Graylog decorator to handle field formatting? Numeric math or number mask?

Graylog Central (peer support)
1

I have “duration” in my apache logs as microseconds. That makes requests taking 3 seconds show as 3M (3,000,000) in the charts, but I would prefer to chart just seconds. I haven’t found a field decorator to convert the numeric value: Is there such a thing? Only pipeline rules to create a new field maybe?

Side request for more context: In charts, how can I adjust or normalize scale of plotted numbers so that I can, for instance, merge http response duration (currently 1M - ~50M) atop Load averages (0.00 - ~5.00) and not have the duration millions values completely eclipse the < 10 unit Load graph?

Thanks
-Bronius

2

No and it wouldn’t help because charts are using the pristine field value, not the “decorated” value.

3

you can use kibana for more advanced charts, it can format numeric fields through Numeral.js, like bytes as KBs, GBs etc, so maybe it converts μs to s

1 Like
4

Thank you @maniel- Do you have any definitive links about how this integration could work? Hoping it was a 1-2 quick plugin to Graylog seems to indicate otherwise. Looks like Kibana would be a whole new front end alongside Graylog? Possibly hosted on the same server that has both Graylog and its Elasticsearch backend?

Thanks!
-Bronius

5

it’s pretty straightforward, you just point kibana install at graylog’s elasticsearch in config/kibana.yml and run it, there is not much more setup, even node.js is bundled

1 Like
6

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.