为什么在Kibana 4中,它会在数据可视化页面的“字段”部分显示“您必须从列表中选择项目”?

时间:2015-07-10 07:01:09

标签: csv elasticsearch logstash kibana kibana-4

我有一个弹性搜索索引,我用它来索引一组文档。

这些文档最初是csv格式,我正在使用logstash解析它们。

在Kibana 4可视化页面中,(参见下面的附图)

在“当前设备安装”字段中,按下“应用”后,弹出即将显示“您必须从列表中选择一个项目”。

Data Visualisation Page

我的logstash配置文件是,

        input {
        file {
                path => "/csv_files_for_logstash/app1lg.csv"
                        type => "core2"
                        start_position => "beginning"
        }   }


    filter {
        csv {
                separator => ","
                        columns=> ["Date","Package Name","App Version Code","Current Device Installs","Daily Device Installs","Daily Device Uninstalls","Daily Device Upgrades","Current User Installs","Total User Installs","Daily User Installs","Daily User Uninstalls"]
        }
        mutate {convert => ["App Version Code", "string"]}
        mutate {convert => ["Current Device Installs", "float"]}
        mutate {convert => ["Daily Device Installs", "float"]}
        mutate {convert => ["Daily Device Uninstalls", "float"]}
        mutate {convert => ["Current User Installs", "float"]}
        mutate {convert => ["Total User Installs", "float"]}
        mutate {convert => ["Daily User Installs", "float"]}
        mutate {convert => ["Daily User Uninstalls", "float"]}
        ruby {
                code => '
                  b = event["App Version Code"]
                  string2=""
                  for counter in (3..(b.size-1))
                         if counter == 4
                                 string2+= "."+ b[counter]
                         elsif counter ==  6
                                string2+= "("+b[counter]
                         elsif counter == 8
                                string2+= b[counter] + ")"
                         else
                                 string2+= b[counter]
                         end

                   end

                   event["App Version Code"] = string2

                  '

        }
}
   output {
        elasticsearch {
                embedded => true
                        action => "index"
                        host => "es"
                        index => "fivetry"
                        workers => 1

        }
        stdout{
                codec => rubydebug {
                }
        }
}

此错误的可能原因是什么?如何删除?

感谢和问候

1 个答案:

答案 0 :(得分:0)

如果您只想要当前设备安装字段的最大计数,您可以单击分割行和放大部分中的X(交叉)按钮。点击Apply。

在这种情况下,它将输出当前设备安装的最大数量字段。