- \n
- Overview<\/a><\/span>\n
- \n
- What is ElasticSearch?<\/a><\/span><\/li>\n
- What is OpenSearch?<\/a><\/span><\/li>\n
- Differences Between OpenSearch and ElasticSearch<\/a><\/span><\/li>\n<\/ul>\n<\/li>\n
- Requesting Access<\/a><\/span><\/li>\n
- Logging In<\/a><\/span><\/li>\n
- Switching Tenants<\/a><\/span><\/li>\n
- Searching<\/a><\/span>\n
- \n
- Searching: Discover Overview<\/a><\/span><\/li>\n
- Search Tips<\/a><\/span>\n
- \n
- Selecting the Time Range<\/a><\/span><\/li>\n
- Viewing Data<\/a><\/span><\/li>\n
- Selecting Displayed Field<\/a><\/span><\/li>\n
- Basic Search<\/a><\/span><\/li>\n
- Wildcard Search<\/a><\/span><\/li>\n
- Substring Search<\/a><\/span><\/li>\n
- Search for a String That Contains Word Boundaries<\/a><\/span><\/li>\n
- Searching for text that contains colons (:)<\/a><\/span><\/li>\n
- Excluding Data From a Search<\/a><\/span><\/li>\n
- Inspect<\/a><\/span><\/li>\n<\/ul>\n<\/li>\n
- New Discover<\/a><\/span><\/li>\n
- Saving Searches<\/a><\/span><\/li>\n
- Exporting Report Data<\/a><\/span><\/li>\n
- Accessing Saved Queries<\/a><\/span><\/li>\n<\/ul>\n<\/li>\n
- Creating Visualizations<\/a><\/span>\n
- \n
- General<\/a><\/span><\/li>\n
- TSVB (Time Series Visualization Builder)<\/a><\/span><\/li>\n
- Map Visualizations<\/a><\/span><\/li>\n
- TimeLine<\/a><\/span><\/li>\n
- Vega<\/a><\/span><\/li>\n
- Learning Vega<\/a><\/span><\/li>\n
- Debugging Vega Graphs<\/a><\/span><\/li>\n
- Vega Sample \u2013 Horizontal Line with Baseline<\/a><\/span><\/li>\n
- Other Types:<\/a><\/span><\/li>\n<\/ul>\n<\/li>\n
- Creating a Dashboard<\/a><\/span>\n
- \n
- General<\/a><\/span><\/li>\n
- Dashboard<\/a><\/span><\/li>\n
- Observability Dashboard<\/a><\/span><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/div>\n
<\/p>\n
Overview<\/h1>\n
The SYSLOG platform is a set of applications commonly known as ELK (ElasticSearch, Logstash, and Kibana). We will be replacing ElasticSearch with OpenSearch in the upcoming months. Currently, the development platform has been upgraded and is available for anyone who wants to check it out. The new website is called “OpenSearch Dashboards”. While maintaining a similar “look and feel” to the current Kibana platform, moving to OpenSearch provides us with new features \u2013 machine learning for data analytics<\/a>, rollup indices<\/a>.<\/p>\n
What is ElasticSearch?<\/h2>\n
ElasticSearch<\/a>, based on the Lucene search software<\/a>, is a distributed search and analytics application which ingests, stores, and indexes data. Kibana is a web-based front-end providing user access to data stored within ElasticSearch.<\/p>\n
What is OpenSearch?<\/h2>\n
In short, it’s the same but different. OpenSearch is also based on the Lucene search software, is designed to be a distributed search and analytics application, and ingests\/stores\/indexes data. If it’s essentially the same thing, why<\/em> does OpenSearch exist? ElasticSearch was initially licensed under the open-source Apache 2.0 license \u2013 a rather permissive free software license. ElasticCo did not agree with how their software was being used by Amazon<\/a>; and, in 2021, the license for ElasticSearch was changed to Server Side Public License<\/a> (SSPL). One of the requirements of SSPL is that anyone who implements the software and sells their implementation as a service needs to publish their source code under the SSPL license \u2013 not just changes made to the original program but all<\/em> other software a user would require to run the software-as-a-service environment for themselves. Amazon used ElasticSearch for their Amazon Elasticsearch Service offering, but was unable\/unwilling to continue doing so under the new license terms. In April of 2021, Amazon Web Services created a fork of ElasticSearch as the basis for OpenSearch<\/a>.<\/p>\n
Differences Between OpenSearch and ElasticSearch<\/h2>\n
After the OpenSearch fork was created, the product roadmap for ElasticSearch was driven by ElasticCo and the roadmap for OpenSearch<\/a> was community driven (with significant oversight and input from Amazon) \u2013 this means the products are not identical although they provide the same core functionality. Elastic publishes a list of features unique to ElasticSearch<\/a>, and the underlying machine learning algorithms are different. However, the important components of the “unique” feature list have been implemented in OpenSearch over time.<\/p>\n
