Kibana-仅在某些情况下可视化消息 [英] Kibana - Only visualize messages under some condition

问题描述

我只需要可视化具有某些字段(名为Status)的邮件.该字段并未出现在所有文档中.

I need to visualize only messages that has some field (named Status). That field doesn't appear in all docs.

我试图添加一个子桶，并写了Status作为过滤器..但没有得到任何结果.

I've tried to add a sub-bucket and wrote Status as filter.. but I didn't get any results.

当前消息拆分(当前仅按进程名称..如前所述，我只需要在文档中具有Status字段的消息):

Current messages split (Currently only by process name.. as mentioned, I need only those that has Status field in docs):

推荐答案

您可以通过在搜索框中以_exists_:Status的形式搜索具有状态字段的文档.

You can search docs that has status field by searching as _exists_:Status in the search box.

检查并确认: https://www.elastic.co/guide/zh-CN/elasticsearch/reference/current/query-dsl-query-string-query.html#_field_names

这篇关于Kibana-仅在某些情况下可视化消息的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！