Aggregating a list of http log paths in kibana - nginx

I have a nginx->fluentd->elasticsearch->kibana stack up and running. Trying to figure if I can do something like a "terms" panel but with a path string component from logs. Using a terms panel directly on that results in top used words from paths, e.g. for drupal it shows "node" as the most popular, which is quite useless without actual node id.
Is that something that is possible to do with elasticsearch?
Update: Here's a sample of my logs:
"path": "/node/123"
"path": "/node/456"
"path": "/user/create"
If I add a "terms" panel for "path" field, I get columns for "node", "user", "create", which make no statistical sense. What I need is a terms panel that aggregates on unique field values, not unique word parts of the field.

You need to configure Elasticsearch's mapping for setting your "path" field as a "not_analyzed" one. The default setting is "analyzed" and by default, ES parses the string fields and divide them in multiple tokens when possible, which is probably what happened in your case. See this related question.
As for how to configure Elasticsearch's mapping, I am also still digging, having a similar problem myself with multi-token strings I want to be able to sort on. It seems like there would be a put mapping API or the possibility of using config files, see here.

Related

Choosing the right name for properties in schema for Weaviate

When loading my schema into Weaviate, I get an error message that the property name can not be found in the contextionary. Some of the properties I need are abbreviations.
This is the schema item it is complaining about:
{
"cardinality": "atMostOne",
"dataType": [
"boolean"
],
"description": "Is this a BLWS elbow yes or no",
"keywords": [
{
"keyword": "BLWS",
"weight": 1
}
],
"name": "blws"
}
This is the error message I get:
2019-09-04T11:47:07.202646 ERROR: {'error': [{'message': "Could not
find the word 'blws' from the property 'blws' in the class name
'Elbow' in the contextionary. Consider using keywords to define the
semantic meaning of this class."}]}
The misleading error
The error message
Consider using keywords to define the semantic meaning of this class
is outdated and and the recommendation in fact not helpful. There is already a GitHub issue to clean this up: https://github.com/semi-technologies/weaviate/issues/929
Prior to https://github.com/semi-technologies/weaviate/issues/856 it was possible to replace an unknown property word with known keywords, but #856 removed that possibility.
However, even prior to the change your schema would not have been accepted, see below.
About property names which are not in the contextionary
A property name consist of one or more recognized parts which is known by the contextionary. By "part" I mean that if you combine multiple words using camelCasing each word would be one part. So for example
drivesVehicle would be valid as it consists of two known words: drives, vehicle
drivesAVehicle would also be valid, as it contains two known words and a stop word (a). Note: Stopwords are fine as long as your property contains at least one non-stopword.
drivesBlws would be invalid, as blws is not a known word
We have discussed adding an ability to add custom words. The proposal can be considered accepted, but at the time of this writing it is not in immediate prioritization.
Why so strict about known words?
One of the core functionalities of weaviate is concept searching ("vector-based searching"), so weaviate must be able to calculate a vector position for each property. It can only do that if it recognizes the words
How to solve this?
Try describing a "blws" with known words. For example if "blws" was an acronoym for "bold long wide short", you could name the property boldLongWideShort. As mentioned above, we will add the ability to add custom words in the future, but as of now that's not supported yet.

Filter at event viewer by data

I want to get event entries by their description (data).
I know how to get the event entry with a certain description, however I want to get an entry whith a description which contains a string (not equals to it).
That, I don't know how to do.
Please help :)
According to my answer here: https://stackoverflow.com/a/34119006/5089204 you should be able to retrieve EventRecords.
Dealing with these events is a quite complex issue... Each event has its own internal structure. The common properties are bundled in EventRecord, but the specific data must be taken from the internal details. Use the ToXml() method of an EventRecord...
In order to get the right events you must define an EventLogQuery. You must know the Provider's name and specify the filter.
Try the following: Open eventvwr and there the Windows-System queue. Right click one event, open the "Details" and choose the "XML-View". Look over different events and you will find, that they are quite differing.
But: You'll find everything you need there: First the "Provider Name" and the "EventId", these two are most important for the `EventLogQuery'.
Now go to the "define a user filter on the current protocoll"-action and type in some values. Then switch to the filter's XML and you'll learn how to define the correct query.
I'm sorry, there is no "easy and general" approach :-)

