[DOCS] Update rollup jobs screenshots (#105624) (#105639)

# Conflicts:
#	docs/images/management_rollup_job_vis.png
This commit is contained in:
James Rodewig 2021-07-14 13:01:59 -04:00 committed by GitHub
parent ee2e7db600
commit 7cf89fc05d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 24 additions and 13 deletions

Binary file not shown.

Before

Width:  |  Height:  |  Size: 265 KiB

After

Width:  |  Height:  |  Size: 32 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 124 KiB

After

Width:  |  Height:  |  Size: 58 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 151 KiB

After

Width:  |  Height:  |  Size: 95 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 373 KiB

After

Width:  |  Height:  |  Size: 52 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 309 KiB

After

Width:  |  Height:  |  Size: 123 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 112 KiB

Binary file not shown.

Before

Width:  |  Height:  |  Size: 188 KiB

After

Width:  |  Height:  |  Size: 46 KiB

View file

@ -64,13 +64,16 @@ You can read more at {ref}/rollup-job-config.html[rollup job configuration].
=== Try it: Create and visualize rolled up data
This example creates a rollup job to capture log data from sample web logs.
To follow along, add the sample web logs data set.
Before you start, <<add-sample-data, add the web logs sample data set>>.
In this example, you want data that is older than 7 days in the target index pattern `kibana_sample_data_logs`
to roll up once a day into the index `rollup_logstash`. Youll bucket the
to roll up into the `rollup_logstash` index. Youll bucket the
rolled up data on an hourly basis, using 60m for the time bucket configuration.
This allows for more granular queries, such as 2h and 12h.
For this example, the job will perform the rollup every minute. However, you'd
typically roll up less frequently in production.
[float]
==== Create the rollup job
@ -80,7 +83,7 @@ As you walk through the *Create rollup job* UI, enter the data:
|*Field* |*Value*
|Name
|logs_job
|`logs_job`
|Index pattern
|`kibana_sample_data_logs`
@ -89,12 +92,13 @@ As you walk through the *Create rollup job* UI, enter the data:
|`rollup_logstash`
|Frequency
|Every day at midnight
|Every minute
|Page size
|1000
|Delay (latency buffer)|7d
|Latency buffer
|7d
|Date field
|@timestamp
@ -118,6 +122,8 @@ As you walk through the *Create rollup job* UI, enter the data:
|bytes (average)
|===
On the **Review and save** page, click **Start job now** and **Save**.
The terms, histogram, and metrics fields reflect
the key information to retain in the rolled up data: where visitors are from (geo.src),
what operating system they are using (machine.os.keyword),
@ -133,7 +139,6 @@ rollup index, or you can remove or archive it using <<creating-index-lifecycle-p
Your next step is to visualize your rolled up data in a vertical bar chart.
Most visualizations support rolled up data, with the exception of Timelion and Vega visualizations.
. Open the main menu, then click *Stack Management > Index Patterns*.
. Click *Create index pattern*, and select *Rollup index pattern* from the dropdown.
@ -149,7 +154,11 @@ is `rollup_logstash,kibana_sample_data_logs`. In this index pattern, `rollup_log
matches the rolled up index pattern and `kibana_sample_data_logs` matches the index
pattern for raw data.
. Open the main menu, click *Dashboard*, then create and add a vertical bar chart.
. Open the main menu, click *Dashboard*, then *Create dashboard*.
. Set the <<set-time-filter,time filter>> to *Last 90 days*.
. On the dashboard, click *Create visualization*.
. Choose `rollup_logstash,kibana_sample_data_logs`
as your source to see both the raw and rolled up data.
@ -157,13 +166,15 @@ as your source to see both the raw and rolled up data.
[role="screenshot"]
image::images/management-create-rollup-bar-chart.png[][Create visualization of rolled up data]
. Look at the data in your visualization.
+
[role="screenshot"]
image::images/management_rollup_job_vis.png[][Visualization of rolled up data]
. Select *Bar vertical stacked* in the chart type dropdown.
. Optionally, create a dashboard that contains visualizations of the rolled up
data, raw data, or both.
. Add the `@timestamp` field to the *Horizontal axis*.
. Add the `bytes` field to the *Vertical axis*, defaulting to an `Average of
bytes`.
+
{kib} creates a vertical bar chart of your data. Select a section of the chart
to zoom in.
+
[role="screenshot"]
image::images/management_rollup_job_dashboard.png[][Dashboard with rolled up data]