Requesting Access<\/h1>\n
Access to the OpenSearch environment can be requested via a Microsoft Forms form.<\/p>\n
Managers can request access for their direct reports at https:\/\/forms.microsoft.com\/Pages\/ResponsePage.aspx?id=wbRnJe2w9UCu41jXxfPisjf18JL-t61BkoGkoNxr24lUN1laRDhaU0lRMzRHVzNZRkdCSTlXQUFNNSQlQCN0PWcu<\/a><\/p>\n
Individual can request access, to be approved by their manager, at https:\/\/forms.microsoft.com\/Pages\/ResponsePage.aspx?id=wbRnJe2w9UCu41jXxfPisjf18JL-t61BkoGkoNxr24lUMk0zRVJIQURTTFc0RkpKOTdINkREM0s4MiQlQCN0PWcu<\/a><\/p>\n
Logging In<\/h1>\n
You will be able to log into the OpenSearch Dashboards site using the same https:\/\/syslogging.vip.windstream.net:5601\/<\/a> URL. For now, though, the DEV OpenSearch installation is available at https:\/\/ltrkarkvm1577.mgmt.windstream.net:5601<\/a> \u2013 log in through PingID<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/thumbnails\/473697523\/image2024-4-4_13-35-23.png?version=1&modificationDate=1712252124000&api=v2\")
<\/span><\/p>\nAnd you will be at the OpenSearch Dashboards home page<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-36-4.png?version=1&modificationDate=1712252164000&api=v2\")
<\/span><\/p>\nTo navigate around the site, click on the hamburger button in the upper left-hand corner of the page<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-36-39.png?version=1&modificationDate=1712252199000&api=v2\")
<\/span><\/p>\nSwitching Tenants<\/h1>\n
Data from different sources are sorted into “tenants” \u2013 you may only have access to a single tenant. In the upper right-hand corner of the page, there will be a circle with a letter \u2013 click that circle. The current tenant will be displayed under your username (the tenant shown here is ‘admin_tenant’). On the same menu, there is an option to “Switch tenants”<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/thumbnails\/473697523\/image2024-4-4_13-40-53.png?version=1&modificationDate=1712252454000&api=v2\")
<\/span><\/p>\nClicking “Switch tenants” will bring up a new pane \u2013 you can chose the tenant you want from the drop-down. Click “Confirm” to switch to the selected tenant.<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-42-7.png?version=1&modificationDate=1712252527000&api=v2\")
<\/span><\/p>\nSearching<\/h1>\n
Searching: Discover Overview<\/h2>\n
To perform ad hoc queries against stored data, use the hamburger button to expand the left-hand navigation menu and select “Discover”.<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/thumbnails\/473697523\/image2024-4-5_10-37-50.png?version=1&modificationDate=1712327871000&api=v2\")
<\/span><\/p>\n“Discover” lets you perform ad hoc queries against the stored data using the same query language as was used in ElasticSearch<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-37-57.png?version=1&modificationDate=1712252278000&api=v2\")
<\/span><\/p>\nYou will notice that “documents” stored in OpenSearch have key:value pairs (field names and data, categories and info, etc) \u2013 in this example, “fields” such as “log.offset”, “agent.hostname”, “@timestamp”, “source”, “tags”, “hostname”, “input.type”, “index”, “Sourcetype”, “host.hostname”, “host.architecture”, etc exist. Each field has a value — “@timestamp” is August 17, 2022 at 16:21:20.518\u00a0\u2013 and you can use the search to find documents matching your criteria.<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-8-17_16-21-48.png?version=1&modificationDate=1712252955000&api=v2\")
<\/span><\/p>\nSearch Tips<\/h2>\n
Selecting the Time Range<\/h3>\n
When you search stored data, the default is to search the last 15 minutes of data. To change this time range, click on the calendar icon next to the “Last 15 minutes” text and select the time range you want to display<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-5_10-39-45.png?version=1&modificationDate=1712327986000&api=v2\")
<\/span><\/p>\nTo search for a specific time range,click on the “Show dates” text<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-5_10-42-39.png?version=1&modificationDate=1712328159000&api=v2\")
