{"id":382299,"date":"2024-06-29T04:11:26","date_gmt":"2024-06-29T04:11:26","guid":{"rendered":"http:\/\/savepearlharbor.com\/?p=382299"},"modified":"-0001-11-30T00:00:00","modified_gmt":"2024-06-29T04:11:26","slug":"","status":"publish","type":"post","link":"https:\/\/savepearlharbor.com\/?p=382299","title":{"rendered":"<span>Kibana Tips &amp; Tricks: How to view events in Discover mode<\/span>"},"content":{"rendered":"<div><!--[--><!--]--><\/div>\n<div id=\"post-content-body\">\n<div>\n<div class=\"article-formatted-body article-formatted-body article-formatted-body_version-1\">\n<div xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/_p\/a3\/bj\/_pa3bjlpfc_pgkya4fhih1_93dk.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/_p\/a3\/bj\/_pa3bjlpfc_pgkya4fhih1_93dk.png\"\/><\/p>\n<p>  Hi Habrausers!<\/p>\n<p>  As you may know Kibana is a visualization instrument, part of <a href=\"https:\/\/www.elastic.co\/elk-stack\/\" rel=\"nofollow\">ELK<\/a> (Elastic, Logstash, Kibana) stack. With the help of Kibana you may analyze and visualize your data, build different charts and combine them on the dashboard to present data in the most beautiful way.  <\/p>\n<blockquote><p><i>People who use Kibana in our company have different background \u2014 some of them are technical who process data, some are managers who simply want to monitor some KPIs. And all have various questions. In spite of Kibana is rather popular in IT companies, there are not many articles or courses about it. To fill the gap I have created Kibana Tips &amp; Tricks \u2014 weekly letters with frequently asked questions or themes. Such letters help our users to become more familiar with Kibana. There are no secrets \u2014 just detailed description of how you may work with your data. <\/i><\/p><\/blockquote>\n<p>I would like to share the first part of &#8216;Kibana Tips &amp; Tricks&#8217; with you \u2014 series of simple how-to articles for people who would like to know more about data analysis and visualization in Kibana. Today we will see how to view events in Kibana.<br \/>  <a name=\"habracut\"><\/a><br \/>  The simplest an quickest way to see events in Kibana is to use <b>Discover view<\/b>.<\/p>\n<p>  The <b>Discover view<\/b> presents all the data in your index as a table of documents and allows you to see the number of events for selected time period.<\/p>\n<p>  To access discover mode click on <b>Discover<\/b> on the left Kibana panel:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/gv\/m8\/tl\/gvm8tlotrzxh43gnkt-rkf1qcgs.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/gv\/m8\/tl\/gvm8tlotrzxh43gnkt-rkf1qcgs.png\"\/><\/p>\n<p>  Discover view consists of several parts:<\/p>\n<ul>\n<li><b>Top panel<\/b> with the ability to save a search or share it<\/li>\n<li><b>Search panel<\/b> \u2014 where you may put specific filters, search for event and change the time range<\/li>\n<li><b>Index choice<\/b> \u2014 to change the index you want to view the data from<\/li>\n<li><b>Index fields list<\/b> which lists all available fields for this index<\/li>\n<li><b>Events histogram<\/b> \u2014 total number of events per time bucket over a time range<\/li>\n<li><b>Event pane<\/b> \u2014 list of individual events <\/li>\n<\/ul>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/zj\/xg\/f6\/zjxgf6n5vxunqmby_rl6fnycvdu.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/zj\/xg\/f6\/zjxgf6n5vxunqmby_rl6fnycvdu.png\"\/><br \/>  Let&#8217;s analyze discover view and see what we can do with specific index and event.<\/p>\n<h3>Top Panel<\/h3>\n<p>  On the Top panel you see buttons: <b>New<\/b>, <b>Save<\/b>, <b>Open<\/b>, <b>Share<\/b> and Inspect.<\/p>\n<p>  To save the data inside discover click on the <b>Save<\/b> button on top right corner as shown below:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/qh\/z4\/4m\/qhz44mtphmso84tyewibiwwp9ju.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/qh\/z4\/4m\/qhz44mtphmso84tyewibiwwp9ju.png\"\/><\/p>\n<p>  After saving you will be able to open it \u2014 just click on <b>Open<\/b> button and input your saved search name: <\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/be\/i2\/hn\/bei2hnveor5ic8n3eyz1qlalpew.