CODEWITHSUNDEEP
elasticsearchlogstashkibana
mikeb
mikeb

Reputation: 11307

Kibana 4.1 - use JSON input to create an Hour Of Day field from @timestamp for histogram

Edit: I found the answer, see below for Logstash <= 2.0 ===>

Plugin created for Logstash 2.0

Whomever is interested in this with Logstash 2.0 or above, I created a plugin that makes this dead simple:

The GEM is here:

https://rubygems.org/gems/logstash-filter-dateparts

Here is the documentation and source code:

https://github.com/mikebski/logstash-datepart-plugin

I've got a bunch of data in Logstash with a @Timestamp for a range of a couple of weeks. I have a duration field that is a number field, and I can do a date histogram. I would like to do a histogram over hour of day, rather than a linear histogram from x -> y dates. I would like the x axis to be 0 -> 23 instead of date x -> date y.

I think I can use the JSON Input advanced text input to add a field to the result set which is the hour of day of the @timestamp. The help text says: Any JSON formatted properties you add here will be merged with the elasticsearch aggregation definition for this section. For example shard_size on a terms aggregation which leads me to believe it can be done but does not give any examples.

Edited to add:

I have tried setting up an entry in the scripted fields based on the link below, but it will not work like the examples on their blog with 4.1. The following script gives an error when trying to add a field with format number and name test_day_of_week: Integer.parseInt("1234")

The problem looks like the scripting is not very robust. Oddly enough, I want to do exactly what they are doing in the examples (add fields for day of month, day of week, etc...). I can get the field to work if the script is doc['@timestamp'], but I cannot manipulate the timestamp.

The docs say Lucene expressions are allowed and show some trig and GCD examples for GIS type stuff, but nothing for date...

There is this update to the BLOG:

UPDATE: As a security precaution, starting with version 4.0.0-RC1, Kibana scripted fields default to Lucene Expressions, not Groovy, as the scripting language. Since Lucene Expressions only support operations on numerical fields, the example below dealing with date math does not work in Kibana 4.0.0-RC1+ versions.

There is no suggestion for how to actually do this now. I guess I could go off and enable the Groovy plugin...

Any ideas?

EDIT - THE SOLUTION:

I added a filter using Ruby to do this, and it was pretty simple:

Basically, in a ruby script you can access event['field'] and you can create new ones. I use the Ruby time bits to create new fields based on the @timestamp for the event.

ruby {
                code => "ts = event['@timestamp']; event['weekday'] = ts.wday; event['hour'] = ts.hour; event['minute'] = ts.min; event['second'] = ts.sec; event['mday'] = ts.day; event['yday'] = ts.yday; event['month'] = ts.month;"
        }

Upvotes: 3

Views: 6389

Answers (1)

Xyon
Xyon

Reputation: 941

This no longer appears to work in Logstash 1.5.4 - the Ruby date elements appear to be unavailable, and this then throws a "rubyexception" and does not add the fields to the logstash events.

I've spent some time searching for a way to recover the functionality we had in the Groovy scripted fields, which are unavailable for scripting dynamically, to provide me with fields such as "hourofday", "dayofweek", et cetera. What I've done is to add these as groovy script files directly on the Elasticsearch nodes themselves, like so:

/etc/elasticsearch/scripts/ hourofday.groovy dayofweek.groovy weekofyear.groovy ... and so on.

Those script files contain a single line of Groovy, like so:

Integer.parseInt(new Date(doc["@timestamp"].value).format("d")) (dayofmonth) Integer.parseInt(new Date(doc["@timestamp"].value).format("u")) (dayofweek)

To reference these in Kibana, firstly create a new search and save it, or choose one of your existing saved searches (Please take a copy of the existing JSON before you change it, just in case) in the "Settings -> Saved Objects -> Searches" page. You then modify the query to add "Script Fields" in, so you get something like this:

{
    "query" : {
      ...
    },
    "script_fields": {
        "minuteofhour": {
          "script_file": "minuteofhour"
        },
        "hourofday": {
          "script_file": "hourofday"
        },
        "dayofweek": {
          "script_file": "dayofweek"
        },
        "dayofmonth": {
          "script_file": "dayofmonth"
        },
        "dayofyear": {
          "script_file": "dayofyear"
        },
        "weekofmonth": {
          "script_file": "weekofmonth"
        },
        "weekofyear": {
          "script_file": "weekofyear"
        },
        "monthofyear": {
          "script_file": "monthofyear"
        }
      }
    }

As shown, the "script_fields" line should fall outside the "query" itself, or you will get an error. Also ensure the script files are available to all your Elasticsearch nodes.

Upvotes: 0

Related Questions