Skip to content

Instantly share code, notes, and snippets.

@brainstorm

brainstorm/kibana_pacemaker.json

Last active August 29, 2015 14:06
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save brainstorm/08b73aec05549c349890 to your computer and use it in GitHub Desktop.
Save brainstorm/08b73aec05549c349890 to your computer and use it in GitHub Desktop.
Download ZIP
kibana_pacemaker.json
Raw
kibana_pacemaker.json
{
"title": "Pacemaker",
"services": {
"query": {
"list": {
"0": {
"query": "verb='GET'",
"alias": "GET",
"color": "#7EB26D",
"id": 0,
"pin": true,
"type": "lucene",
"enable": true
},
"1": {
"id": 1,
"color": "#EAB839",
"alias": "POST",
"pin": true,
"type": "lucene",
"enable": true,
"query": "verb='POST'"
},
"2": {
"id": 2,
"color": "#6ED0E0",
"alias": "PUT",
"pin": true,
"type": "lucene",
"enable": true,
"query": "verb='PUT'"
},
"5": {
"id": 5,
"color": "#1F78C1",
"alias": "agent",
"pin": true,
"type": "lucene",
"enable": true,
"query": "agent"
},
"6": {
"id": 6,
"color": "#DEDAF7",
"alias": "all",
"pin": true,
"type": "lucene",
"enable": true,
"query": "*"
}
},
"ids": [
0,
1,
2,
5,
6
]
},
"filter": {
"list": {
"0": {
"from": "2014-05-01T19:31:18.292Z",
"to": "now",
"type": "time",
"field": "@timestamp",
"mandate": "must",
"active": true,
"alias": "",
"id": 0
},
"1": {
"type": "time",
"from": "2014-06-12T01:59:23.799Z",
"to": "2014-09-14T07:20:40.581Z",
"field": "@timestamp",
"mandate": "must",
"active": true,
"alias": "",
"id": 1
}
},
"ids": [
0,
1
]
}
},
"rows": [
{
"title": "Graph",
"height": "350px",
"editable": true,
"collapse": false,
"collapsable": true,
"panels": [
{
"span": 12,
"editable": true,
"group": [
"default"
],
"type": "histogram",
"mode": "count",
"time_field": "@timestamp",
"value_field": null,
"auto_int": true,
"resolution": 100,
"interval": "12h",
"fill": 3,
"linewidth": 3,
"timezone": "browser",
"spyable": true,
"zoomlinks": true,
"bars": false,
"stack": true,
"points": false,
"lines": true,
"legend": true,
"x-axis": true,
"y-axis": true,
"percentage": false,
"interactive": true,
"queries": {
"mode": "selected",
"ids": [
0,
1,
2
]
},
"title": "Events over time",
"intervals": [
"auto",
"1s",
"1m",
"5m",
"10m",
"30m",
"1h",
"3h",
"12h",
"1d",
"1w",
"1M",
"1y"
],
"options": true,
"tooltip": {
"value_type": "cumulative",
"query_as_alias": true
},
"scale": 1,
"y_format": "none",
"grid": {
"max": null,
"min": 0
},
"annotate": {
"enable": false,
"query": "*",
"size": 20,
"field": "_type",
"sort": [
"_score",
"desc"
]
},
"pointradius": 5,
"show_query": true,
"legend_counts": true,
"zerofill": true,
"derivative": false
},
{
"error": false,
"span": 12,
"editable": true,
"type": "bettermap",
"loadingEditor": false,
"field": "geoip.coordinates",
"size": 1000,
"spyable": true,
"tooltip": "_id",
"queries": {
"mode": "all",
"ids": [
0,
1,
2,
5,
6
]
},
"title": "pacemaker world (subset=1000)"
},
{
"error": false,
"span": 6,
"editable": true,
"type": "terms",
"loadingEditor": false,
"field": "httpversion",
"exclude": [],
"missing": false,
"other": true,
"size": 10,
"order": "count",
"style": {
"font-size": "10pt"
},
"donut": true,
"tilt": false,
"labels": true,
"arrangement": "horizontal",
"chart": "pie",
"counter_pos": "above",
"spyable": true,
"queries": {
"mode": "selected",
"ids": [
6
]
},
"tmode": "terms",
"tstat": "total",
"valuefield": "",
"title": "http versions"
},
{
"error": false,
"span": 6,
"editable": true,
"type": "terms",
"loadingEditor": false,
"field": "response",
"exclude": [],
"missing": false,
"other": true,
"size": 5,
"order": "count",
"style": {
"font-size": "10pt"
},
"donut": false,
"tilt": false,
"labels": true,
"arrangement": "horizontal",
"chart": "pie",
"counter_pos": "above",
"spyable": true,
"queries": {
"mode": "all",
"ids": [
0,
1,
2,
5,
6
]
},
"tmode": "terms",
"tstat": "total",
"valuefield": "",
"title": "responses"
},
{
"error": false,
"span": 6,
"editable": true,
"type": "terms",
"loadingEditor": false,
"field": "agent",
"exclude": [],
"missing": false,
"other": true,
"size": 5,
"order": "count",
"style": {
"font-size": "10pt"
},
"donut": false,
"tilt": false,
"labels": true,
"arrangement": "horizontal",
"chart": "bar",
"counter_pos": "above",
"spyable": true,
"queries": {
"mode": "all",
"ids": [
0,
1,
2,
5,
6
]
},
"tmode": "terms",
"tstat": "total",
"valuefield": "",
"title": "agents"
},
{
"error": false,
"span": 6,
"editable": true,
"type": "terms",
"loadingEditor": false,
