parent
519e9460f9
commit
805fcffc2e
|
@ -34,4 +34,4 @@ which indicates the next transaction in the trace.
|
||||||
These transactions can be expanded and viewed in detail by clicking on them.
|
These transactions can be expanded and viewed in detail by clicking on them.
|
||||||
|
|
||||||
After exploring these traces,
|
After exploring these traces,
|
||||||
you can return to the full trace by clicking *View full trace* in the upper right hand corner of the page.
|
you can return to the full trace by clicking *View full trace*.
|
||||||
|
|
|
@ -109,6 +109,7 @@ image::apm/images/apm-transaction-duration-dist.png[Example view of transactions
|
||||||
|
|
||||||
This graph shows a typical distribution, and indicates most of our requests were served quickly - awesome!
|
This graph shows a typical distribution, and indicates most of our requests were served quickly - awesome!
|
||||||
It's the requests on the right, the ones taking longer than average, that we probably want to focus on.
|
It's the requests on the right, the ones taking longer than average, that we probably want to focus on.
|
||||||
|
|
||||||
When you select one of these buckets,
|
When you select one of these buckets,
|
||||||
you're presented with up to ten trace samples.
|
you're presented with up to ten trace samples.
|
||||||
Each sample has a span timeline waterfall that shows what a typical request in that bucket was doing.
|
Each sample has a span timeline waterfall that shows what a typical request in that bucket was doing.
|
||||||
|
|
|
@ -76,7 +76,7 @@ After you've added the workpad to your website, you can change the autoplay and
|
||||||
|
|
||||||
To change the autoplay settings:
|
To change the autoplay settings:
|
||||||
|
|
||||||
. In the lower right corner of the shareable workpad, click the settings icon.
|
. Click the settings icon.
|
||||||
|
|
||||||
. Click *Auto Play*, then change the settings.
|
. Click *Auto Play*, then change the settings.
|
||||||
+
|
+
|
||||||
|
@ -85,7 +85,7 @@ image::images/canvas_share_autoplay_480.gif[Autoplay settings]
|
||||||
|
|
||||||
To change the toolbar settings:
|
To change the toolbar settings:
|
||||||
|
|
||||||
. In the lower right corner, click the settings icon.
|
. Click the settings icon.
|
||||||
|
|
||||||
. Click *Toolbar*, then change the settings.
|
. Click *Toolbar*, then change the settings.
|
||||||
+
|
+
|
||||||
|
|
|
@ -18,7 +18,7 @@ Your first step to working with Canvas is to create a workpad.
|
||||||
|
|
||||||
. Click *Create workpad*.
|
. Click *Create workpad*.
|
||||||
|
|
||||||
. To add a *Name* for your workpad, use the editor on the right. For example, `My Canvas Workpad`.
|
. To add a *Name* for your workpad, use the editor. For example, `My Canvas Workpad`.
|
||||||
|
|
||||||
[float]
|
[float]
|
||||||
=== Customize your workpad with images
|
=== Customize your workpad with images
|
||||||
|
@ -29,7 +29,7 @@ To customize your workpad to look the way you want, add your own images.
|
||||||
+
|
+
|
||||||
The default Elastic logo image appears on your page.
|
The default Elastic logo image appears on your page.
|
||||||
|
|
||||||
. To replace the Elastic logo with your own image, select the image, then use the editor on the right.
|
. To replace the Elastic logo with your own image, select the image, then use the editor.
|
||||||
|
|
||||||
. To move the image, click and drag it to your preferred location.
|
. To move the image, click and drag it to your preferred location.
|
||||||
|
|
||||||
|
@ -73,7 +73,7 @@ You'll notice that the error is gone, but the number could use some formatting.
|
||||||
|
|
||||||
. To format the number, use the Canvas expression language.
|
. To format the number, use the Canvas expression language.
|
||||||
|
|
||||||
.. In the lower right corner, click *Expression editor*.
|
.. Click *Expression editor*.
|
||||||
+
|
+
|
||||||
You're now looking at the raw data syntax that Canvas uses to display the element.
|
You're now looking at the raw data syntax that Canvas uses to display the element.
