ELK7 ---- Basic operation of Kibana7.x

Basic operation of Kibana 7.x

 

Kibana

Kibana is a web application, you can access it through 5601.
The 7.x version is already minimalist style, and the menu bar on the left is also minimalist icon style, but the main functions are as follows:
Kibana visual management page detailed instructions
Use a browser to visit, for example: localhost:5601 Default port , Enter the homepage
Discover: log management view to search and query
Visualize: statistical view to build a visual chart
Dashboard: instrument view to combine the constructed charts to form a chart disk
Timelion: time axis view data over time
APM: performance management view application Program performance management system
Canvas: Large screen display
Dev Tools: Developer command view development tool
Monitoring: Health view request access to performance warning
Management: Management view management tool

The most important and most commonly used are the first three and the last management roles and users, including index creation. The others are also introduced below:

Kibana's basic operations on ES

The basic configuration of connecting ES is as follows

server.port: 5601
server.host: "localhost"
elasticsearch.hosts: ["http://localhost:9200"]
kibana.index: ".kibana"

Start ES and kibna to
open the kibana page, click on the development tool on the left to see that the console command line can directly execute ES's REST style API, and the right is the return result

of the query. Use this tool to review the basic ES operation API, common queries Methods as below

GET /_cat/nodes?v
# 查询所有索引
GET /_cat/indices?v
GET /_cat/indices?v&h=health,status,index
# 创建索引
PUT /bamboo
# 删除索引
DELETE /bamboo
# 创建索引对应的mapping和setting
PUT /bamboo 
{
  "mappings": { 
      "properties": { 
        "title":    { "type": "text"  }, 
        "name":     { "type": "text"  }, 
        "age":      { "type": "integer" },  
        "created":  {
          "type":   "date", 
          "format": "strict_date_optional_time||epoch_millis"
        }
      }
    },
  "settings":{
    "index":{
    "number_of_shards": 5,
    "number_of_replicas": 1
    }
  }
}

#获取当前索引的setting信息
GET /bamboo/_settings
GET /bamboo/_mapping
# 获取所有的索引mapping信息
GET _all/_mapping

#添加一条数据
PUT /bamboo/_doc/1
{
  "name":"zs",
  "title":"张三",
  "age":18,
  "created":"2018-12-25"
}

# 修改一条数据的某个属性值
PUT /bamboo/_doc/1 
{
  "name":"lxs",
  "title":"李小四"
}

GET /bamboo/_doc/100

DELETE /bamboo/_doc/1

# 批量插入多个document,_id不指定则系统生成字符串
POST /bamboo/_doc/_bulk 
{"index":{"_id":2}}
{"name":"ww","title":"王五","age":18,"created":"2018-12-27"}
{"index":{}}
{"name":"zl","title":"赵六","age":25,"created":"2018-12-27"}


# 批量操作（包含修改和删除）
POST /bamboo/_doc/_bulk
{"update":{"_id":"1"}} 
{"doc":{"title":"王小五"}}
{"delete":{"_id":"2"}}


#只获取字段name,age
GET /bamboo/_doc/1?_source=name,age

# 聚集查询 id为1,2的数据
GET /bamboo/_doc/_mget
{
"docs":[
   {
       "_id": 2
   },
   {
       "_id": 1
   }
 ]
}


GET /bamboo/_doc/_search 
{"query":{"bool":{"must":[{"match_all":{}}],"must_not":[],"should":[]}},"from":0,"size":10,"sort":[],"aggs":{}}

•  

discover use

To add a new log collection item, click Management-> Index Patterns, such as adding nginx system logs. Note that the latter do not forget.
Create nginx here and set @timestamp as index matching. The following data will be queried based on this timestamp to

delete the log collection items in kibana, click the patern to enter -> click the delete icon.
By default, kibana needs to set a default index. To
set the default index, click the five-pointed star icon, so that the required interface will be automatically displayed according to the default index in other modules, otherwise the empty index will not be used.

Click discover, and the salary space of the default index will be displayed. The displayed data is 15 minutes by default. You can adjust the time period and refresh the query to the data you want. If the index mode you choose is configured with a time field, the distribution of documents over time will be displayed in the histogram at the top of the page.

By default, the list in the lower right corner will display all fields. In the field under the Available fields on the left, select add to add only the fields you selected to the list.

Reference

Kibana (a picture is worth tens of millions of lines of log)
https://www.cnblogs.com/cjsblog/p/9476813.html
ESstack video explanation
http://www.elastictech.cn/videos