"field": "bytes",
"exclude": [],
"missing": true,
"other": true,
"size": 25,
"order": "count",
"style": {
"font-size": "10pt"
},
"donut": false,
"tilt": false,
"labels": true,
"arrangement": "horizontal",
"chart": "bar",
"counter_pos": "above",
"spyable": true,
"queries": {
"mode": "selected",
"ids": [
6
]
},
"tmode": "terms",
"tstat": "total",
"valuefield": "",
"title": "bytes"
},
{
"error": false,
"span": 6,
"editable": true,
"type": "terms",
"loadingEditor": false,
"field": "clientip",
"exclude": [],
"missing": true,
"other": true,
"size": 17,
"order": "count",
"style": {
"font-size": "10pt"
},
"donut": false,
"tilt": false,
"labels": true,
"arrangement": "horizontal",
"chart": "table",
"counter_pos": "above",
"spyable": true,
"queries": {
"mode": "all",
"ids": [
0,
1,
2,
5,
6
]
},
"tmode": "terms",
"tstat": "total",
"valuefield": "",
"title": "unique ips"
},
{
"error": false,
"span": 6,
"editable": true,
"type": "terms",
"loadingEditor": false,
"field": "request",
"exclude": [],
"missing": true,
"other": true,
"size": 17,
"order": "count",
"style": {
"font-size": "10pt"
},
"donut": false,
"tilt": false,
"labels": true,
"arrangement": "horizontal",
"chart": "table",
"counter_pos": "above",
"spyable": true,
"queries": {
"mode": "all",
"ids": [
0,
1,
2,
5,
6
]
},
"tmode": "terms",
"tstat": "total",
"valuefield": "",
"title": "urls"
}
],
"notice": false
},
{
"title": "Events",
"height": "350px",
"editable": true,
"collapse": false,
"collapsable": true,
"panels": [
{
"title": "All events",
"error": false,
"span": 12,
"editable": true,
"group": [
"default"
],
"type": "table",
"size": 10,
"pages": 5,
"offset": 0,
"sort": [
"@timestamp",
"desc"
],
"style": {
"font-size": "9pt"
},
"overflow": "min-height",
"fields": [],
"localTime": true,
"timeField": "@timestamp",
"highlight": [
"agent"
],
"sortable": true,
"header": true,
"paging": true,
"spyable": true,
"queries": {
"mode": "all",
"ids": [
0,
1,
2,
5,
6
]
},
"field_list": true,
"status": "Stable",
"trimFactor": 300,
"normTimes": true,
"all_fields": false
}
],
"notice": false
}
],
"editable": true,
"failover": false,
"index": {
"interval": "day",
"pattern": "[logstash-]YYYY.MM",
"default": "NO_TIME_FILTER_OR_INDEX_PATTERN_NOT_MATCHED",
"warm_fields": true
},
"style": "dark",
"panel_hints": true,
"pulldowns": [
{
"type": "query",
"collapse": false,
"notice": false,
"query": "*",
"pinned": true,
"history": [
"*",
"agent",
"verb='PUT'",
"verb='POST'",
"verb='GET'",
"httpversion='1.1'",
"http='1.0'",
"httpversion=1.1"
],
"remember": 10,
"enable": true
},
{
"type": "filtering",
"collapse": true,
"notice": true,
"enable": true
}
],
"nav": [
{
"type": "timepicker",
"collapse": false,
"notice": false,
"status": "Stable",
"time_options": [
"5m",
"15m",
"1h",
"6h",
"12h",
"24h",
"2d",
"7d",
"30d"
],
"refresh_intervals": [
"5s",
"10s",
"30s",
"1m",
"5m",
"15m",
"30m",
"1h",
"2h",
"1d"
],
"timefield": "@timestamp",
"now": false,
"filter_id": 0,
"enable": true
}
],
"loader": {
"save_gist": false,
"save_elasticsearch": true,
"save_local": true,
"save_default": true,
"save_temp": true,
"save_temp_ttl_enable": true,
"save_temp_ttl": "30d",
"load_gist": true,
"load_elasticsearch": true,
"load_elasticsearch_size": 20,
"load_local": true,
"hide": false
},
"refresh": false
}
Raw
logstash.conf
input {
file {
type => "nginx-access"
start_position => beginning
sincedb_path => "./sincedb"
path => [ "somelogs.log" ]
}
}
filter {
if [type] == "nginx-access" {
grok {
patterns_dir => "/etc/logstash/conf.d/patterns"
match => { "message" => "%{NGINXACCESS}" }
}
date { match => [ "timestamp", "dd/MMM/YYYY:HH:mm:ss Z" ]
locale => "en" }
# GeoIP
if [clientip] {
geoip {
source => "clientip"
target => "geoip"
add_field => [ "[geoip][coordinates]", "%{[geoip][longitude]}" ]
add_field => [ "[geoip][coordinates]", "%{[geoip][latitude]}" ]
add_tag => ["geoip"]
}
mutate {
convert => [ "[geoip][coordinates]", "float" ]
}
}
}
}
output {
elasticsearch {
host => "0.0.0.0"
cluster => pacemaker
port => 9300
bind_host => "localhost"
# Month-based indexing, daily is too expensive
index => "logstash-%{+YYYY.MM}"
}
}
Raw
nginx_patterns
NGUSERNAME [a-zA-Z\.\@\-\+_%]+
NGUSER %{NGUSERNAME}
NGINXACCESS %{IPORHOST:clientip} %{NGUSER:ident} %{NGUSER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} (?:%{NUMBER:bytes}|-) (?:"(?:%{URI:referrer}|-)"|%{QS:referrer}) %{QS:agent}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment