Use case

[WillemDH]

Hello,

I was looking for a way to provide a simple webpage for querying certain logs. This webpage would consist of a 'Google like' blank page with one simple searchbox. Putting a searchterm in this box would only search specific types of logs.

Would something described above doable with NLS? I don't want to expose the Kibana ui to certain users. They just need to search for simple things. I understand this is not in the scope of NLS support and I'm happy with any suggestion or link to documentation on how to set up such a thing.

Grtz

Willem

[jomann]

Hi Willem,

When you make a query in NLS on a dashboard and it returns data - you'll see an "( i )" button on the upper-right corner of your panels. Those will give you the query you did to get the data it's displaying. An example query from right now is below... in order to make something like you mentioned you would have to take this kind of query and run it when someone types something into the box. You can pre-fill part of the query field and then if you read the elasticsearch documentation on how to do a full query you'll get more info on the types of things you can pass into the json. The below example doesn't actually have a query - it's only a facet/filter that is applied to the data before it would run a query. You can set the filter to anything or multiple things too.

Something else to note is that the backend/x,x/_search part is only required if you wanted to only use the last 2 days of log data. If you wanted to search all of it, you'd use backend/_search without the indexes specified.

Code: Select all

curl -XGET 'http://<ip>/nagioslogserver/index.php/api/backend/logstash-2015.05.29,logstash-2015.05.28/_search?pretty&token=<token>' -d '{
  "facets": {
    "0": {
      "date_histogram": {
        "field": "@timestamp",
        "interval": "10m"
      },
      "global": true,
      "facet_filter": {
        "fquery": {
          "query": {
            "filtered": {
              "query": {
                "query_string": {
                  "query": "*"
                }
              },
              "filter": {
                "bool": {
                  "must": [
                    {
                      "range": {
                        "@timestamp": {
                          "from": 1432828721296,
                          "to": 1432915121297
                        }
                      }
                    }
                  ]
                }
              }
            }
          }
        }
      }
    }
  },
  "size": 0
}'