I want to use Elasticserach and kibana alerts to detect line passing - elasticsearch

We would like to implement a system that draws a line on a map displayed by kibana in advance and detects when a moving object (such as a boat) passes through the line.
I believe a possible way to do this is to set up rules using Elasticsearch query from kibana's rule creation.
But I don't know how to realize it.
I drew a line by selecting create index in add layer from maps in kibana.
A json file containing location, speed, and time information was imported into elasticserch and displayed on a map.

Related

How Can I Use More Than One Index-Pattern In A Visualization In Kibana?

I have three index pattern that contain metrics for my application. I'd like to be able to correlate the time series data of this index-patterns at the same time on the SAME visualization. Is that possible? I've done this in Grafana before and I'm trying to do the same in Kibana but I'm not sure how.
I'm doing this so I can super-impose on set of metric data over another and have the user be able to see what the app is doing and what the host is doing. For instance, showing the API call latencies in a bar chart an then "super-imposing" metrics from another index-pattern (such a memory etc) seamlessly in the same visualization.
Is this possible?
Option 1: You can use the Lens visualization tool, which allows you to select different index patterns in the same chart.
Option 2: You can use the TSVB visualization tool, which allows you to set different index patterns for different metrics. To do so, you need to go to the "Options" tab of a metric, select "Yes" below "Override Index Pattern?" and set the desired index pattern in the text field besides.
Option 3: You can create a new index pattern that matches all the indices matched by the three original index patterns. Then, you can use the more inclusive index pattern to create visualizations.

using created Visualize Kibana for other index patterns (same data)?

I'm having a problem with using Visualize Kibana. At first I make some Visualize and saved them, then I made another index pattern with the same data but with another name index. So how can I use my old Visualize for my new index pattern?
Thanks all.
In recent versions of Kibana you may be able to do it form Management->Saved Objects, here you can manage all your saved objects:
open in Management the new index pattern you want to get in the visualization
get the UUID of the index pattern from the address bar in the browser
open the saved visualization (Management -> Saved Objects) and edit the kibanaSavedObjectMeta.searchSourceJSON parameter with the UUID of the index pattern you want
now the visualization will point to the new index
WARNING: with this method you can corrupt your saved objects and then you cannot recover them.
As of today, it seems to be an issue with no practical solution.
There is a new type of visualization called Lens, which allows to change the index from the one originally saved. Just enter to edit the visualization, and you will find the name of the current index in the leftmost column, and will be able to change it.
A downside is that Lens has not yet all types of graphics (for example heat maps), but will work for bars, lines and sectors.

Kibana not displaying any data

I created visualizations on fly through curl. However, it does not display data.
I have created visualizations by doing as follows
1. Exporting an already built visualization in JSON
2. Modifying the index_name and field names of JSON
3. Importing back the visualization
The visualizations are created in Kibana, they have the same visualization name and refer the index pattern and fields I want. However it does not display any data (graphs)
Can anyone explain what is the problem with the way I am doing ?
The problem was with the variable. I used for find and replacs. The variable I used was also being used to filter data and hence replacing it was not showing any data. My bad

How to create new Kibana visualization through REST?

I want to automate the creation of a set visualizations for new kibana/elasticsearch installations.
So I need to know if I can automate this, independent the programming language.
There are no APIs yet in Kibana to manage the searches, visualizations and dashboards. Some feature requests have been suggested (here and here) but they are still being discussed.
However, since Kibana visualizations are stored in the .kibana index with the visualization mapping type, you can definitely GET them, learn how they are built, modify them and PUT them again.
For a visualization named "Top consumers by country", you can get the visualization spec using
curl -XGET http://localhost:9200/.kibana/visualization/Top-consumers-by-country
You'll get a document containing the title of your visualization, another field called visState containing the specification of your visualization (obvisouly different for each visualization) and finally a field named kibanaSavedObjectMeta which contains the Elasticsearch query and index details.
You can also view/edit/export the same data in Settings > Objects > Visualizations

How to create visualisation on the fly using a script in Kibana 4

I have some requirement where I need to create different visualization for different users which will differ very slightly on the query param. So, I am considering to create a script which will enable me to do this.Have anyone done this on Kibana 4. Some pointers on how to create visualization using query would be of great help.
I would also like to create Dashboards on the fly but that can wait till I get this one sorted out.
If you want to go ahead with Java plugin (as mentioned in comments), here are the steps:
Create different visualizations with different X-axis parameters. Visualizations are basically json strings so you can write a java code which changes the value of x aggregation based on the mapping that you have. Now each chart will have different ids.
While you are creating a custom dashboard based on the user, check the mapping between user and the visualization and use the following command to add the visualization:
client.prepareIndex(,"visualization",).setSource().execute();

Resources