|
||||||
|
|
||||||
|
|
|
@ -124,7 +124,7 @@ Organize your ideas onto separate pages by adding more pages.
|
||||||
|
|
||||||
. Click *Page 1*, then click *+*.
|
. Click *Page 1*, then click *+*.
|
||||||
|
|
||||||
. On the *Page* editor panel on the right, select the page transition from the *Transition* dropdown.
|
. On the *Page* editor panel, select the page transition from the *Transition* dropdown.
|
||||||
+
|
+
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/canvas-add-pages.gif[Add pages]
|
image::images/canvas-add-pages.gif[Add pages]
|
||||||
|
|
|
@ -18,9 +18,9 @@ For more information on alerting concepts and the types of alerts and actions av
|
||||||
[float]
|
[float]
|
||||||
==== Finding alerts
|
==== Finding alerts
|
||||||
|
|
||||||
The *Alerts* tab lists all alerts in the current space, including summary information about their execution frequency, tags, and type.
|
The *Alerts* tab lists all alerts in the current space, including summary information about their execution frequency, tags, and type.
|
||||||
|
|
||||||
The *search bar* can be used to quickly find alerts by name or tag.
|
The *search bar* can be used to quickly find alerts by name or tag.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/alerts-filter-by-search.png[Filtering the alerts list using the search bar]
|
image::images/alerts-filter-by-search.png[Filtering the alerts list using the search bar]
|
||||||
|
@ -30,7 +30,7 @@ The *type* dropdown lets you filter to a subset of alert types.
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/alerts-filter-by-type.png[Filtering the alerts list by types of alert]
|
image::images/alerts-filter-by-type.png[Filtering the alerts list by types of alert]
|
||||||
|
|
||||||
The *Action type* dropdown lets you filter by the type of action used in the alert.
|
The *Action type* dropdown lets you filter by the type of action used in the alert.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/alerts-filter-by-action-type.png[Filtering the alert list by type of action]
|
image::images/alerts-filter-by-action-type.png[Filtering the alert list by type of action]
|
||||||
|
@ -39,16 +39,16 @@ image::images/alerts-filter-by-action-type.png[Filtering the alert list by type
|
||||||
[[create-edit-alerts]]
|
[[create-edit-alerts]]
|
||||||
==== Creating and editing alerts
|
==== Creating and editing alerts
|
||||||
|
|
||||||
Many alerts must be created within the context of a {kib} app like <<xpack-infra, Metrics>>, <<xpack-apm, APM>>, or <<xpack-uptime, Uptime>>, but others are generic. Generic alert types can be created in the *Alerts* management UI by clicking the *Create* button. This will launch a flyout that guides you through selecting an alert type and configuring it's properties. Refer to <<alert-types>> for details on what types of alerts are available and how to configure them.
|
Many alerts must be created within the context of a {kib} app like <<xpack-infra, Metrics>>, <<xpack-apm, APM>>, or <<xpack-uptime, Uptime>>, but others are generic. Generic alert types can be created in the *Alerts* management UI by clicking the *Create* button. This will launch a flyout that guides you through selecting an alert type and configuring it's properties. Refer to <<alert-types>> for details on what types of alerts are available and how to configure them.
|
||||||
|
|
||||||
After an alert is created, you can re-open the flyout and change an alerts properties by clicking the *Edit* button shown on each row of the alert listing.
|
After an alert is created, you can re-open the flyout and change an alerts properties by clicking the *Edit* button shown on each row of the alert listing.
|
||||||
|
|
||||||
|
|
||||||
[float]
|
[float]
|
||||||
[[controlling-alerts]]
|
[[controlling-alerts]]
|
||||||
==== Controlling alerts
|
==== Controlling alerts
|
||||||
|
|
||||||
The alert listing allows you to quickly mute/unmute, disable/enable, and delete individual alerts by clicking the action button at the right of each row.