Filter property based searches in Artifactory

I'm looking to use the Artifactory property search
https://www.jfrog.com/confluence/display/RTF/Artifactory+REST+API#ArtifactoryRESTAPI-ArtifactSearch%28QuickSearch%29
Currently this will pull json listing any artifact that matches my properties.
"results" : [
{
"uri": "http://localhost:8080/artifactory/api/storage/libs-release-local/org/acme/lib/ver/lib-ver.pom"
},{
"uri": "http://localhost:8080/artifactory/api/storage/libs-release-local/org/acme/lib/ver2/lib-ver2.pom"
}
]
I need to be able to filter the artifacts I get back as i'm only interested in a certain classifier. The GAVC Search has this with &c=classifier
I can do it in code if this isn't possible via the interface
Any help appreciated
Since the release of AQL in Artifactory 3.5, it's now the official and the preferred way to find artifacts.
Here's an example similar to your needs:
items.find
(
{
"$and":[
{"#license":{"$eq":"GPL"}},
{"#version":{"$match":"1.1.*"}},
{"name":{"$match":"*.jar"}}
]
}
)
To run the query in Artifactory, copy the query to a file and name it aql.query
Run the following command from the directory that contains the aql.query file
curl -X POST -uUSER:PASSWORD 'http://HOST:PORT/artifactory/api/search/aql' -Taql.query
Don't forget to replace the templates (USER, PASSWORD,HOST and PORT) to real values.
In the example
The first two criteria are used to filter items by properties.
The third criteria filters items by the artifact name (in our case the artifact name should end with .jar)
For more details on how to write AQL query are in AQL
Old answer
Currently you can't combine the property search with GAVC search.
So you have two options:
Executing one of them (whichever gives you more precise results) and then filter the JSON list on the client by a script
Writing an execution user plugin that will execute the search by using the Searches service and then filter the results on the server side.
Of course, the later is preferable.

Yahoo Pipes - Build an RSS-URL using specific parameters pulled from another RSS feed's content

The main Data Type used by Yahoo Pipes is the [Item], which is RSS feed content. I want to take an RSS's content or sub-element, make it into [Text] (or a number might work), and then use it as an INPUT into a [Module] to build a RSS-URL with specific parameters. I will then use the new RSS-URL to pull more content.
Could possibly use the [URL Builder Module] or some work-around.
The key here is using "dynamic" data from an RSS feed (not user input, or a static data), and getting that data into a Data Type that is compatible (and/or accessible) as an INPUT into a module.
It seems like a vital functionality, but I cannot figure it out. I have tried many, many work-around attempts, with no success.
The Specific API and Methods (if you are interested)
Using the LastFM API.
1st Method: user.getWeeklyChartList. Then pick the "from" (start) and "to" (end) Unix timestamps from 1 year-ago-today.
2nd Method: user.getWeeklyAlbumChart using those specific (and "dynamic") timestamps to pull my top albums for that week.
tl;dr. Build an RSS-URL using specific parameters from another RSS feed's content.
I think I may have figured it out. I doubt it is the best way, but it works. The problem was the module I needed to use didn't have and input node. But the Loop module has an input node, so if I embed the URL builder into the Loop module I can then access sub-element content from the 1st feed to use as parameters to build the URL for the 2nd feed! Then I can just scrap all the extra stuff generated by the Loop, by using Truncate.

Drupal Views (Page) Using Human-Friendly Path

I have CCK and Views module installed. For the sake of this question scope, I'll call the content type as Project. Projects have many Members.
Project nodes are accessible through /project/project-name. I want to be able to display list of members through path /project/project-name/members.
Is there any way to do this?
Currently I have a views setup for page display on path /project/%/members, and have the argument taken from the url. I realize I can't use "Node ID from URL" option directly since it's node name instead of node id. Therefore I tried to enable "PHP Code" argument. But the problem is, Drupal Views always assume that the parameter is "project-name" and therefore ignored my php code argument setting. Anyone knows how I might be able to do this?
Thanks
Yes, you can actually use the "Node ID from URL" option, and you should.
Use the path or pathauto module to generate human-readable URLs for your projects in the form project/project-name. This will create a human-readable alias for the node, but the underlying Drupal system path is still node/nid.
Views can still use the "Node ID from URL" as an argument (or Contextual filter, as they are known in Drupal 7) even with human-readable aliases for those ugly paths.
If the project's name is the node title you can get what you want pretty easily.
You can pass the node title as argument instead of the nid, but the result will be the same. You get some options to use lowercase, transform - to space ect, as what you can do in a url is limited compared to a node title.
The rest of the view would be the same, as the solution using node nids in the url.
You need to create path aliases for /project/project-NID/members to /project/project-Name/members
I asked this exact question a month ago. :)
drupal link to view dependent on argument

Resources