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/be\/i2\/hn\/bei2hnveor5ic8n3eyz1qlalpew.png\"\/><\/p>\n<p>  If you want to share the data with others use <b>Share<\/b> button:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/3r\/7k\/m7\/3r7km7rjs3lexrx9pm3dp6ztrsa.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/3r\/7k\/m7\/3r7km7rjs3lexrx9pm3dp6ztrsa.png\"\/><\/p>\n<p>  Choose <b>Permalink<\/b>.<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/5x\/ew\/tl\/5xewtlilufvogweinyqc90go9s8.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/5x\/ew\/tl\/5xewtlilufvogweinyqc90go9s8.png\"\/><\/p>\n<p>  The<b> Snapshot <\/b>option will give a Kibana link which will display data available in the search currently.<\/p>\n<p>  The<b> Saved object<\/b> option will give a Kibana link which will display the recent data available in your search.<\/p>\n<p>  If you turn on <b>Short URL<\/b> option \u2014 new short url will be generated for your search (this option depends on access level).<\/p>\n<h3>Search Panel<\/h3>\n<p>  You can use <b>Search Panel<\/b> to look for data inside the index. Examples are below:<\/p>\n<p>  To see data for specific time range you need to click on <b>Show dates<\/b> in the top right corner and than on calendar icon.\u00a0<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/uu\/n0\/x2\/uun0x28cubqw95rzklxgddlhbhi.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/uu\/n0\/x2\/uun0x28cubqw95rzklxgddlhbhi.png\"\/><\/p>\n<p>  You can choose between <b>Quick select<\/b>, <b>Commonly used<\/b>, <b>Recently used date ranges<\/b> and <b>Auto-refresh<\/b> options.<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/cc\/hl\/6p\/cchl6podlrnedbivmvofhizson8.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/cc\/hl\/6p\/cchl6podlrnedbivmvofhizson8.png\"\/><\/p>\n<p>  With <b>Quick select<\/b> option you may choose last or future period, define seconds, minutes, hours, months or years and than put preferable range in numbers. <\/p>\n<p>  <b>Commonly used<\/b> allows you to choose the time range from predefined options<\/p>\n<p>  In <b>Refresh every<\/b> section you can set time interval in Kibana will auto-refresh the screen and get fresh data according to interval you set.<\/p>\n<p>  If you want to search by specific field in the list (event.module in our case), put <b>event.module: \u00abkafka\u00bb<\/b> in the search pane end push &#171;<b>Update<\/b>&#187; button.<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/e7\/x4\/wd\/e7x4wdjejxrav8ifzgu1hfd6-8m.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/e7\/x4\/wd\/e7x4wdjejxrav8ifzgu1hfd6-8m.png\"\/><\/p>\n<p>  Writing search query is rather simple as it provides autocomplete \u2014 I only put <b>\u00abmodu\u00bb<\/b> and received the list of available fields to filter by:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/dm\/ai\/pl\/dmaiplhbenlbzmf7txszvwmce3c.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/dm\/ai\/pl\/dmaiplhbenlbzmf7txszvwmce3c.png\"\/><\/p>\n<h3>Index select<\/h3>\n<p>  By default for <a href=\"https:\/\/demo.elastic.co\/app\/kibana#\/\" rel=\"nofollow\">demo Kibana<\/a> you will see page for <b>filebeat-*<\/b> index.<\/p>\n<p>  To choose another index press an <b>arrow<\/b>.<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/lm\/it\/ee\/lmiteefgepdyh7l7xk9vyrloafk.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/lm\/it\/ee\/lmiteefgepdyh7l7xk9vyrloafk.png\"\/><\/p>\n<p>  Also you may see such picture with message <b>\u201cNo results match your search criteria\u201d<\/b>:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/sx\/hh\/rq\/sxhhrqqmjc8xrubaduqyb_w7ium.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/sx\/hh\/rq\/sxhhrqqmjc8xrubaduqyb_w7ium.png\"\/><\/p>\n<p>  That means you have no events matching the defined time period or filters. Adjust filters and the time range \u2014 it should fix the problem.<\/p>\n<h3>Events histogram<\/h3>\n<p>  You can see the number of events per time interval on the histogram in the center of the screen.<\/p>\n<p>  By default the number of events is shown using \u00abauto\u00bb time granularity, but you may change it.