|
The alert listing allows you to quickly mute/unmute, disable/enable, and delete individual alerts by clicking the action button.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image:management/alerting/images/individual-mute-disable.png[The actions button allows an individual alert to be muted, disabled, or deleted]
|
image:management/alerting/images/individual-mute-disable.png[The actions button allows an individual alert to be muted, disabled, or deleted]
|
||||||
|
@ -56,4 +56,4 @@ image:management/alerting/images/individual-mute-disable.png[The actions button
|
||||||
These operations can also be performed in bulk by multi-selecting alerts and clicking the *Manage alerts* button:
|
These operations can also be performed in bulk by multi-selecting alerts and clicking the *Manage alerts* button:
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image:management/alerting/images/bulk-mute-disable.png[The Manage alerts button lets you mute/unmute, enable/disable, and delete in bulk]
|
image:management/alerting/images/bulk-mute-disable.png[The Manage alerts button lets you mute/unmute, enable/disable, and delete in bulk]
|
||||||
|
|
|
@ -15,7 +15,7 @@ image::images/connector-listing.png[Example connector listing in the Alerts and
|
||||||
[float]
|
[float]
|
||||||
==== Connector list
|
==== Connector list
|
||||||
|
|
||||||
The *Connectors* tab lists all connectors in the current space. The *search bar* can be used to find specific connectors by name and/or type.
|
The *Connectors* tab lists all connectors in the current space. The *search bar* can be used to find specific connectors by name and/or type.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/connector-filter-by-search.png[Filtering the connector list using the search bar]
|
image::images/connector-filter-by-search.png[Filtering the connector list using the search bar]
|
||||||
|
@ -26,12 +26,12 @@ The *type* dropdown also lets you filter to a subset of action types.
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/connector-filter-by-type.png[Filtering the connector list by types of actions]
|
image::images/connector-filter-by-type.png[Filtering the connector list by types of actions]
|
||||||
|
|
||||||
The *Actions* column indicates the number of actions that reference the connector. This count helps you confirm a connector is unused before you delete it, and tells you how many actions will be affected when a connector is modified.
|
The *Actions* column indicates the number of actions that reference the connector. This count helps you confirm a connector is unused before you delete it, and tells you how many actions will be affected when a connector is modified.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/connector-action-count.png[Filtering the connector list by types of actions]
|
image::images/connector-action-count.png[Filtering the connector list by types of actions]
|
||||||
|
|
||||||
You can delete individual connectors using the trash icon on the right of each row. Connectors can also be deleted in bulk by multi-selecting them and clicking the *Delete* button to the left of the search box.
|
You can delete individual connectors using the trash icon. Connectors can also be deleted in bulk by multi-selecting them and clicking the *Delete* button to the left of the search box.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/connector-delete.png[Deleting connectors individually or in bulk]
|
image::images/connector-delete.png[Deleting connectors individually or in bulk]
|
||||||
|
@ -44,4 +44,4 @@ When this happens the action will fail to execute, and appear as errors in the {
|
||||||
|
|
||||||
==== Creating a new connector
|
==== Creating a new connector
|
||||||
|
|
||||||
New connectors can be created by clicking the *Create connector* button, which will guide you to select the type of connector and configure it's properties. Refer to <<action-types>> for the types of connectors available and how to configure them. Once you create a connector it will be made available to you anytime you set up an action in the current space.
|
New connectors can be created by clicking the *Create connector* button, which will guide you to select the type of connector and configure it's properties. Refer to <<action-types>> for the types of connectors available and how to configure them. Once you create a connector it will be made available to you anytime you set up an action in the current space.
|
||||||
|
|
|
@ -38,7 +38,6 @@ image:management/index-patterns/images/rollup-index-pattern.png["Menu with rollu
|
||||||
Just start typing in the *Index pattern* field, and {kib} looks for
|
Just start typing in the *Index pattern* field, and {kib} looks for
|
||||||
the names of {es} indices that match your input. Make sure that the name of the
|
the names of {es} indices that match your input. Make sure that the name of the
|
||||||
index pattern is unique.
|
index pattern is unique.
|
||||||
To include system indices in your search, toggle the switch in the upper right.
|
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image:management/index-patterns/images/create-index-pattern.png["Create index pattern"]
|
image:management/index-patterns/images/create-index-pattern.png["Create index pattern"]
|
||||||
|
|
|
@ -25,7 +25,7 @@ the *Index patterns* overview.
