# Conflicts: # docs/images/management_rollup_job_vis.png
Before Width: | Height: | Size: 265 KiB After Width: | Height: | Size: 32 KiB |
Before Width: | Height: | Size: 124 KiB After Width: | Height: | Size: 58 KiB |
Before Width: | Height: | Size: 151 KiB After Width: | Height: | Size: 95 KiB |
Before Width: | Height: | Size: 373 KiB After Width: | Height: | Size: 52 KiB |
Before Width: | Height: | Size: 309 KiB After Width: | Height: | Size: 123 KiB |
Before Width: | Height: | Size: 112 KiB |
Before Width: | Height: | Size: 188 KiB After Width: | Height: | Size: 46 KiB |
|
@ -64,13 +64,16 @@ You can read more at {ref}/rollup-job-config.html[rollup job configuration].
|
|||
=== Try it: Create and visualize rolled up data
|
||||
|
||||
This example creates a rollup job to capture log data from sample web logs.
|
||||
To follow along, add the sample web logs data set.
|
||||
Before you start, <<add-sample-data, add the web logs sample data set>>.
|
||||
|
||||
In this example, you want data that is older than 7 days in the target index pattern `kibana_sample_data_logs`
|
||||
to roll up once a day into the index `rollup_logstash`. You’ll bucket the
|
||||
to roll up into the `rollup_logstash` index. You’ll bucket the
|
||||
rolled up data on an hourly basis, using 60m for the time bucket configuration.
|
||||
This allows for more granular queries, such as 2h and 12h.
|
||||
|
||||
For this example, the job will perform the rollup every minute. However, you'd
|
||||
typically roll up less frequently in production.
|
||||
|
||||
[float]
|
||||
==== Create the rollup job
|
||||
|
||||
|
@ -80,7 +83,7 @@ As you walk through the *Create rollup job* UI, enter the data:
|
|||
|*Field* |*Value*
|
||||
|
||||
|Name
|
||||
|logs_job
|
||||
|`logs_job`
|
||||
|
||||
|Index pattern
|
||||
|`kibana_sample_data_logs`
|
||||
|
@ -89,12 +92,13 @@ As you walk through the *Create rollup job* UI, enter the data:
|
|||
|`rollup_logstash`
|
||||
|
||||
|Frequency
|
||||
|Every day at midnight
|
||||
|Every minute
|
||||
|
||||
|Page size
|
||||
|1000
|
||||
|
||||
|Delay (latency buffer)|7d
|
||||
|Latency buffer
|
||||
|7d
|
||||
|
||||
|Date field
|
||||
|@timestamp
|
||||
|
@ -118,6 +122,8 @@ As you walk through the *Create rollup job* UI, enter the data:
|
|||
|bytes (average)
|
||||
|===
|
||||
|
||||
On the **Review and save** page, click **Start job now** and **Save**.
|
||||
|
||||
The terms, histogram, and metrics fields reflect
|
||||
the key information to retain in the rolled up data: where visitors are from (geo.src),
|
||||
what operating system they are using (machine.os.keyword),
|
||||
|
@ -133,7 +139,6 @@ rollup index, or you can remove or archive it using <<creating-index-lifecycle-p
|
|||
Your next step is to visualize your rolled up data in a vertical bar chart.
|
||||
Most visualizations support rolled up data, with the exception of Timelion and Vega visualizations.
|
||||
|
||||
|
||||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||||
|
||||
. Click *Create index pattern*, and select *Rollup index pattern* from the dropdown.
|
||||
|
@ -149,7 +154,11 @@ is `rollup_logstash,kibana_sample_data_logs`. In this index pattern, `rollup_log
|
|||
matches the rolled up index pattern and `kibana_sample_data_logs` matches the index
|
||||
pattern for raw data.
|
||||
|
||||
. Open the main menu, click *Dashboard*, then create and add a vertical bar chart.
|
||||
. Open the main menu, click *Dashboard*, then *Create dashboard*.
|
||||
|
||||
. Set the <<set-time-filter,time filter>> to *Last 90 days*.
|
||||
|
||||
. On the dashboard, click *Create visualization*.
|
||||
|
||||
. Choose `rollup_logstash,kibana_sample_data_logs`
|
||||
as your source to see both the raw and rolled up data.
|
||||
|
@ -157,13 +166,15 @@ as your source to see both the raw and rolled up data.
|
|||
[role="screenshot"]
|
||||
image::images/management-create-rollup-bar-chart.png[][Create visualization of rolled up data]
|
||||
|
||||
. Look at the data in your visualization.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image::images/management_rollup_job_vis.png[][Visualization of rolled up data]
|
||||
. Select *Bar vertical stacked* in the chart type dropdown.
|
||||
|
||||
. Optionally, create a dashboard that contains visualizations of the rolled up
|
||||
data, raw data, or both.
|
||||
. Add the `@timestamp` field to the *Horizontal axis*.
|
||||
|
||||
. Add the `bytes` field to the *Vertical axis*, defaulting to an `Average of
|
||||
bytes`.
|
||||
+
|
||||
{kib} creates a vertical bar chart of your data. Select a section of the chart
|
||||
to zoom in.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image::images/management_rollup_job_dashboard.png[][Dashboard with rolled up data]
|
||||
|
|