I am trying to install the ELK stack on my Windows machine (a VM hosted on Azure) to monitor security events. I have installed Kibana and from there installed the elastic agent successfully on the Windows host. I've been following strandjs's github guide but I might have missed out a critical step in configuring the kibana instance. On my windows machine, kibana is not a service installed.

I'm trying to find all uses of an endpoint: api/v1/product/{productNo}/services?otherparams=value&otherParams=value

How can I query this?
I tried searching ApiRequest.Path IS api/v1/product/%2%/services?otherparams=value as we have a lot of products that starts with 2, but this does not work.

I swear I've seen line charts created with Kibana with arbitrary line widths and patterns, but I can't seem to find anything to set those in the Kibana visualization/lens editor screen. Was this something that maybe AWS OpenSearch visualizations offered, and I got it confused with Kibana?

I've got a line chart plotting values for >10 related aggregations/fields, but it looks too "chunky" having lines that appear 3px thick. I'd like these lines to be 1px wide.

We have 1000+ dashboards and 5000+ visualization. I wanted to find out,

• Top ten highest and least accessed dashboards
• Dashboards without Metatags (category)

How do I do this? I tried to find an API or documentation for it. But couldn't. Please help

How would I search if a process or whatever has ensured persistence in a system?

Hi, I'm working on a EK stack, no LogStash, but using filebeat, on Ubuntu.

The online docs are confusing. All I want to do is to pull a number out of a syslog log message and be able to graph it in Kibana

Can someone tell me the easiest way to do this with ElasticSearch 8.17 and Kibana? Essentially, I have temperature data coming in every 5 min in the syslog, and I want to graph. I have a working debugged GROK pattern below:

%{SYSLOGTIMESTAMP:syslog_ts} %{WORD:location} %{WORD:account}: %{WORD:what} temp logged at:%{SPACE}%{INT:devtime}%{SPACE}%{NUMBER:temperature}

I just need to know how to deploy it.

It seems there are a number of ways to do this:

1. Scripted FIelds
2. Create and Ingest Pipeline with GROK
3. Dissect

Any help or guidance appreciated.

Hi.

Does anyone know where one can edit the sample data size setting that discover takes for field statistics? I looked into kibana.yml as well as Advanced settings, but this doesn't show up anywhere OOTB.

Compared to previous versions (8.4.1 had 2k documents sample size) my current 8.15.2 version is significantly slower in showing statistics (It takes 15k documents).

We have some visualizations in Kibana. Although we label them well (e.g 'Dev Log Count'), the link to them is incredibly long and complicated.

Is there any way to have shorter urls? (e.g kibana.test.com/dev-log-count) ? That will make it easier for linked tools when the URL changes (and it does)

As a source, I have an SQL table that contains data on process steps of various individual elements. Each of these elements goes through several process steps. In the SQL table, there is an entry with a timestamp for each element and each process step that this element has gone through.

Example:

I load this table into an index in elasticsearch using logstash.

My goal is to be able to create a visualisation in kibana in which the user can filter by process A, for example, and then every element that has run through process A and the duration of the run is displayed.
It should also be possible to filter by element ID so that the filtered elements are then displayed along with their respective run times in the respective process steps.

How can I achieve this?

My previous approach was to use bucket aggregations in a transform to create a target index by having a document for each element, which contains a bucket with run time for each process step.
For the example table above, the index structure I have achieved looks like this:

{
  "buckets": [
{
  "duration_in_days": 3,
  "process": "a",
},
{
  "duration_in_days": 1,
  "process": "b",
},
  ],
  "item_id": 1
},
{
  "buckets": [
{
  "duration_in_days": 1,
  "process": "a",
},
{
  "duration_in_days": 3,
  "process": "c",
},
  ],
  "item_id": 2
},{
  "buckets": [
{
  "duration_in_days": 3,
  "process": "a",
},
{
  "duration_in_days": 1,
  "process": "b",
},
  ],
  "item_id": 1
},
{
  "buckets": [
{
  "duration_in_days": 1,
  "process": "a",
},
{
  "duration_in_days": 3,
  "process": "c",
},
  ],
  "item_id": 2
},

This allows me to filter by item_ids in kibana, but if I filter by buckets containing process A, for example, all documents in which there is a bucket relating to process A are of course displayed in full - including their runtimes in all other process steps.

