Project 5: Getting hands-on

What you will learn in this TP

• Create a 'drill down' between dashboards
• Create advanced (guided) variables: key-value
• Create advanced (custom) variables: key-value
• Identify and recognize the data source
• Build and use a Lucene query
• Use a Geomap visualization
• Customize the visualization
• Set the default time range
• Set a panel's title and description
• Build bar charts
• Set up a table with a traffic-light scheme
• Use value mapping
• Use regex
• Build pie charts
• Build a panel from another one
• Get familiar with the Logs visualization
• Run range queries with Lucene
• Build time series
• Use the Elasticsearch data source's Metrics mode
• Group data by a criterion
• Exclude a field by negation with Lucene
• Set up an alert

Introduction #

What you will learn in this section

• Create a 'drill down' between dashboards
• Create advanced (guided) variables: key-value
• Create advanced (custom) variables: key-value

For this project, you must have fully completed Project 4

1. Creating the dashboard

   In the folder you just created, create a dashboard named 'project 5' and assign it the tag 'project 5'. Then identify the correct data source that corresponds to Elasticsearch.

2. Variable host_avance1

   You must create a variable named 'host_avance1' with the label 'Advanced host 1' that displays the list of domains (the 'host' field) present in an 'Infinity' data source. The URL to use to build the variable is: https://github.com/RousselTM/grafana-formation/blob/main/tp/data/host_avance1.json

   WARNING: notice that in the json there are two special fields, '__text' and '__value', which Grafana knows how to interpret as the variable's key and value.

3. Variable host_avance2

   You must create a variable named 'host_avance2' with the label 'Advanced host 2' that displays the list of domains (the 'host' field) present in an 'Infinity' data source. The URL to use to build the variable is: https://github.com/RousselTM/grafana-formation/blob/main/tp/data/host_avance2.json

   WARNING: notice that in the json the two special fields '__text' and '__value' are gone. Also, the fields no longer have a title and are in key:value form. So you must use the 'Regex' field to extract the information we're interested in.

4. Variable host_avance3

   You must create a variable named 'host_avance3' with the label 'Advanced host 3' that displays the list of domains (the 'host' field) present in an 'Infinity' data source. The URL to use to build the variable is: https://github.com/RousselTM/grafana-formation/blob/main/tp/data/host_avance3.json

   WARNING: a new use case. This time the information we're interested in is inside a sub-field. So you must switch from 'JSON' type to 'UQL' type. In the 'UQL' field that appears, you'll need to build the correct syntax.

5. Testing host_avanceX variables

   You must create 3 'Text' type visualizations placed side by side. Each will display the 3 following variable formats:

   Default: ${host_avanceX}
   Value: ${host_avanceX:value}
   Title: ${host_avanceX:text}

Time series with Annotations #

What you will learn in this section

• Identify and recognize the data source
• Build and use a Lucene query
• Use a Geomap visualization
• Customize the visualization
• Set the default time range
• Set a panel's title and description

Get familiar with the map visualization

1. Data source

   You must identify and select the Elasticsearch data source.

   INFO: at work, you should define a naming convention in Grafana. A common mistake is putting the source type in the name, even though it's easily identifiable in the Grafana console

2. The query

   You must build a Lucene query to display only documents with an HTTP status of '503' and whose 'machine.os' field starts with 'win'. As a reminder, you created a variable, so every query must include it!

3. Visualization type

   You must choose a visualization that displays data as a map and use these fields for coordinates:
   • Latitude: geo.coordinates.lat
   • Longitude: geo.coordinates.lon

4. Title and description

   You must set the visualization's title to 'Geographic distribution of visitors' and description to 'Geographic representation of users'

5. Point details

   You must configure the table to display only these fields when hovering over a point:
   • host
   • clientip
   • @timestamp
   • geo.dest
   • geo.src
   • message
   As well as any field needed for the map to work. The fields must be displayed in the exact order listed.

6. Default time range

   You must configure the dashboard to display data over 30 days by default.

Panel: SPC Histogram #

What you will learn in this section

• Build bar charts
• Set up a table with a traffic-light scheme
• Use value mapping
• Use regex

You must create a panel that displays a bar chart showing the breakdown of HTTP status codes. Set up a traffic-light color scheme:

• Green with 'OK': 2xx codes
• Yellow with 'Redirect': 3xx codes
• Orange with 'Client error': 4xx codes
• Red with 'Server error': 5xx codes

1. Grouping the data

   Using transformations, group the data by status code and count how many times each one appears over time.

2. Converting the data

   A bar chart uses 'string' type fields. You must therefore convert the status codes to a string.

3. Coloring mode

   Tell Grafana to use the status code to color the bars.

4. Traffic-light scheme

   Set up the traffic-light scheme as requested above.

Panel: pie chart #

What you will learn in this section

• Build pie charts
• Build a panel from another one

You must create a panel that displays a bar chart showing the breakdown of HTTP status codes. Customize the labels according to this model:

• Label 'OK': 2xx code
• Label 'Redirect': 3xx code
• Label 'Client error': 4xx code
• Label 'Server error': 5xx code

1. Duplicating a panel

   Duplicate the panel you just created (Bar chart panel). Then resize them so they display on the same row. The bar chart should take up about 2/3 of the row and the clone 1/3.

2. Changing visualization

   Change the visualization so the data is now displayed as pie slices.

3. Traffic-light scheme

   Is it possible to apply a traffic-light color scheme with this type of visualization?

Panel: Logs #

What you will learn in this section

• Get familiar with the Logs visualization
• Run range queries with Lucene

You must add a panel to the dashboard to display Logs.

1. HTTP errors

   Add a panel to display logs, showing only HTTP error logs.

   INFO: an HTTP error log is a log with an HTTP status code from 4xx to 5xx

Panel: time series #

What you will learn in this section

• Build time series
• Use the Elasticsearch data source's Metrics mode
• Group data by a criterion
• Exclude a field by negation with Lucene

Build a time series with data from Elasticsearch. This graph should show how the number of documents evolves per HTTP status code

1. The query type

   Set the correct mode to build a time series. AND in the query, exclude all HTTP statuses in 2xx and 3xx

2. The grouping

   Configure Grafana to group the metrics by time (in Elasticsearch, the default time field is '@timestamp') and by HTTP status code.

3. The visualization

   Select the visualization that displays time series.

Alerts #

What you will learn in this section

• Set up an alert

You must set up an alert on server errors.

INFO: a server error is a log with an HTTP status code of 5xx

1. Server error

   Set up an alert that triggers every time a server error occurs. Notifications must be sent to the 'RousselTM' contact point. You can check the notifications at: See notifications.

Difficulty level : ●●●○○ (3/5)