Search code examples
elasticsearchlogstashsyslogkibana-4elasticsearch-2.0

Kibana Discover: filter errors, exceptions

I'm using Kibana Discover for filtering messages with different Severity levels.

According to RFC-3164 it may be done using formula:

i * 8 + <severity_level> = syslog_pri

Using this information I can filter errors with severity_level=3 using something like this:

# Here is some Python code to extract list of PRI's for errors:
[i*8 + 3 for i in range(24)]

syslog_pri: in (3, 11, 19, 27,...)

The question is: How to check IN condition in Kibana's search string?

Solution

  • The syntax from Kibana search bar should be the same as the one from query_string. Something like the following should work:

    syslog_pri: (3 OR 11 OR 19 OR...)