elasticsearch - 如何将日志数据作为Kibana图值

Question

我有一个日志文件，给出的持续时间:10 ，在我的日志文件中带有时间戳。当我在kibana中放置一个持续时间的搜索字段时，只要持续时间在日志文件中出现，我就能在图中获得一个点。我如何获取/设置图中点的值。

目前

10:12:34 Duration :510:17:19 Duration :7

Whenever Duration is coming a point is coming in the graph.How to set the value at the particular timestamp to 7/10 or whtever is corresponding value for duration.

my logstash conf file is as follows

input {

 file {

   path => "C:/log.txt"    

    }

}

 filter {
  extractnumbers {
  add_field => [ "Duration", "%{message}" ]
 }
}

output {

 stdout { codec => rubydebug } 
elasticsearch { 
 embedded => true 
}

}

Answer 1

您想做这样的事情:

grok {
   match => ["message", %{TIME:time}.*%{NUMBER:duration}]
}

date { match => [ "time", "HH:mm:ss" ] }