Kibana do not select the field to be selected

Kibana do not select the field you want to select, that is, the term to filter the selected field when the Discovery list does not have this option.

650) this.width=650; "src=" Http://s3.51cto.com/wyfs02/M01/79/08/wKiom1aFAWuSYiPXAAAaSCMrdEo742.gif "style=" float: none; "title=" 3.gif "alt=" Wkiom1afawusyipxaaaascmrdeo742.gif "/>

Go to discover to see, found that this field is preceded by a question mark, click to prompt this field is not indexed, not for visualize and discover search.

Thinking:

From the source, the log is collected Logstash, conjecture may be because logstash need to follow certain rules to add this index, so focus on the Logstash filter

Here I am using Grok, guess is not after the message match need to use Add_field add before line.

Try:

Add Add_field after found no (I add_field use not very good, write wrong), and then Baidu related Grok format found, do not need to add Add_field can be used to search the field.

The attempt failed.

Think again:

Exclude Logstash, the back is elasticsearch, this itself basically did not make changes, exclusion, and then Kibana, suddenly thought to see between the written Tomcat error stack log field can be searchable, to see the log field found to be able to use, Go back to compare to the bottom of the lower Logstash found both the writing and patterns definitions are no different, to the basic can be identified as the Kibana of the setup problem.

Try:

Check the official document Kibana the relevant configuration location, try to view the setting, and did find that the relevant items in index:

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M02/79/08/wKiom1aFAW-j0Bx7AADa7MWGOTM207.gif "title=" 4.gif " Style= "Float:none;" alt= "Wkiom1afaw-j0bx7aada7mwgotm207.gif"/>

After the refresh the field is indexed, equivalent to in Kibana if the index is established, and then add the new field through Logstash, it needs to be refreshed here to update the state (do not know if restarting Kibana has the same effect, there is time to try).

This field will then be used normally.

This solves the problem.

This article is from the "Sky Kill" blog, please be sure to keep this source http://1645027.blog.51cto.com/1635027/1730540

Kibana do not select the field to be selected