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::management/index-patterns/images/new-index-pattern.png["Index files and data types"]
|
image::management/index-patterns/images/new-index-pattern.png["Index files and data types"]
|
||||||
|
|
||||||
Use the icons in the upper right to perform the following actions:
|
Use the icons to perform the following actions:
|
||||||
|
|
||||||
* [[set-default-pattern]]*Set the default index pattern.* {kib} uses a badge to make users
|
* [[set-default-pattern]]*Set the default index pattern.* {kib} uses a badge to make users
|
||||||
aware of which index pattern is the default. The first pattern
|
aware of which index pattern is the default. The first pattern
|
||||||
|
|
|
@ -42,8 +42,8 @@ image::images/management_create_rollup_job.png[][Wizard that walks you through c
|
||||||
=== Start, stop, and delete rollup jobs
|
=== Start, stop, and delete rollup jobs
|
||||||
|
|
||||||
Once you’ve saved a rollup job, you’ll see it the *Rollup Jobs* overview page,
|
Once you’ve saved a rollup job, you’ll see it the *Rollup Jobs* overview page,
|
||||||
where you can drill down for further investigation. The *Manage* menu in
|
where you can drill down for further investigation. The *Manage* menu enables
|
||||||
the lower right enables you to start, stop, and delete the rollup job.
|
you to start, stop, and delete the rollup job.
|
||||||
You must first stop a rollup job before deleting it.
|
You must first stop a rollup job before deleting it.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
|
|
|
@ -37,7 +37,6 @@ the Elasticsearch responses are shown on the *Layer add panel* and the indexed d
|
||||||
appears on the map. The geospatial data on the map
|
appears on the map. The geospatial data on the map
|
||||||
should be identical to the locally-previewed data, but now it's indexed data from Elasticsearch.
|
should be identical to the locally-previewed data, but now it's indexed data from Elasticsearch.
|
||||||
|
|
||||||
. To continue adding data to the map, click *Add layer* in the lower
|
. To continue adding data to the map, click *Add layer*.
|
||||||
right-hand corner.
|
|
||||||
. In *Layer settings*, adjust any settings or <<maps-vector-style-properties, properties>> as needed.
|
. In *Layer settings*, adjust any settings or <<maps-vector-style-properties, properties>> as needed.
|
||||||
. Click *Save & close*.
|
. Click *Save & close*.
|
||||||
|
|
|
@ -55,14 +55,14 @@ auto-populate *Index type* with either {ref}/geo-point.html[geo_point] or
|
||||||
{ref}/geo-shape.html[geo_shape] and *Index name* with
|
{ref}/geo-shape.html[geo_shape] and *Index name* with
|
||||||
`<file name>`.
|
`<file name>`.
|
||||||
|
|
||||||
. Click *Import file* in the lower right.
|
. Click *Import file*.
|
||||||
+
|
+
|
||||||
You'll see activity as the GeoJSON Upload utility creates a new index
|
You'll see activity as the GeoJSON Upload utility creates a new index
|
||||||
and index pattern for the data set. When the process is complete, you should
|
and index pattern for the data set. When the process is complete, you should
|
||||||
receive messages that the creation of the new index and index pattern
|
receive messages that the creation of the new index and index pattern
|
||||||
were successful.
|
were successful.
|
||||||
|
|
||||||
. Click *Add layer* in the bottom right.
|
. Click *Add layer*.
|
||||||
|
|
||||||
. In *Layer settings*, adjust settings and <<maps-vector-style-properties, properties>> as needed.
|
. In *Layer settings*, adjust settings and <<maps-vector-style-properties, properties>> as needed.
|
||||||
. Click *Save & close*.
|
. Click *Save & close*.
|
||||||
|
|
|
@ -80,7 +80,7 @@ To symbolize countries by web traffic, you'll need to augment the world country
|
||||||
To do this, you'll create a <<terms-join, term join>> to link the vector source *World Countries* to
|
To do this, you'll create a <<terms-join, term join>> to link the vector source *World Countries* to
|
||||||
the {es} index `kibana_sample_data_logs` on the shared key iso2 = geo.src.