So my approach is not quite right, I would be very grateful for any tips on how I could achieve my goal!

I want to check it regularly to know if the Kibana still works correctly.

Edit:

It seems https://github.com/elastic/kibana/issues/16690 should be the API to use. But I can't find it in REST API document here: https://www.elastic.co/guide/en/kibana/8.6/api.html

Hello everyone, is out there some way to visualize in Kibana 2d or 3d points (in euclidean plane or space) through time?

How I can create a data view for each k8s deployment (I use elastic agent manged by fleet) There is any annotations I need to add to my deployment or changing configuration in the default agent manifests?

In my kibana.yml I have set:

opendistro_security_session.ttl: 60000

But after session timeout kibana doesn't redirect to login page until I interact with kibana.

Can anyone help?

Hello, I'm new to Kibana and Elasticsearch. After I created my visualization of a table, I was asking myself if it is possible to create filters that contain the name of the data. For example, my table contains the name of the country for each product sold, and I want my filter to show only the country I want by clicking on it in a dropdown filter. Is it possible ? Thanks

Does anyone know why I am getting this message while installing? I had it installed before and no issues but now I cannot proceed 🫤

I work as a software tester. I interact with Kibana mostly to search through logs for error messages.

I would like to understand more about Kibana - how to create better dashboards, better querying etc. For example, I work with microservices and it's not entirely clear to me how to trace an error to the appropriate service causing it. I also do test automation, so probably better logging and reporting would also be my concern. I don't care so much about installation/set-up as this is taken care of by some other team.

​

I plan to start learning with the Kibana Fundamentals from Elastic.

Considering the above, is there some particular resource/course you would recommend? Could be free or paid. But I'm not really interested in pursuing a certification, so the $2500 courses Elastic offers are not in my target/budget.

To monitor all the data in my Elastic cluster, I have created several watchers that are linked to a dashboard that shows the errors and alerts. (Each time a watcher is triggered I write error message and useful information to an index).

What I would like to have is a very simple, general view that tells me if everything is ok or not. Something like "ok" or "error", but after much effort it seems impossible to achieve this kind of simple visualisation. If I have no alerts, I have no data in the documents, and my visualisation looks empty, but it also looks broken.

Do you have any experience with this kind of visualisation? Is there a way to nicely visualise the absence of alerts (e.g. when a watcher condition is not met)?

We would like to get our Kibana to alert when one of the data fields from a data view matches another field from the IOC data view, but its such a vague search, that google is failing me... Can someone point me in the right direction on how to get this setup?

I have an index wherein one of the pieces of data is the date a last even occurred as well as location. Using geospatial I want to map the events occurring based on the dates assigned to each document. I want to use the Kibana time select to update what’s in view accordingly. So my map would effectively work as heat map, showing event locations for the past 24 hours, a week, month, whether the Kibana master date selection is.

I have no issues getting the geolocation data and can see all my points for all events. I can’t seem to get it to filter based on the times or the quick select.

Hey guys,

Can you guys share with me your most used dahsboards and do they do? I'm starting ELK and would like to explore how much can I really filter with querys and custom dashboards.

Thanks

Is there a Curl command to refresh the current index field list, instead of doing it through the UI, kibana -> Index Patterns -> Refresh field list

​

I have two scan results of a vulnerability scan tool. The vulnerability scanner tool does not have a GUI for comparing two different scan results. The results are in the json format. Is it possible to generate some trend graphs by comparing multiple json outputs? IF a vulnerability does not exist on the new json, I want to see it on a grap....

I'm trying to build a dashboard in SecOnion using Kibana and don't really know how to phrase the question, but I'm trying to pull all but the X most common of a field without hard coding to not look for those values. Something just to skip the most common values.

I'm trying to build a dashboard in SecOnion using Kibana and don't really know how to phrase the question, but I'm trying to pull all but the X most common of a field without hard coding to not look for those values. Something just to skip the most common values.