How to display different field values ​​over time in Kibana - ClassCast exception

Question

I am trying to read log files using logstash. I used grok to parse the number in the message into a number and saved it as a field. But, as far as I can see, I only got Kibana to graphically display the number of messages over time.

I have not been able to use Kibana to plot more than just the number of posts.

An example of my post:

1) "JvmStatsLoggerService - gc count: 58"
2) "JvmStatsLoggerService - gc time: 2392 ms"

I am extracting / creating the COUNT and TIME fields to store the corresponding values ​​of 58 and 2392. I want to graphically display the different COUNT and TIME values ​​for the last 5 minutes or 10 minutes, and not the number of times they had in the log files over time.

Tried this on live demo , but on my kibana localost console I got this error

Oops! ClassCastException[org.elasticsearch.index.fielddata.plain.PagedBytesIndexFieldData cannot be cast to org.elasticsearch.index.fielddata.IndexNumericFieldData]

Any help is greatly appreciated.

Answer 1

Your elastic search index does not know that the count and time fields are integers. The easiest way to find out its type is to specify the type in the grok template (notification last :int)

grok {
  match => ["message", "%{INT:timeout:int}"]
}