Kibana Logstash frontend

[Jens Braeuer]

Hi everyone,

I wonder who of you is using Kibana
(https://github.com/rashidkpc/Kibana) and what are your experiences with
it so far. How do the features compare to the built-in webinterface of
logstash?

Thanks,
Jens

[Joe Miller]

Any screenshots available of Kibana?

[Jeremiah Shirk]

I found a few at http://rashidkpc.github.com/Kibana/about.html

-- 

Jeremiah Shirk

[Matt Moor]

We're using it, and are pretty happy so far. We have 320M messages in
ElasticSearch, increasing at a rate of about 250/s and it's pretty
responsive (this probably comes down to scaling ES). UI is definitely
a lot easier than logstash-web, though there are a few quirks (the
time-range filter only operates on the set returned by the search,
which also has a time filter... easy to forget and wonder why you're
not showing any messages!)

Early days for us, though - we're certainly not splitting on fields as
much as we should be, so our searches tend to be quite broad and not
take advantage of browsing and filtering results by field.

Cheers,

Matt

[JaimeGago]

Matt,
Any reason you went for Kibana? I'm currently looking at Logstash and it seems many folks prefer the graylog2 web UI with which logstash supposedly integrates easily.

J.

[Dick Davies]

Graylog2 is a bit heavyweight. Also: mongodb <shudder/>.

[Matt Moor]

Hi Jaime,

We did a lot of scalability testing around the ES backend (we're
expecting to increase our log throughput by at least an order of
magnitude in the near future), and wanted to stay as close to that as
possible. Early research left us pretty skeptical as to how graylog2
(well, mongoDB) would cope with the volume we expect.

Cheers,

Matt

[Dick Davies]

In fairness they're not using the mongo instance for storing
the messages any more, but unfortunately all user settings, accounts,
streams, and other essential bits of the Graylog UI are still in there.

It's not so much a throughput issue as a 'oh god am I going
to have to recover all this every time the box reboots' one :)