Kibana via Command Line

Access the log your way

Kibana is a great tool to search for logging, especially in a large microservice environment, like the one we got at REWE digital. However its default view just does not work for me.

We use JSON logs and the default view shows the time and the (JSON) _source, loglevel is hidden within it and there are no filters at all (e.g. filter DEBUG and INFO logs).

Kibana’s default configuration is quite useless to me in my urgent need to analyse an error

The UI of course allows me to add those and more, but I did the exact same clicks every time I opened Kibana to analyse a certain behavior.

This certainly can all be solved with browser bookmarks. But that did not work very well for me. There are to many variants, which might be interesting and at least we here have one Kibana instance per our three environments.

One could also use saved searches or even dashboards, but I need to add those manually for each Kibana instance, I need to choose names, which might be long, non-intuitive or too simple.

So I wrote a little script to open Kibana with a set of filters and columns, I can define with parameters. This script just lives in the root directory of my services, so it can be used by anyone interested in that service’s logs.

My Groovy script gives me a far better — yet adjustable — start into the tool

Usecases

• ./open-log
just opens Kibana with loglevel and msg columns, only showing the service’s logs (via filter for service) from the last 24 hours, with filters for each loglevel (does not display DEBUG and INFO by default).
• ./open-log -e int
does the same on our INT environment’s Kibana instance.
• ./open-log -c host,log_type
displays the columns host and log_type in addition to the default ones.
• ./open-log -s another-service,one-more-service
changes the service filter to also display logs form another-serviceand one-more-service.
• ./open-log -t 30m
displays logs from the last 30 minutes only.
• ./open-log -q "something interesting"
searches for "something interesting" in the search input.