Kibana加載樣本數據

時間 2019-12-05

標籤 kibana 加載樣本數據简体版

原文原文鏈接

kibana 6.2 加載樣本數據

kibana loading sample data

下載樣本數據

# 莎士比亞經典做品
wget https://download.elastic.co/demos/kibana/gettingstarted/shakespeare_6.0.json

# 一組虛擬生成的帳戶數據
wget https://download.elastic.co/demos/kibana/gettingstarted/accounts.zip

# 一組虛擬生成的日誌數據
wget https://download.elastic.co/demos/kibana/gettingstarted/logs.jsonl.gz

解壓文件

unzip accounts.zip
gunzip logs.jsonl.gz

數據格式

Shakespeare數據集json

{
    "line_id": INT,
    "play_name": "String",
    "speech_number": INT,
    "line_number": "String",
    "speaker": "String",
    "text_entry": "String",
}

account數據集bash

{
    "account_number": INT,
    "balance": INT,
    "firstname": "String",
    "lastname": "String",
    "age": INT,
    "gender": "M or F",
    "address": "String",
    "employer": "String",
    "email": "String",
    "city": "String",
    "state": "String"
}

logs數據集app

{
    "memory": INT,
    "geo.coordinates": "geo_point"
    "@timestamp": "date"
}

Mapping Fields

加載這些數據以前，須要先建立它們的索引，並建立字段映射curl

在Kibana的Dev Tools > Console中，建立索引url

PUT /shakespeare
{
    "mappings": {
        "doc": {
            "properties": {
                "speaker": {"type": "keyword"},
                "play_name": {"type": "keyword"},
                "line_id": {"type": "integer"},
                "speech_number": {"type": "integer"}
            }
        }
    }
}

speaker和play_name被指定爲keyword類型的字段，它們不會被分析器分析
line_id和speech_number被指定爲integer類型

logs數據集須要映射經緯度日誌

PUT /logstash-2015.05.18
{
    "mappings": {
        "log": {
            "properties": {
                "geo": {
                    "properties": {
                        "coordinates": {
                            "type": "geo_point"
                        }
                    }
                }
            }
        }
    }
}

PUT /logstash-2015.05.19
{
    "mappings": {
        "log": {
            "properties": {
                "geo": {
                    "properties": {
                        "coordinates": {
                            "type": "geo_point"
                        }
                    }
                }
            }
        }
    }
}

PUT /logstash-2015.05.20
{
    "mappings": {
        "log": {
            "properties": {
                "geo": {
                    "properties": {
                        "coordinates": {
                            "type": "geo_point"
                        }
                    }
                }
            }
        }
    }
}

accounts數據集使用默認的映射便可code

加載數據集

curl -H 'Content-Type: application/x-ndjson' -XPOST 'localhost:9200/bank/account/_bulk?pretty' --data-binary @accounts.json

curl -H 'Content-Type: application/x-ndjson' -XPOST 'localhost:9200/shakespeare/doc/_bulk?pretty' --data-binary @shakespeare_6.0.json

curl -H 'Content-Type: application/x-ndjson' -XPOST 'localhost:9200/_bulk?pretty' --data-binary @logs.jsonl

查看是否成功加載索引