Kibana加载样本数据

kibana 6.2 加载样本数据

kibana loading sample data

下载样本数据

# 莎士比亚经典作品
wget https://download.elastic.co/demos/kibana/gettingstarted/shakespeare_6.0.json

# 一组虚拟生成的账户数据
wget https://download.elastic.co/demos/kibana/gettingstarted/accounts.zip

# 一组虚拟生成的日志数据
wget https://download.elastic.co/demos/kibana/gettingstarted/logs.jsonl.gz

解压文件

unzip accounts.zip
gunzip logs.jsonl.gz

数据格式

Shakespeare数据集

{
    "line_id": INT,
    "play_name": "String",
    "speech_number": INT,
    "line_number": "String",
    "speaker": "String",
    "text_entry": "String",
}

account数据集

{
    "account_number": INT,
    "balance": INT,
    "firstname": "String",
    "lastname": "String",
    "age": INT,
    "gender": "M or F",
    "address": "String",
    "employer": "String",
    "email": "String",
    "city": "String",
    "state": "String"
}

logs数据集

{
    "memory": INT,
    "geo.coordinates": "geo_point"
    "@timestamp": "date"
}

Mapping Fields

加载这些数据之前，需要先创建它们的索引，并创建字段映射

在Kibana的Dev Tools > Console中，创建索引

PUT /shakespeare
{
    "mappings": {
        "doc": {
            "properties": {
                "speaker": {"type": "keyword"},
                "play_name": {"type": "keyword"},
                "line_id": {"type": "integer"},
                "speech_number": {"type": "integer"}
            }
        }
    }
}

• speaker和play_name被指定为keyword类型的字段，它们不会被分析器分析
• line_id和speech_number被指定为integer类型

logs数据集需要映射经纬度

PUT /logstash-2015.05.18
{
    "mappings": {
        "log": {
            "properties": {
                "geo": {
                    "properties": {
                        "coordinates": {
                            "type": "geo_point"
                        }
                    }
                }
            }
        }
    }
}

PUT /logstash-2015.05.19
{
    "mappings": {
        "log": {
            "properties": {
                "geo": {
                    "properties": {
                        "coordinates": {
                            "type": "geo_point"
                        }
                    }
                }
            }
        }
    }
}

PUT /logstash-2015.05.20
{
    "mappings": {
        "log": {
            "properties": {
                "geo": {
                    "properties": {
                        "coordinates": {
                            "type": "geo_point"
                        }
                    }
                }
            }
        }
    }
}

accounts数据集使用默认的映射即可

加载数据集

curl -H 'Content-Type: application/x-ndjson' -XPOST 'localhost:9200/bank/account/_bulk?pretty' --data-binary @accounts.json

curl -H 'Content-Type: application/x-ndjson' -XPOST 'localhost:9200/shakespeare/doc/_bulk?pretty' --data-binary @shakespeare_6.0.json

curl -H 'Content-Type: application/x-ndjson' -XPOST 'localhost:9200/_bulk?pretty' --data-binary @logs.jsonl

查看是否成功加载

GET /_cat/indices?v