|
the {es} index `kibana_sample_data_logs` on the shared key iso2 = geo.src.
|
||||||
|
|
||||||
. Click plus image:maps/images/gs_plus_icon.png[] to the right of *Term Joins* label.
|
. Click plus image:maps/images/gs_plus_icon.png[] next to the *Term Joins* label.
|
||||||
. Click *Join --select--*
|
. Click *Join --select--*
|
||||||
. Set *Left field* to *ISO 3166-1 alpha-2 code*.
|
. Set *Left field* to *ISO 3166-1 alpha-2 code*.
|
||||||
. Set *Right source* to *kibana_sample_data_logs*.
|
. Set *Right source* to *kibana_sample_data_logs*.
|
||||||
|
@ -238,7 +238,7 @@ The *machine.os.keyword: osx* filter appears in the dashboard query bar.
|
||||||
+
|
+
|
||||||
. Click the *x* to remove the *machine.os.keyword: osx* filter.
|
. Click the *x* to remove the *machine.os.keyword: osx* filter.
|
||||||
. In the map, click in the United States vector.
|
. In the map, click in the United States vector.
|
||||||
. Click plus image:maps/images/gs_plus_icon.png[] to the right of *iso2* row in the tooltip.
|
. Click plus image:maps/images/gs_plus_icon.png[] next to the *iso2* row in the tooltip.
|
||||||
+
|
+
|
||||||
Both the visualizations and the map are filtered to only show documents where *geo.src* is *US*.
|
Both the visualizations and the map are filtered to only show documents where *geo.src* is *US*.
|
||||||
The *geo.src: US* filter appears in the dashboard query bar.
|
The *geo.src: US* filter appears in the dashboard query bar.
|
||||||
|
@ -247,4 +247,3 @@ Your dashboard should look like this:
|
||||||
+
|
+
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::maps/images/gs_dashboard_with_terms_filter.png[]
|
image::maps/images/gs_dashboard_with_terms_filter.png[]
|
||||||
|
|
||||||
|
|
|
@ -4,7 +4,7 @@
|
||||||
|
|
||||||
**Elastic Maps** embeds the search bar for real-time search.
|
**Elastic Maps** embeds the search bar for real-time search.
|
||||||
Only layers requesting data from {es} are filtered when you submit a search request.
|
Only layers requesting data from {es} are filtered when you submit a search request.
|
||||||
Layers narrowed by the search context contain the filter icon image:maps/images/filter_icon.png[] to the right of layer name in the legend.
|
Layers narrowed by the search context contain the filter icon image:maps/images/filter_icon.png[] next to the layer name in the legend.
|
||||||
|
|
||||||
You can create a layer that requests data from {es} from the following:
|
You can create a layer that requests data from {es} from the following:
|
||||||
|
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
[[defining-alerts]]
|
[[defining-alerts]]
|
||||||
== Defining alerts
|
== Defining alerts
|
||||||
|
|
||||||
{kib} alerts can be created in a variety of apps including <<xpack-apm,*APM*>>, <<xpack-infra,*Metrics*>>, <<xpack-siem,*SIEM*>>, <<xpack-uptime,*Uptime*>> and from <<management,*Management*>> UI. While alerting details may differ from app to app, they share a common interface for defining and configuring alerts that this section describes in more detail.
|
{kib} alerts can be created in a variety of apps including <<xpack-apm,*APM*>>, <<xpack-infra,*Metrics*>>, <<xpack-siem,*SIEM*>>, <<xpack-uptime,*Uptime*>> and from <<management,*Management*>> UI. While alerting details may differ from app to app, they share a common interface for defining and configuring alerts that this section describes in more detail.
|
||||||
|
|
||||||
[float]
|
[float]
|
||||||
=== Alert flyout
|
=== Alert flyout
|
||||||
|
@ -25,20 +25,20 @@ All alert share the following four properties in common:
|
||||||
image::images/alert-flyout-general-details.png[All alerts have name, tags, check every, and re-notify every properties in common]
|
image::images/alert-flyout-general-details.png[All alerts have name, tags, check every, and re-notify every properties in common]
|
||||||
|
|
||||||
Name:: The name of the alert. While this name does not have to be unique, the name can be referenced in actions and also appears in the searchable alert listing in the management UI. A distinctive name can help identify and find an alert.