<\/span><\/p>\nThere will now be two fields for the start and end range of the time span. You can click on either the start or end time to set those values. Clicking on one, you will see three options\u00a0\u2013 “Now” means the range start\/end will be set to whatever the current date\/time is when the search is performed or refreshed. “Relative” allows you to specify an interval (I know this happened in the last three hours, so I can search from 3 hours ago to now).<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-5_10-45-22.png?version=1&modificationDate=1712328323000&api=v2\")
<\/span><\/p>\nAbsolute allows you to chose a date and time<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/thumbnails\/473697523\/image2024-4-5_10-48-4.png?version=1&modificationDate=1712328485000&api=v2\")
<\/span><\/p>\nViewing Data<\/h3>\n
When viewing log data, there are several parts of the screen. The top right quadrant has a histogram showing how many matching documents have been found over the time interval.<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-5_10-54-19.png?version=1&modificationDate=1712328860000&api=v2\")
<\/span><\/p>\nHovering your mouse over a column will show you the exact count and time interval \u2013 in this example, each column represents a 10 minute period, and 2,788 documents matched the search<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/thumbnails\/473697523\/image2024-4-5_10-55-41.png?version=1&modificationDate=1712328941000&api=v2\")
<\/span><\/p>\nBelow the histogram, you will see the records \u2013 the default display has the document timestamp and the entire message (Source). To view a single record, click the magnifying glass icon next to the record.<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/thumbnails\/473697523\/image2024-4-5_10-57-43.png?version=1&modificationDate=1712329063000&api=v2\")
<\/span><\/p>\nA new pane will appear on the right-hand side with the document details.<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-5_10-58-37.png?version=1&modificationDate=1712329117000&api=v2\")
<\/span><\/p>\nClicking the “+” before a field value will filter the records to just<\/em> those where the field has the value displayed<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-5_11-8-38.png?version=1&modificationDate=1712329719000&api=v2\")
<\/span><\/p>\nIn this example, we now have all records where “Action” is “Login”<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-5_11-11-12.png?version=1&modificationDate=1712329873000&api=v2\")
<\/span><\/p>\nAnd finally, the left-hand column displays the fields found within the documents. Clicking the magnifying glass next to a field will display the top 5 frequently occurring values for that field \u2013 7.7% of the records have “TELNET” as the port value in this example.<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-5_11-0-55.png?version=1&modificationDate=1712329255000&api=v2\")
<\/span><\/p>\nClicking on the + next to the TELNET value will filter the searched records to just those where Port is TELNET \u2013 clicking the minus would filter records to everything where Port is not<\/em> TELNET<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-5_11-2-13.png?version=1&modificationDate=1712329333000&api=v2\")
<\/span><\/p>\nSelecting Displayed Field<\/h3>\n
When viewing the field list, you can click the plus icon next to a field to change the values displayed in the table data.<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/thumbnails\/473697523\/image2024-4-5_10-51-55.png?version=1&modificationDate=1712328715000&api=v2\")
<\/span><\/p>\nThe fields displayed in the table will be listed in “Selected Fields” at the top of the fields list<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-5_10-51-35.png?version=1&modificationDate=1712328695000&api=v2\")
<\/span><\/p>\nClicking the red X next to a selected field will remove it from the data table.<\/p>\n
![](\"https:\/\/wiki.windstream.com\/download\/thumbnails\/473697523\/image2024-4-5_11-6-3.png?version=1&modificationDate=1712329563000&api=v2\")
<\/span><\/p>\nBasic Search<\/h3>\n
To search for a full string, indicate the field name that you want to search followed by a colon. Then enter what you want to find. As an example, finding records from the BNG named bng04.lncl01-ne.us.windstream.net means entering<\/p>\n
