Kibana Query Syntax

Kibana 使用 Lucene 語法

example :

syslog_program:sshd AND message:"Failed password"

條件 :

AND, OR, NOT

Fuzzy :

roam~

Wildcard :

te?t, test*

References :
Apache Lucene - Query Parser Syntax 

Logstash + Elasticsearch + Kibana

$ vi logstash.conf

Apache setting
Collect & visualize your logs with Logstash, Elasticsearch & Redis | Michael Bouvy

rsyslog settingLogging with Logstash - Hron's blog

$ java -Xmx256m -jar logstash-1.3.3-flatjar.jar agent --config logstash.conf --log logstash.log

Kibana dashboard customize

References :
Real time analytics with Elasticsearch and Kibana3 | thoughts.each{ blog it }

Kibana Installation

Apache :

// download Kibana
$ cd /var/www
$ wget http://download.elasticsearch.org/kibana/kibana/kibana-latest.zip
$ unzip kibana-latest.zip

// setting
$ mv kibana-latest kibana
$ cd kibana
$ vi config.js

// Set the elasticsearch parameter to the fully qualified hostname of your Elasticsearch server

http://localhost/kibana-latest


ElasticSearch site plugin :

# cd /usr/share/elasticsearch
# bin/plugin -url http://download.elasticsearch.org/kibana/kibana/kibana-latest.zip -install elasticsearch/kibana3

http://localhost:9200/_plugin/kibana3


To Remove :

# cd /usr/share/elasticsearch
# bin/plugin --remove elasticsearch/kibana4

References :
Elasticsearch.org Kibana | Installation | Elasticsearch
elasticsearch/kibana
データ可視化に便利なkibanaは、elasticsearchのsiteプラグインとして構成すると便利 #fluentd - Y-Ken Studio