Book Image

Mastering Kibana 6.x

Book Image

Mastering Kibana 6.x

Overview of this book

Kibana is one of the popular tools among data enthusiasts for slicing and dicing large datasets and uncovering Business Intelligence (BI) with the help of its rich and powerful visualizations. To begin with, Mastering Kibana 6.x quickly introduces you to the features of Kibana 6.x, before teaching you how to create smart dashboards in no time. You will explore metric analytics and graph exploration, followed by understanding how to quickly customize Kibana dashboards. In addition to this, you will learn advanced analytics such as maps, hits, and list analytics. All this will help you enhance your skills in running and comparing multiple queries and filters, influencing your data visualization skills at scale. With Kibana’s Timelion feature, you can analyze time series data with histograms and stats analytics. By the end of this book, you will have created a speedy machine learning job using X-Pack capabilities.
Table of Contents (21 chapters)
Title Page
Copyright and Credits
Packt Upsell
Contributors
Preface
Index

Grok debugger


Grok is basically used for pattern matching, and we can structure an arbitrary text by parsing it through grok expressions. Grok patterns can be used for the grok processor in Dev Tools and in the Logstash grok filter. There are more than 120 grok patterns that Elastic Stack supports.

There are different data sources from where we can get arbitrary data such as syslog logs, Apache logs, MySQL logs, or any other type of log. Now, these types of data are not labeled with a field name, and without that, we cannot process it in Elasticsearch or Kibana. To overcome this issue, we need to parse the log data with grok expression. For that, we need to map the log values with field names in the grok expression and then simulate it to get the values in the field. Once this is done, we can use that expression into Logstash grok filter to filtering this log data.

To create the grok expression, we need to click on the Grok Debugger link after Search Profiler, which will open the following...