hostname: bng04.lncl01-ne.us.windstream.net<\/pre>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-8-17_16-19-10.png?version=1&modificationDate=1712252955000&api=v2\")
<\/span><\/p>\nWildcard Search<\/h3>\n
You can use ? to match any single character \u2013 this is useful when you are searching for a number of hosts simultaneously (dns??.example.com will match dns01.example.com though dns99.example.com).<\/p>\n
You can use * to match zero or more characters \u2013 this means dns*.example.com would match dns.example.com, dns1.example.com, and dns1234568793.example.com<\/p>\n
Substring Search<\/h3>\n
To search for a substring, use * around your search string \u2013 looking for documents from any of the devices with inmn01-sc in their name, search for:<\/p>\n
\"source\": *inmn01-sc.us*\r\n\r\n<\/pre>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-9-30_14-7-16.png?version=1&modificationDate=1712252955000&api=v2\")
<\/span><\/p>\nSearch for a String That Contains Word Boundaries<\/h3>\n
When your search string contains something the tokenizer considers a word boundary (the “.” characters in hostnames, for example), you may find the results contain more than you want. Basically, searching for foo.bar<\/em> will return any document matching foo<\/em> and any document matching bar<\/em><\/p>\n
- Dashboard<\/a><\/span><\/li>\n
- TSVB (Time Series Visualization Builder)<\/a><\/span><\/li>\n
- Viewing Data<\/a><\/span><\/li>\n
- Search Tips<\/a><\/span>\n
- What is OpenSearch?<\/a><\/span><\/li>\n
- What is ElasticSearch?<\/a><\/span><\/li>\n
![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-8-17_16-28-52.png?version=1&modificationDate=1712252956000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-8-17_16-32-10.png?version=1&modificationDate=1712252956000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-8-17_16-37-34.png?version=1&modificationDate=1712252956000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-48-47.png?version=1&modificationDate=1712252927000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-49-48.png?version=1&modificationDate=1712252988000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-47-26.png?version=1&modificationDate=1712252846000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-47-52.png?version=1&modificationDate=1712252872000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-51-46.png?version=1&modificationDate=1712253107000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-53-18.png?version=1&modificationDate=1712253198000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/thumbnails\/473697523\/image2024-4-4_13-53-59.png?version=1&modificationDate=1712253240000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-56-10.png?version=1&modificationDate=1712253370000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_13-56-43.png?version=1&modificationDate=1712253403000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/thumbnails\/473697523\/image2024-4-4_14-6-44.png?version=1&modificationDate=1712254005000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_14-7-38.png?version=1&modificationDate=1712254058000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_14-9-2.png?version=1&modificationDate=1712254142000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2024-4-4_14-8-39.png?version=1&modificationDate=1712254119000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-7-13_15-1-23.png?version=1&modificationDate=1712254041000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-7-13_15-1-29.png?version=1&modificationDate=1712254041000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-7-13_15-1-34.png?version=1&modificationDate=1712254041000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-7-13_15-1-41.png?version=1&modificationDate=1712254041000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-7-13_15-1-47.png?version=1&modificationDate=1712254041000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/attachments\/473697523\/image2022-7-13_15-1-57.png?version=1&modificationDate=1712254042000&api=v2\")
<\/span><\/p>\n![](\"https:\/\/wiki.windstream.com\/download\/thumbnails\/473697523\/image2022-7-13_15-2-2.png?version=1&modificationDate=1712254042000&api=v2\")
<\/span><\/p>\n