Technology
GraphSummit Paris - The art of the possible with Graph Technology
 
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Need for Speed: Removing speed bumps from your Symfony projects ⚡️Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
 
Oracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers.pptxOracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers.pptx
 
ALGIT - Assembly Line for Green IT - Numbers, Data, Facts
ALGIT - Assembly Line for Green IT - Numbers, Data, FactsALGIT - Assembly Line for Green IT - Numbers, Data, Facts
ALGIT - Assembly Line for Green IT - Numbers, Data, Facts
 
Why Choose Odoo 17 Community & How it differs from Odoo 17 Enterprise Edition
Why Choose Odoo 17 Community & How it differs from Odoo 17 Enterprise EditionWhy Choose Odoo 17 Community & How it differs from Odoo 17 Enterprise Edition
Why Choose Odoo 17 Community & How it differs from Odoo 17 Enterprise Edition
 
How to write a program in any programming language
How to write a program in any programming languageHow to write a program in any programming language
How to write a program in any programming language
 
Empowering Growth with Best Software Development Company in Noida - Deuglo
Empowering Growth with Best Software  Development Company in Noida - DeugloEmpowering Growth with Best Software  Development Company in Noida - Deuglo
Empowering Growth with Best Software Development Company in Noida - Deuglo
 
Graspan: A Big Data System for Big Code Analysis
Graspan: A Big Data System for Big Code AnalysisGraspan: A Big Data System for Big Code Analysis
Graspan: A Big Data System for Big Code Analysis
 
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j - Product Vision and Knowledge Graphs - GraphSummit ParisNeo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
 
socradar-q1-2024-aviation-industry-report.pdf
socradar-q1-2024-aviation-industry-report.pdfsocradar-q1-2024-aviation-industry-report.pdf
socradar-q1-2024-aviation-industry-report.pdf
 
GreenCode-A-VSCode-Plugin--Dario-Jurisic
GreenCode-A-VSCode-Plugin--Dario-JurisicGreenCode-A-VSCode-Plugin--Dario-Jurisic
GreenCode-A-VSCode-Plugin--Dario-Jurisic
 
E-commerce Application Development Company.pdf
E-commerce Application Development Company.pdfE-commerce Application Development Company.pdf
E-commerce Application Development Company.pdf
 
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j - Product Vision and Knowledge Graphs - GraphSummit ParisNeo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
 