<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/mp\/6u\/iq\/mp6uiqez-n0sh4a0y4xpffvbqps.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/mp\/6u\/iq\/mp6uiqez-n0sh4a0y4xpffvbqps.png\"\/><\/p>\n<p>  Hourly:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/av\/rl\/ai\/avrlaie9wywxb8su1vmlneykyyy.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/av\/rl\/ai\/avrlaie9wywxb8su1vmlneykyyy.png\"\/><\/p>\n<p>  Weekly:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/jp\/qm\/yc\/jpqmycdezs50ioxhyaniwqvkfb8.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/jp\/qm\/yc\/jpqmycdezs50ioxhyaniwqvkfb8.png\"\/><\/p>\n<h3>Index fields list<\/h3>\n<p>  All available fields are located on the left side of the screen:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/wb\/w4\/ej\/wbw4ejgge3gla8o9vvjnujtu0c8.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/wb\/w4\/ej\/wbw4ejgge3gla8o9vvjnujtu0c8.png\"\/><\/p>\n<p>  You can select the fields from available and add them to tabular mode. To do it just click on add button on the right:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/yj\/ao\/57\/yjao57ytmw8x_wifmmic3a9ew6i.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/yj\/ao\/57\/yjao57ytmw8x_wifmmic3a9ew6i.png\"\/><\/p>\n<p>  On the screenshot below 2 fields were added \u2014 <b>event.module<\/b> and <b>host.os.name<\/b>:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/gd\/vr\/lp\/gdvrlpt--kabhogfnuirhunpyey.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/gd\/vr\/lp\/gdvrlpt--kabhogfnuirhunpyey.png\"\/><\/p>\n<h3>Event panel<\/h3>\n<p>  All events are shown in row format. <\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/tm\/9h\/kj\/tm9hkjipcyjjvkl8vb-dwbtg4vm.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/tm\/9h\/kj\/tm9hkjipcyjjvkl8vb-dwbtg4vm.png\"\/><\/p>\n<p>  Click the arrow to expand the row and it will give you details in Table format or JSON format.<\/p>\n<p>  Table mode:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/_n\/ig\/wx\/_nigwxil1d0iwaxoxnegmonqlr4.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/_n\/ig\/wx\/_nigwxil1d0iwaxoxnegmonqlr4.png\"\/><\/p>\n<p>  JSON mode:<\/p>\n<p>  <img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/hc\/mi\/lx\/hcmilxtxei1vt92urot86mgerda.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/hc\/mi\/lx\/hcmilxtxei1vt92urot86mgerda.png\"\/><\/p>\n<p>  That&#8217;s all for today! I hope that you now have a basic understanding of how to use Kibana and view events in Discover mode.<\/p>\n<p>  If you have any questions regading Kibana that may be covered in \u00abTips &amp; Tricks\u00bb feel free to share your ideas in comments.<\/p>\n<h4>Useful links<\/h4>\n<p>  <\/p>\n<ul>\n<li>For those who would like to try Kibana you may use demo <a href=\"https:\/\/demo.elastic.co\/app\/kibana#\/\" rel=\"nofollow\">here<\/a> <\/li>\n<li>In case of other questions please read <a href=\"https:\/\/www.elastic.co\/guide\/en\/kibana\/index.html\" rel=\"nofollow\">Kibana documentation<\/a><\/li>\n<li> Initial picture of elk was taken <a href=\"https:\/\/www.elastic.co\/what-is\/elk-stack\" rel=\"nofollow\">here<\/a><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<\/div>\n<p><!----><!----><\/div>\n<p><!----><\/p>\n<div class=\"tm-article-poll-container\"><!--[--><\/p>\n<div class=\"tm-article-poll tm-article-poll_variant-bordered\">\n<div class=\"tm-notice tm-notice_positive tm-article-poll__notice\"><!----><\/p>\n<div class=\"tm-notice__inner\"><!----><\/p>\n<div class=\"tm-notice__content\" data-test-id=\"notice-content\"><!--[--><span>\u0422\u043e\u043b\u044c\u043a\u043e \u0437\u0430\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043c\u043e\u0433\u0443\u0442 \u0443\u0447\u0430\u0441\u0442\u0432\u043e\u0432\u0430\u0442\u044c \u0432 \u043e\u043f\u0440\u043e\u0441\u0435. <a rel=\"nofollow\" href=\"\/kek\/v1\/auth\/habrahabr\/?back=\/ru\/articles\/505228\/&#038;hl=ru\">\u0412\u043e\u0439\u0434\u0438\u0442\u0435<\/a>, \u043f\u043e\u0436\u0430\u043b\u0443\u0439\u0441\u0442\u0430.<\/span><!--]--><\/div>\n<\/div>\n<\/div>\n<p><!