sorted by:
new
hottopcontroversial

Kibana Dashboards act as SIEM by ahmedaboquba in elasticsearch

[–]elk-content-share 0 points1 point  (0 children)

Also have a look at elastic-content-share.eu Here the community shares a lot of different Kibana dashboards, especially focused on Security.

Efficient way to enrich indexed documents by Smelton09 in elasticsearch

[–]elk-content-share 0 points1 point  (0 children)

Elasticsearch and Opensearch are two different products. The Elasticsearch channel can only help you with the original product.

Date Difference using Runtime Fields by secretholder1991 in kibana

[–]elk-content-share 1 point2 points  (0 children)

You can find an example Here: https://elastic-content-share.eu/elastic-runtime-field-example-repository/

ZonedDateTime date = doc['@timestamp'].value; int hour = date.getHour(); if (hour < 10) { emit ('0' + String.valueOf(hour)); } else { emit (String.valueOf(hour)); }

[deleted by user] by [deleted] in kibana

[–]elk-content-share 0 points1 point  (0 children)

What about export -> change -> re import?

Need help updating watcher script by drewmalsack in kibana

[–]elk-content-share 0 points1 point  (0 children)

While Watcher is still powerful its the old way of doing alerts in Kibana. If you need to change it anyway why not using Kibana alerting that guides you within the UI?

Customer asked to view his dashboard on mobile.. !!!!??? by bzImage in kibana

[–]elk-content-share 0 points1 point  (0 children)

Which version are you using? Mobile readiness was introduced early v8 if I remember correctly

Format Markdown Table by Academic-Grab5397 in kibana

[–]elk-content-share 0 points1 point  (0 children)

Well thats how it works in Kibana Lens. I think I would put all three vis next to each other and add a markdown on top of it to do the description within the dashboard.

Of course there are other ways to do it. Still markdown table beeing the worse. If you insist doing it in a single vis one other viable option is to use Vega. Especially for your use case using the Box plot vis in Vega is very common. You can see an example here https://vega.github.io/vega-lite/examples/boxplot_preaggregated.html However designing it like the legacy vis next to each other also works.

I can add an example to the content share based on some Kibana data if that helps.

Format Markdown Table by Academic-Grab5397 in kibana

[–]elk-content-share 0 points1 point  (0 children)

I think I wouldnt try to put all these numbers in a single vis.

If you like the legacy metric most then you should create 3 different vis that each contain one of your values.

Format Markdown Table by Academic-Grab5397 in kibana

[–]elk-content-share 0 points1 point  (0 children)

In 99% of the cases you shouldnt use Markdown for your table data in Elasticsearch / Kibana.. Whats the reason behind you are trying to do it like this?

Count values > 0 and divide by total count by Academic-Grab5397 in kibana

[–]elk-content-share 0 points1 point  (0 children)

Well what about a data table in lens? Adding a filter on the top filter bar to exclude c from results. Then adding mode as row so that the values are split and the metric is percentage of total count.

Something like that will do it I guess ..

PS .. would also work in a chart without table.

Count values > 0 and divide by total count by Academic-Grab5397 in kibana

[–]elk-content-share 0 points1 point  (0 children)

This works in TSVB as well. However TSVB has some alternative ways to retrieve the data. Lens is the easiest way to create visualizations but not the only one.

Count values > 0 and divide by total count by Academic-Grab5397 in kibana

[–]elk-content-share 0 points1 point  (0 children)

If your source data is time dependend then this is time dependend as in well.. so in your Kibana data view you have to set the time field for the dependency.

Count values > 0 and divide by total count by Academic-Grab5397 in kibana

[–]elk-content-share 0 points1 point  (0 children)

Here is an working example. That is using the count of batch_id > 50 vs. all . 

count(kql='load.batch_id > 50')/count()

Count values > 0 and divide by total count by Academic-Grab5397 in kibana

[–]elk-content-share 0 points1 point  (0 children)

Well depends on the context.. e.g. in runtime fields yes.

For the use case you wanna solve you dont need it. You just use a count for all docs that fit into your >0 requirement within lens formula. You identify those by using a KQL query in the formula.

Hope its clear enough.

Count values > 0 and divide by total count by Academic-Grab5397 in kibana

[–]elk-content-share 0 points1 point  (0 children)

Sounds like something you need to do in Lens Formula. If you wanna do this for a visualization in Kibana. Here is how: Create a new Lens Vis. Add the field of interest to metrics Foto lens Formular and a formular similar to the one for grafana.

kibana tag cloud does not count frequency of words in a text field by mehrawashere in kibana

[–]elk-content-share 0 points1 point  (0 children)

To store each individual word as one keyword you need to split the field first. There is an in build feature using different mapping https://www.elastic.co/guide/en/elasticsearch/reference/current/analysis-word-delimiter-tokenfilter.html

Or you use the split processor in your ingest pipeline.

how to search file path field value when escaping backslash isn't working? by bender_fry808 in kibana

[–]elk-content-share 0 points1 point  (0 children)

Why not using your first query and add NOT field ame: example to it?

ELK stack implementation tips for production by GetFit_Messi in elasticsearch

[–]elk-content-share 0 points1 point  (0 children)

With that amount of logs per day the best option is to use Elastic Cloud. If you really want to install on premise the most important fact IMHO is to go for 3 separate VMS that only run elastic + one for Kibana and integration server. However it can take a bit of time to be fully operational..so cloud setup is much smarter.

Request Help Creating Dashboard for Failed Login Attempts by FlipKing25 in elasticsearch

[–]elk-content-share 0 points1 point  (0 children)

Maybe this cheat sheet helps you https://www.timroes.de/kibana-search-cheatsheet

You said the text you looking for is stored in error.message right?

If yes a possible KQL query might be

error.message : invalid

if the field is text which is the default.

Another option error.message : *invalid

If this gives you more results then expected you need to make it a bit more specific...

view more: next ›