ELK Stack - Turn boring logfiles into sexy dashboard

  • 1. FINDOLOGIC GmbH Boring Logfiles → Sexy Dashboards
  • 2. Boring Logfiles 178.236.7.219 - - [27/Oct/2014:06:43:13 +0100] "GET /ps/amazon.de/index.php?shopkey=DEADBEEF&shopurl=https %3A%2F%2Fwww.amazon.de %2F&multishop_id=0&userip=173.194.112.2&referer=https %3A%2F%2Fwww.amazon.de%2FTechnik %2FFernseher&count=0&group[]=2&service=search&query=le d HTTP/1.1" 200 12363 "-" "-"
  • 4. Stack ● Elasticsearch ● Logstash ● Kibana
  • 5. Infrastruktur App 1 App 2 App 3 Logstash 1 Logstash 2 Logstash 3 ElasticSearch Kibana
  • 6. Logstash Architektur Input Filter Output ● Grok ● Search / Replace ● Split ● GeoIP ● DNS ● URL-Decode ● ... ● ElasticSearch ● Redis ● CouchDB ● ... ● Pipe ● Socket ● File ● ...
  • 7. Logstash stand-alone ● Logs zentralisieren ● In DB speichern ● Durchsuchbar machen
  • 8. Setup ● Logstash herunterladen, extrahieren ● Elasticsearch installieren ● fertig
  • 9. Georg? ● CTO bei FINDOLOGIC GmbH ● http://www.findologic.com ● g.sorst@findologic.com ● @piefke_schorsch
  • 10. Hands on ● Grok ● kv ● Query ● Endpoint ● GeoIP
  • 11. Logstash.conf input { file { path => "/home/georg/coding/logstash-apache/access.log" start_position => beginning } #pipe { # command => "ssh frontend1.findologic.com tail -f /var/log/apache2/access.log" #} } filter { grok { match => { "message" => "%{IPORHOST:clientip} %{USER:ident} %{USER:auth} [%{HTTPDATE:timestamp}] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent}" } } # split the query string: query=test&count=0&first=10 → request_query: test, request_count: 0, request_first: 10 kv { field_split => "&?" source => "request" prefix => "request_" } # urldecode does not decode the + into whitespace so do this manually mutate { gsub => [ "request_query", "+", " " ] } # URL-decode the query so it is easier to read. We don't really about the other request_* parameters urldecode { field => "request_query" } # extract the script file, eg. index.php mutate { gsub => [ # Remove the query string including the ? : /path/index.php?key=value -> /path/index.php "request", "?.*$", "", # Remove everything up to the last / : /path/index.php -> index.php "request", "^.*/", "" ] } # Default to index.php if no script file is given if [request] == "" { mutate { replace => [ "request", "index.php" ] } } # If the IP is syntactically valid resolve it geographically if [request_userip] =~ "^d+.d+.d+.d+$" { geoip { source => "request_userip" target => "client_geoip" } } } output { elasticsearch { host => localhost } #stdout { codec => rubydebug } }
  • 12. Kibana Dashboard { "title": "Logstash Search", "services": { "query": { "list": { "0": { "query": "*", "alias": "", "color": "#7EB26D", "id": 0, "pin": false, "type": "lucene", "enable": true }, "1": { "id": 1, "color": "#EAB839", "alias": "Suche", "pin": false, "type": "lucene", "enable": true, "query": "request:index.php" }, "2": { "id": 2, "color": "#6ED0E0", "alias": "Autocomplete", "pin": false, "type": "lucene", "enable": true, "query": "request:autocomplete.php" }, "3": { "id": 3, "color": "#EF843C", "alias": "", "pin": false, "type": "lucene", "enable": true, "query": "client_geoip.country_code2:DE OR client_geoip.country_code2:AT OR client_geoip.country_code2:CH" } }, "ids": [ 0, 1, 2, 3 ] }, "filter": { "list": { "0": { "type": "time", "field": "@timestamp", "from": "now-24h", "to": "now", "mandate": "must", "active": true, "alias": "", "id": 0 }, "1": { "type": "time", "from": "2014-10-27T18:04:33.357Z", "to": "2014-10-27T19:18:47.459Z", "field": "@timestamp", "mandate": "must", "active": true, "alias": "", "id": 1 } }, "ids": [ 0, 1 ] } }, "rows": [ { "title": "Graph", "height": "350px", "editable": true, "collapse": false, "collapsable": true, "panels": [ { "span": 12, "editable": true, "group": [ "default" ], "type": "histogram", "mode": "count", "time_field": "@timestamp", "value_field": null, "auto_int": true, "resolution": 100, "interval": "30s", "fill": 3, "linewidth": 3, "timezone": "browser", "spyable": true, "zoomlinks": true, "bars": true, "stack": true, "points": false, "lines": false, "legend": true, "x-axis": true, "y-axis": true, "percentage": false, "interactive": true, "queries": { "mode": "selected", "ids": [ 1, 2 ] }, "title": "Events over time", "intervals": [ "auto", "1s", "1m", "5m", "10m", "30m", "1h", "3h", "12h", "1d", "1w", "1M", "1y" ], "options": true, "tooltip": { "value_type": "cumulative", "query_as_alias": true }, "scale": 1, "y_format": "none", "grid": { "max": null, "min": 0 }, "annotate": { "enable": false, "query": "*", "size": 20, "field": "_type", "sort": [ "_score", "desc" ] }, "pointradius": 5, "show_query": true, "legend_counts": true, "zerofill": true, "derivative": false } ], "notice": false }, { "title": "", "height": "350px", "editable": true, "collapse": false, "collapsable": true, "panels": [ { "error": false, "span": 6, "editable": true, "type": "terms", "loadingEditor": false, "field": "request_query", "exclude": [], "missing": false, "other": false, "size": 10, "order": "count", "style": { "font-size": "10pt" }, "donut": false, "tilt": false, "labels": true, "arrangement": "horizontal", "chart": "pie", "counter_pos": "above", "spyable": true, "queries": { "mode": "all", "ids": [ 0, 1, 2, 3 ] }, "tmode": "terms", "tstat": "total", "valuefield": "" }, { "error": false, "span": 6, "editable": true, "type": "bettermap", "loadingEditor": false, "field": "client_geoip.location", "size": 1000, "spyable": true, "tooltip": "_id", "queries": { "mode": "selected", "ids": [ 3 ] } } ], "notice": false }, { "title": "Events", "height": "350px", "editable": true, "collapse": false, "collapsable": true, "panels": [ { "title": "All events", "error": false, "span": 12, "editable": true, "group": [ "default" ], "type": "table", "size": 100, "pages": 5, "offset": 0, "sort": [ "@timestamp", "desc" ], "style": { "font-size": "9pt" }, "overflow": "min-height", "fields": [], "localTime": true, "timeField": "@timestamp", "highlight": [], "sortable": true, "header": true, "paging": true, "spyable": true, "queries": { "mode": "all", "ids": [ 0, 1, 2, 3 ] }, "field_list": true, "status": "Stable", "trimFactor": 300, "normTimes": true, "all_fields": false } ], "notice": false } ], "editable": true, "failover": false, "index": { "interval": "day", "pattern": "[logstash-]YYYY.MM.DD", "default": "NO_TIME_FILTER_OR_INDEX_PATTERN_NOT_MATCHED", "warm_fields": true }, "style": "light", "panel_hints": true, "pulldowns": [ { "type": "query", "collapse": false, "notice": false, "query": "*", "pinned": true, "history": [ "client_geoip.country_code2:DE OR client_geoip.country_code2:AT OR client_geoip.country_code2:CH", "request:autocomplete.php", "request:index.php", "*" ], "remember": 10, "enable": true }, { "type": "filtering", "collapse": false, "notice": true, "enable": true } ], "nav": [ { "type": "timepicker", "collapse": false, "notice": false, "status": "Stable", "time_options": [ "5m", "15m", "1h", "6h", "12h", "24h", "2d", "7d", "30d" ], "refresh_intervals": [ "5s", "10s", "30s", "1m", "5m", "15m", "30m", "1h", "2h", "1d" ], "timefield": "@timestamp", "now": false, "filter_id": 0, "enable": true } ], "loader": { "save_gist": false, "save_elasticsearch": true, "save_local": true, "save_default": true, "save_temp": true, "save_temp_ttl_enable": true, "save_temp_ttl": "30d", "load_gist": true, "load_elasticsearch": true, "load_elasticsearch_size": 20, "load_local": true, "hide": false }, "refresh": false } Vergrößern zum Anzeigen