--[--><\/p>\n<div class=\"tm-article-poll__header\">Do you want to read other Kibana Tips &#038; Ticks?<\/div>\n<div class=\"tm-article-poll__answers\"><!--[--><\/p>\n<div class=\"tm-article-poll__answer\">\n<div class=\"tm-article-poll__answer-data\"><span class=\"tm-article-poll__answer-percent tm-article-poll__answer-percent_winning\">100% <\/span><span class=\"tm-article-poll__answer-label\">Yes, please share all materials you have!<\/span><span class=\"tm-article-poll__answer-votes\">5<\/span><\/div>\n<div class=\"tm-article-poll__answer-bar\">\n<div class=\"tm-article-poll__answer-progress tm-article-poll__answer-progress_winning\" style=\"width: 100%\"><\/div>\n<\/div>\n<\/div>\n<div class=\"tm-article-poll__answer\">\n<div class=\"tm-article-poll__answer-data\"><span class=\"tm-article-poll__answer-percent\">0% <\/span><span class=\"tm-article-poll__answer-label\">No, it is boring and I do not like it<\/span><span class=\"tm-article-poll__answer-votes\">0<\/span><\/div>\n<div class=\"tm-article-poll__answer-bar\">\n<div class=\"tm-article-poll__answer-progress\" style=\"width: 0%\"><\/div>\n<\/div>\n<\/div>\n<p><!--]--><\/div>\n<div class=\"tm-article-poll__stats\"> \u041f\u0440\u043e\u0433\u043e\u043b\u043e\u0441\u043e\u0432\u0430\u043b\u0438 5 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439.   \u0412\u043e\u0437\u0434\u0435\u0440\u0436\u0430\u043b\u0441\u044f 1 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c. <\/div>\n<p><!--]--><\/div>\n<p><!--]--><\/div>\n<p> \u0441\u0441\u044b\u043b\u043a\u0430 \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b \u0441\u0442\u0430\u0442\u044c\u0438 <a href=\"https:\/\/habr.com\/ru\/articles\/505228\/\"> https:\/\/habr.com\/ru\/articles\/505228\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<div><!--[--><!--]--><\/div>\n<div id=\"post-content-body\">\n<div>\n<div class=\"article-formatted-body article-formatted-body article-formatted-body_version-1\">\n<div xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\"><img decoding=\"async\" src=\"https:\/\/habrastorage.org\/r\/w1560\/webt\/_p\/a3\/bj\/_pa3bjlpfc_pgkya4fhih1_93dk.png\" alt=\"image\" data-src=\"https:\/\/habrastorage.org\/webt\/_p\/a3\/bj\/_pa3bjlpfc_pgkya4fhih1_93dk.png\"\/><\/p>\n<p>  Hi Habrausers!<\/p>\n<p>  As you may know Kibana is a visualization instrument, part of <a href=\"https:\/\/www.elastic.co\/elk-stack\/\" rel=\"nofollow\">ELK<\/a> (Elastic, Logstash, Kibana) stack. With the help of Kibana you may analyze and visualize your data, build different charts and combine them on the dashboard to present data in the most beautiful way.  <\/p>\n<blockquote><p><i>People who use Kibana in our company have different background \u2014 some of them are technical who process data, some are managers who simply want to monitor some KPIs. And all have various questions. In spite of Kibana is rather popular in IT companies, there are not many articles or courses about it. To fill the gap I have created Kibana Tips &amp; Tricks \u2014 weekly letters with frequently asked questions or themes. Such letters help our users to become more familiar with Kibana. There are no secrets \u2014 just detailed description of how you may work with your data. <\/i><\/p><\/blockquote>\n<p>I would like to share the first part of &#8216;Kibana Tips &amp; Tricks&#8217; with you \u2014 series of simple how-to articles for people who would like to know more about data analysis and visualization in Kibana. Today we will see how to view events in Kibana.  <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-382299","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/382299","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=382299"}],"version-history":[{"count":0,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=\/wp\/v2\/posts\/382299\/revisions"}],"wp:attachment":[{"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=382299"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=382299"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/savepearlharbor.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=382299"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}