|
Name:: The name of the alert. While this name does not have to be unique, the name can be referenced in actions and also appears in the searchable alert listing in the management UI. A distinctive name can help identify and find an alert.
|
||||||
Tags:: A list of tag names that can be applied to an alert. Tags can help you organize and find alerts, because tags appear in the alert listing in the management UI which is searchable by tag.
|
Tags:: A list of tag names that can be applied to an alert. Tags can help you organize and find alerts, because tags appear in the alert listing in the management UI which is searchable by tag.
|
||||||
Check every:: This value determines how frequently the alert conditions below are checked. Note that the timing of background alert checks are not guaranteed, particularly for intervals of less than 10 seconds. See <<alerting-scale-performance>> for more information.
|
Check every:: This value determines how frequently the alert conditions below are checked. Note that the timing of background alert checks are not guaranteed, particularly for intervals of less than 10 seconds. See <<alerting-scale-performance>> for more information.
|
||||||
Re-notify every:: This value limits how often actions are repeated when an alert instance remains active across alert checks. See <<alerting-concepts-suppressing-duplicate-notifications>> for more information.
|
Re-notify every:: This value limits how often actions are repeated when an alert instance remains active across alert checks. See <<alerting-concepts-suppressing-duplicate-notifications>> for more information.
|
||||||
|
|
||||||
[float]
|
[float]
|
||||||
[[defining-alerts-type-conditions]]
|
[[defining-alerts-type-conditions]]
|
||||||
=== Alert type and conditions
|
=== Alert type and conditions
|
||||||
|
|
||||||
Depending upon the {kib} app and context, you may be prompted to choose the type of alert you wish to create. Some apps will pre-select the type of alert for you.
|
Depending upon the {kib} app and context, you may be prompted to choose the type of alert you wish to create. Some apps will pre-select the type of alert for you.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/alert-flyout-alert-type-selection.png[Choosing the type of alert to create]
|
image::images/alert-flyout-alert-type-selection.png[Choosing the type of alert to create]
|
||||||
|
|
||||||
Each alert type provides its own way of defining the conditions to detect, but an expression formed by a series of clauses is a common pattern. Each clause has a UI control that allows you to define the clause. For example, in an index threshold alert the `WHEN` clause allows you to select an aggregation operation to apply to a numeric field.
|
Each alert type provides its own way of defining the conditions to detect, but an expression formed by a series of clauses is a common pattern. Each clause has a UI control that allows you to define the clause. For example, in an index threshold alert the `WHEN` clause allows you to select an aggregation operation to apply to a numeric field.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/alert-flyout-alert-conditions.png[UI for defining alert conditions on an index threshold alert]
|
image::images/alert-flyout-alert-conditions.png[UI for defining alert conditions on an index threshold alert]
|
||||||
|
@ -52,19 +52,19 @@ To add an action to an alert, you first select the type of action:
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/alert-flyout-action-type-selection.png[UI for selecting an action type]
|
image::images/alert-flyout-action-type-selection.png[UI for selecting an action type]
|
||||||
|
|
||||||
Each action must specify a <<alerting-concepts-connectors, connector>> instance. If no connectors exist for that action type, click "Add new" to create one.
|
Each action must specify a <<alerting-concepts-connectors, connector>> instance. If no connectors exist for that action type, click "Add new" to create one.
|
||||||
|
|
||||||
Each action type exposes different properties. For example an email action allows you to set the recipients, the subject, and a message body in markdown format. See <<action-types>> for details on the types of actions provided by {kib} and their properties.
|
Each action type exposes different properties. For example an email action allows you to set the recipients, the subject, and a message body in markdown format. See <<action-types>> for details on the types of actions provided by {kib} and their properties.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/alert-flyout-action-details.png[UI for defining an email action]
|
image::images/alert-flyout-action-details.png[UI for defining an email action]
|
||||||
|
|
||||||
Using the https://mustache.github.io/[Mustache] template syntax `{{variable name}}`, you can pass alert values at the time a condition is detected to an action. Available variables differ by alert type, and a list can be accessed using the "add variable" button at the right of the text box.
