Skip to content

Instantly share code, notes, and snippets.

View ijokarumawak's full-sized avatar
🎯
Focusing

Koji Kawamura ijokarumawak

🎯
Focusing
84 followers · 16 following
  • Yokohama Japan
View GitHub Profile
@ijokarumawak
ijokarumawak / 0.README.md
Last active August 31, 2023 04:56
AdVEGAnt Calendar - A Vega visualization example to create Kibana filter

AdVEGAnt Calendar

image

This example dashboard contains a Vega visualization, which renders a Christmas tree! When each node in the tree is clicked, a corresponding Kibana filter is created, so that the advent calendar blog post can be seen on the TSVB Markdown on the right hand side.

I was planning to write a post for Japanese Elastic Stack (Elasticsearch) Advent Calendar 2022, but every slot is filled. Nice! So I'm sharing it here... :)

@ijokarumawak
ijokarumawak / vega-sample.json
Created December 13, 2022 11:04
{
"$schema": "https://vega.github.io/schema/vega/v5.json",
"description": "A basic bar chart example, with value labels shown upon mouse hover.",
"data": [
{
"name": "table",
"values": [
{"name": "A", "current": 28, "upper": 80, "lower": 20},
{"name": "B", "current": 55, "upper": 70, "lower": 30},
{"name": "C", "current": 43, "upper": 60, "lower": 20},
@ijokarumawak
ijokarumawak / 0_README.md
Last active November 8, 2022 06:34
A simple Logstash example.

Simple Logstash example

  • Load CSV data
  • Apply some filters
  • Changing index name besed on value

How to run

Clone this Gist on your host.

@ijokarumawak
ijokarumawak / 0_README.md
Last active June 15, 2022 09:34
Use Logstash ruby filter to rename field name based on value type to avoid Elasticsearch mapping conflict

This is Logstash ruby filter example to rename field names within a specified hash, based on each value type. The original question was asked at this Elastic Discuss.

How to test the filter

With -t, the filter can be tested:

logstash -e "filter { ruby { path => '/{path_of_the_ruby_script}/rename_by_data_type.rb' script_params => { 'field' => 'the_name_of_target_field' } } }" -t

Output:

@ijokarumawak
ijokarumawak / 0.Runtime Field Dashboard sample.md
Last active April 12, 2022 05:54
Runtime Field を利用した Kibana ダッシュボードサンプル

Runtime Field を利用した Kibana ダッシュボードサンプル

"socks_a" のように、カテゴリ名_会社名という値を Runtime field を使い、カテゴリ名、会社名と別々のフィールドとして扱うサンプル。

# 1. サンプルデータの登録
POST items-sample/_bulk
{"index": {}}
{"sku":"socks_a","price":500}
{"index": {}}
@ijokarumawak
ijokarumawak / ReusableTimeUnitExtractionPainlessScript.md
Last active March 11, 2022 09:37
A stored Painless script example for Elasticsearch Ingest node pipeline to extract certain time unit from a timestamp value. 
# Create a stored script
PUT _scripts/getTimestampUnitValue
{
  "script": {
    "lang": "painless", 
    "source": """
    def value = ctx[params['field']];
    if (value == null) {
      return;
@ijokarumawak
ijokarumawak / Query timestamp only by hours.md
Created December 15, 2021 03:10
A runtime field example at query time. 
GET blogs/_search
{
  "runtime_mappings": {
    "publish_hour": {
      "type": "long",
      "script": {
        "source": "emit(doc['publish_date'].value.hour)"
      }
 }
@ijokarumawak
ijokarumawak / Kibana-Lens-multi-metrics.md
Last active October 19, 2021 02:13
Show multiple metrics in the same Kibana Lens chart

Show two metrics using different chart styles.

  • Use two layers, line chart and bar chart
  • Use the same x-axis among the two layers, order_date date histogram in this example
  • Use different colors
  • Separate y-axis
@ijokarumawak
ijokarumawak / test-beats-processors.md
Last active February 15, 2022 10:57

How to test Beats processors

To test Beats processors, beats playground can be helpful.

Input:

2019-09-29 STATUS_OK Server started normally. 92ms
2019-09-30 STATUS_OK Server started normally. 120ms
2019-10-01 STATUS_NG Server stopped abnormally. Timed out. 3010ms
@ijokarumawak
ijokarumawak / README.md
Created July 26, 2021 08:43
EQL example.

Set up a Data Stream

# Delete the stream in order to clear old data
DELETE _data_stream/my-event-stream

# Define a template
PUT /_index_template/my-event-stream-template
{
  "index_patterns": [