画布 1
Kibana
  主界面
    Discover
      输入 input
        ("查询句子1" OR "查询句子2" )
          k:v and k:("literal")
          “v” or "v"
        options
          Syntax options
      左上角是 search 名称 + hits 总数：leads.errorAlarm 21hits
      上方是
        share this search
        new
          新增搜索
        Save
          保存搜索
        Open
          Open Search
            Manage Search
            Title
            Rows per page: 10
        Share
          CSV reports
          Permalinks
        Inspect
          leads.errorAlarm
已保存的索引名
          View: Requests
            View the requests that collect the data
          主界面
            1 request was made
            Request: Segment 0
              This request queries Elasticsearch to fetch the data for the search.
              3101ms 成功会有个打钩标记
            Statistics
              Hits
                165
              Hits (total)
                165
              Index pattern
                leads-log-*
              Index pattern ID
                0821a770-289a-11eb-afc0-0774f1e70642
              Query time
                741ms
              Request time
                3103ms
            Request
              {
"version": true,
"size": 500,
"sort": [
{
"@timestamp": {
"order": "desc",
"unmapped_type": "boolean"
}
}
],
"_source": {
"excludes": []
},
"aggs": {
"2": {
"date_histogram": {
"field": "@timestamp",
"interval": "10m",
"time_zone": "Etc/UTC",
"min_doc_count": 1
}
}
},
"stored_fields": [
"*"
],
"script_fields": {},
"docvalue_fields": [
{
"field": "@timestamp",
"format": "date_time"
}
],
"query": {
"bool": {
"must": [
{
"query_string": {
"query": "(\"report tnm2 string attribute with id:1448029\" OR \"report tnm2 string attribute with id:1894333\" OR \"report tnm2 string attribute with id:1746078\" OR \"report tnm2 string attribute with id:1893119\" OR \"report tnm2 string attribute with id:1771832\" OR \"report tnm2 string attribute with id:1867188\")",
"analyze_wildcard": true,
"default_field": "*"
}
},
{
"range": {
"@timestamp": {
"gte": 1651968000000,
"lte": 1652054399999,
"format": "epoch_millis"
}
}
}
],
"filter": [],
"should": [],
"must_not": []
}
},
"highlight": {
"pre_tags": [
"@kibana-highlighted-field@"
],
"post_tags": [
"@/kibana-highlighted-field@"
],
"fields": {
"*": {}
},
"fragment_size": 2147483647
}
}
            Response
        Auto-refresh
        时间范围
          下方的柱状图的缩放和本时间范围的变动是同步的
      Add a filter+
        增加 filter 可以对查询结果做进一步过滤
        Filter
          先选择 fields
            log.offset is 50
          再选择 Label
            Label 本身是可选的
      索引复选框
        索引模式 index pattern
        leads-log-*
      Selected fields
        默认选中的有
          _source
            This field is present in your Elasticsearch mapping but not in the 500 documents shown in the doc table. You may still be able to visualize or search on it.
      Available fields
        设置
          Aggregatable
            默认选项
            any
            yes
            no
          Searchable
            默认选项
            any
            yes
            no
          Type
            默认选项
            any
            yes
            no
          Field name
          Hide missing fields
        Popular
          蓝色区域
            _index
              点开每个field可以看到 Top 5 values in 500/500 records 的排名
                每个排名值都可以进行”filter for value“(+)和”filter out value”两种操作(-)
            content
            date
            fields.fileName
            host.ip
            log.offset
            thread
          灰色区域
            @timestamp
            _id
            _score
            _type
            host.id
            level
            logger
      主界面
        这是一个扁平化的 kv 表，有些_source只有 content，有些 _source有下面所有的内容
        时间范围
          May 8th 2022, 00:00:00.000 - May 8th 2022, 23:59:59.999
          时间颗粒度
            Auto
            MilliSecond
            Second
            Minute
            Hourly
            Daily
            Weekly
            Monthly
            Yearly
        时间柱状图
          @timestamp per 30 minutes
        Time
          May 10th 2022, 11:55:59.292
            子时间戳都可要在 000 和 999 的精度之间切换
        _source
          content
            原始的 logger 里的 msg
          date
            2022-05-10 11:55:59 292
          level
            INFO
          log.offset
            63721527
          logger
          thread
          @timestamp
          host.ip
          host.id
          fields.fileName
          "host"
            所有的 json 结构体内部都藏有一个 fields 的 json
            {
"ip": [
"9.147.246.29"
],
"id": "71adcf8eed5b47dab4980eccf6a042df"
},
            fields
              fileName
                application.log
          fields
            @timestamp
              2022-05-10T11:55:59.292Z
        Table
          (+)
          (-)
          一页书
            toggle column in the table
          Filter for field present
          没有下划线的是doc自己的 field，有下划线的是es为文档内置的 field
        JSON
          原始的 ES 查询结果
    Visualize
      Title
      Type
        Data Table
          搜索条件
            consumeTime:>0 AND action:("custom/page")
          索引模式
            fyec_action*
          Data
            Metrics
              可以加多个Metric，count 是一个metric，xx是另一个metric
              Add metrics
                Aggregation
                  Metric Aggregations
                    Average
                    Count
                    Max
                    Median
                    Min
                    Percentail Ranks
                    Percentiles
                    Standard Deviation
                    Sum
                    Top Hit
                    Unique Count
                  Parent Pipeline Aggregations
                    Cumulative Sum
                    Derivative
                    Moving Avg
                    Serial Diff
                  extracted field/script-generated field -> aggregator -> metrics aggregation
                Custom Label
            Buckets
              select buckets type
                Split Rows
                  enable aggregations
                    Aggregation
                      Terms
                      Significant Terms
                      Range
                      IPv4 Range
                      Histogram
                      Geohash
                      Filters
                      Date Range
                      Date Histogram
                    Field
                      String
                        field 111
                        field 222
                        field 333
                      Date
                        createTime
                      Number
                        xxxId
                        xxxTime
                        xxxCount
                    Order By
                      mertric: Count
                        自然按照 count 进行总排名
                      Custom Metric
                      Alphabetical
                    Order
                      Descending
                      Ascending
                    Size
                      5
                    Group other values in separate bucket
                      Label for other bucket
                        Other
                    show missing values
                    Custom Label
                Split Table
              每一个配置是一种 Dimenssion，所以可以 remove dimenssion
          Options
            Per Page
              10
              checkbox
                Show metrics for every bucket/level
              checkbox
                Show partial rows
              checkbox
                Calculate metrics for every bucket/level
              checkbox
                Show total
            Total function
              sum
        Line
      Add
        Select visualization type
          Basic Charts
            Area
            Heat Map
            Horizontal Bar
            Line
            Pie
            Vertical Bar
          Data
            Data Table
            Gauge
          Maps
          Time Series
          Other
    Dashboard
    Timelion
      time series interface for everything.
    Canvas
      Canvas workpads
        Workpad Name
        Import workpad JSON file
        Create workpad
    MachineLearning
      Job Management
      Anomaly Explorer
      Single Metric Viewer
      Data Visualizer
        The Machine Learning Data Visualizer tool helps you understand your data, by analyzing the metrics and fields in a log file or an existing Elasticsearch index.
        这是一个需要白金订阅的功能
      Settings
    Infrastructure
    Logs
    APM
    Dev Tools
    Monitoring
    Management