|
Using the https://mustache.github.io/[Mustache] template syntax `{{variable name}}`, you can pass alert values at the time a condition is detected to an action. Available variables differ by alert type, and a list can be accessed using the "add variable" button.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/alert-flyout-action-variables.png[Passing alert values to an action]
|
image::images/alert-flyout-action-variables.png[Passing alert values to an action]
|
||||||
|
|
||||||
You can attach more than one action. Clicking the "Add action" button will prompt you to select another alert type and repeat the above steps again.
|
You can attach more than one action. Clicking the "Add action" button will prompt you to select another alert type and repeat the above steps again.
|
||||||
|
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/alert-flyout-add-action.png[You can add multiple actions on an alert]
|
image::images/alert-flyout-add-action.png[You can add multiple actions on an alert]
|
||||||
|
@ -77,4 +77,4 @@ Actions are not required on alerts. In some cases you may want to run an alert w
|
||||||
[float]
|
[float]
|
||||||
=== Managing alerts
|
=== Managing alerts
|
||||||
|
|
||||||
To modify an alert after it was created, including muting or disabling it, use the <<alert-management, alert listing in the Management UI>>.
|
To modify an alert after it was created, including muting or disabling it, use the <<alert-management, alert listing in the Management UI>>.
|
||||||
|
|
|
@ -90,7 +90,7 @@ In *Edit* mode, you can move, resize, customize, and delete panels to suit your
|
||||||
* To move a panel, click and hold the panel header and drag to the new location.
|
* To move a panel, click and hold the panel header and drag to the new location.
|
||||||
|
|
||||||
[[resizing-containers]]
|
[[resizing-containers]]
|
||||||
* To resize a panel, click the resize control on the lower right and drag
|
* To resize a panel, click the resize control and drag
|
||||||
to the new dimensions.
|
to the new dimensions.
|
||||||
|
|
||||||
* To toggle the use of margins and panel titles, use the *Options* menu.
|
* To toggle the use of margins and panel titles, use the *Options* menu.
|
||||||
|
|
|
@ -33,7 +33,7 @@ which has a pre-built index pattern.
|
||||||
|
|
||||||
By default, *Discover* shows data for the last 15 minutes.
|
By default, *Discover* shows data for the last 15 minutes.
|
||||||
If you have a time-based index, and no data displays,
|
If you have a time-based index, and no data displays,
|
||||||
you might need to increase the time range. Using the <<set-time-filter, time filter>> in the upper right,
|
you might need to increase the time range. Using the <<set-time-filter, time filter>>,
|
||||||
you can specify a common or recently-used time range, a relative time
|
you can specify a common or recently-used time range, a relative time
|
||||||
from now, or an absolute time range.
|
from now, or an absolute time range.
|
||||||
|
|
||||||
|
|
|
@ -38,7 +38,7 @@ image::user/graph/images/graph-url-connections.png["URL connections"]
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::user/graph/images/graph-link-summary.png["Link summary"]
|
image::user/graph/images/graph-link-summary.png["Link summary"]
|
||||||
|
|
||||||
. Use the control bar on the right to explore
|
. Use the control bar to explore
|
||||||
additional connections:
|
additional connections:
|
||||||
+
|
+
|
||||||
* To display additional vertices that connect to your graph, click the expand icon
|
* To display additional vertices that connect to your graph, click the expand icon
|
||||||
|
@ -70,7 +70,7 @@ select *Edit settings*.
|
||||||
|
|
||||||
To change the color and label of selected vertices,
|
To change the color and label of selected vertices,
|
||||||
click the style icon image:user/graph/images/graph-style-button.png[Style]
|
click the style icon image:user/graph/images/graph-style-button.png[Style]
|
||||||
in the control bar on the right.
|
in the control bar.
