Graylog decorator to handle field formatting? Numeric math or number mask?

(Bronius Motekaitis) #1

I have “duration” in my apache logs as microseconds. That makes requests taking 3 seconds show as 3M (3,000,000) in the charts, but I would prefer to chart just seconds. I haven’t found a field decorator to convert the numeric value: Is there such a thing? Only pipeline rules to create a new field maybe?

Side request for more context: In charts, how can I adjust or normalize scale of plotted numbers so that I can, for instance, merge http response duration (currently 1M - ~50M) atop Load averages (0.00 - ~5.00) and not have the duration millions values completely eclipse the < 10 unit Load graph?


(Jochen) #2

No and it wouldn’t help because charts are using the pristine field value, not the “decorated” value.


you can use kibana for more advanced charts, it can format numeric fields through Numeral.js, like bytes as KBs, GBs etc, so maybe it converts μs to s

(Bronius Motekaitis) #4

Thank you @maniel- Do you have any definitive links about how this integration could work? Hoping it was a 1-2 quick plugin to Graylog seems to indicate otherwise. Looks like Kibana would be a whole new front end alongside Graylog? Possibly hosted on the same server that has both Graylog and its Elasticsearch backend?



it’s pretty straightforward, you just point kibana install at graylog’s elasticsearch in config/kibana.yml and run it, there is not much more setup, even node.js is bundled

(system) #6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.