|
||||||
|
|
||||||
|
|
||||||
[float]
|
[float]
|
||||||
|
|
|
@ -14,8 +14,8 @@ image::user/monitoring/images/monitoring-beats.jpg["Monitoring Beats",link="imag
|
||||||
To view an overview of the Beats data in the cluster, click *Overview*. The
|
To view an overview of the Beats data in the cluster, click *Overview*. The
|
||||||
overview page has a section for activity in the last day, which is a real-time
|
overview page has a section for activity in the last day, which is a real-time
|
||||||
sample of data. The summary bar and charts follow the typical paradigm
|
sample of data. The summary bar and charts follow the typical paradigm
|
||||||
of data in the Monitoring UI, which is bound to the span of the time filter in
|
of data in the Monitoring UI, which is bound to the span of the time filter.
|
||||||
the top right corner of the page. This overview page can therefore show
|
This overview page can therefore show
|
||||||
up-to-date or historical information.
|
up-to-date or historical information.
|
||||||
|
|
||||||
To view a listing of the individual Beat instances in the cluster, click *Beats*.
|
To view a listing of the individual Beat instances in the cluster, click *Beats*.
|
||||||
|
|
|
@ -38,7 +38,7 @@ you'll see two places highlighted in green:
|
||||||
|
|
||||||
* The visualization builder pane
|
* The visualization builder pane
|
||||||
|
|
||||||
* The *X-axis* or *Y-axis* fields in the right column
|
* The *X-axis* or *Y-axis* fields
|
||||||
|
|
||||||
You can incorporate many fields into your visualization, and Lens uses heuristics to decide how
|
You can incorporate many fields into your visualization, and Lens uses heuristics to decide how
|
||||||
to apply each one to the visualization.
|
to apply each one to the visualization.
|
||||||
|
@ -89,8 +89,8 @@ You can switch between suggestions without losing your previous state:
|
||||||
[role="screenshot"]
|
[role="screenshot"]
|
||||||
image::images/lens_suggestions.gif[]
|
image::images/lens_suggestions.gif[]
|
||||||
|
|
||||||
If you want to switch to a chart type that is not suggested, click the chart type in the
|
If you want to switch to a chart type that is not suggested, click the chart type,
|
||||||
top right, then select a chart type. When there is an exclamation point (!)
|
then select a chart type. When there is an exclamation point (!)
|
||||||
next to a chart type, Lens is unable to transfer your current data, but
|
next to a chart type, Lens is unable to transfer your current data, but
|
||||||
still allows you to make the change.
|
still allows you to make the change.
|
||||||
|
|
||||||
|
@ -106,7 +106,7 @@ If there is a match, Lens displays the new data. All fields that do not match th
|
||||||
|
|
||||||
. Change the data field options, such as the aggregation or label.
|
. Change the data field options, such as the aggregation or label.
|
||||||
|
|
||||||
.. Click *Drop a field here* or the field name in the right column.
|
.. Click *Drop a field here* or the field name in the column.
|
||||||
|
|
||||||
.. Change the options that appear depending on the type of field.
|
.. Change the options that appear depending on the type of field.
|
||||||
|
|
||||||
|
@ -168,7 +168,7 @@ image::images/lens_tutorial_2.png[Lens tutorial]
|
||||||
|
|
||||||
Customize your visualization to look exactly how you want.
|
Customize your visualization to look exactly how you want.
|
||||||
|
|
||||||
. In the right column, click *Average of taxful_total_price*.
|
. Click *Average of taxful_total_price*.
|
||||||
|
|
||||||
.. Change the *Label* to `Sales`, or a name that you prefer for the data.
|
.. Change the *Label* to `Sales`, or a name that you prefer for the data.
|
||||||
|
|
||||||
|
@ -180,7 +180,7 @@ six available categories.
|
||||||
. Look at the suggestions. None of them show an area chart, but for sales data, a stacked area chart
|
. Look at the suggestions. None of them show an area chart, but for sales data, a stacked area chart
|
||||||
might make sense. To switch the chart type:
|
might make sense. To switch the chart type:
|
||||||
|
|
||||||
.. Click *Stacked bar chart* in the right column.
|
.. Click *Stacked bar chart* in the column.
|
||||||
|
|
||||||
.. Click *Stacked area*.
|
.. Click *Stacked area*.
|
||||||
+
|
+
|
||||||
|
|
Loading…
Reference in a new issue