In [1]:
library(jsonlite)
In [2]:
setwd("C:/Users/Johannes/Projects/results/output/20161218")
jsonData <- fromJSON("20161218-logstash.json", flatten = TRUE)
In [3]:
print(head(jsonData))
_index _type _id _score sort
1 logstash-2016.12.18 logs AVkR139EbpknfgCFxFy4 NA 1.482063e+12
2 logstash-2016.12.18 logs AVkR139NbpknfgCFxFy5 NA 1.482063e+12
3 logstash-2016.12.18 logs AVkR13WMbpknfgCFxFyH NA 1.482063e+12
4 logstash-2016.12.18 logs AVkR13WMbpknfgCFxFyG NA 1.482063e+12
5 logstash-2016.12.18 logs AVkR13WMbpknfgCFxFyE NA 1.482063e+12
6 logstash-2016.12.18 logs AVkR13WMbpknfgCFxFyF NA 1.482063e+12
_source.source_host _source.level _source.created
1 40.68.164.185 6 2016-12-18T12:10:35.454949019Z
2 40.68.164.185 6 2016-12-18T12:10:35.058709599Z
3 40.68.164.185 6 2016-12-18T12:10:35.528087556Z
4 40.68.164.185 6 2016-12-18T12:10:35.528087556Z
5 40.68.164.185 3 2016-12-18T12:10:35.058709599Z
6 40.68.164.185 6 2016-12-18T12:10:35.528087556Z
_source.message
1 worker:ready Worker started.
2 worker:ready Worker started.
3 <NA>
4 > node app.js
5 npm info lifecycle elastic-worker@1.0.0~start: elastic-worker@1.0.0
6 > elastic-worker@1.0.0 start /usr/src/app
_source.version _source.command _source.tags _source.image_name
1 1.1 npm start NULL djbnjack/elastic-worker:latest
2 1.1 npm start NULL djbnjack/elastic-worker:latest
3 1.1 npm start NULL djbnjack/elastic-worker:latest
4 1.1 npm start NULL djbnjack/elastic-worker:latest
5 1.1 npm start NULL djbnjack/elastic-worker:latest
6 1.1 npm start NULL djbnjack/elastic-worker:latest
_source.@timestamp _source.container_name
1 2016-12-18T12:10:52.628Z elastic-workers.7.614ldil5k7w0bahkgkmi3ncx4
2 2016-12-18T12:10:52.486Z elastic-workers.41.b93a0xuk5vbw0540rqu3gjlza
3 2016-12-18T12:10:50.141Z elastic-workers.11.2y9axe7110ubv3j11fpmpya68
4 2016-12-18T12:10:50.140Z elastic-workers.11.2y9axe7110ubv3j11fpmpya68
5 2016-12-18T12:10:50.131Z elastic-workers.41.b93a0xuk5vbw0540rqu3gjlza
6 2016-12-18T12:10:50.131Z elastic-workers.11.2y9axe7110ubv3j11fpmpya68
_source.host _source.@version _source.tag
1 node-06 1
2 node-06 1
3 node-06 1
4 node-06 1
5 node-06 1
6 node-06 1
_source.image_id
1 sha256:82850a5886f9bde2fef20e81e7e9339d65796066bd246b856375ce8dedffd90b
2 sha256:82850a5886f9bde2fef20e81e7e9339d65796066bd246b856375ce8dedffd90b
3 sha256:82850a5886f9bde2fef20e81e7e9339d65796066bd246b856375ce8dedffd90b
4 sha256:82850a5886f9bde2fef20e81e7e9339d65796066bd246b856375ce8dedffd90b
5 sha256:82850a5886f9bde2fef20e81e7e9339d65796066bd246b856375ce8dedffd90b
6 sha256:82850a5886f9bde2fef20e81e7e9339d65796066bd246b856375ce8dedffd90b
_source.container_id
1 1c00dc95b1e8fb17b98836d076236c37d6978ffef5b4c207b9824d8aeadde34d
2 db265d4d66b7cd561934b23ae597974d0aa9b28f54c7ff4267d68b4ff439287f
3 e20a08f6bea03a3a90d1589ef89f565b38232f8256e21c09808c57e362ff0055
4 e20a08f6bea03a3a90d1589ef89f565b38232f8256e21c09808c57e362ff0055
5 db265d4d66b7cd561934b23ae597974d0aa9b28f54c7ff4267d68b4ff439287f
6 e20a08f6bea03a3a90d1589ef89f565b38232f8256e21c09808c57e362ff0055
_source.short_message fields.created fields.@timestamp
1 <NA> 1.482063e+12 1.482063e+12
2 <NA> 1.482063e+12 1.482063e+12
3 1.482063e+12 1.482063e+12
4 <NA> 1.482063e+12 1.482063e+12
5 <NA> 1.482063e+12 1.482063e+12
6 <NA> 1.482063e+12 1.482063e+12
In [5]:
colnames(jsonData)
- '_index'
- '_type'
- '_id'
- '_score'
- 'sort'
- '_source.source_host'
- '_source.level'
- '_source.created'
- '_source.message'
- '_source.version'
- '_source.command'
- '_source.tags'
- '_source.image_name'
- '_source.@timestamp'
- '_source.container_name'
- '_source.host'
- '_source.@version'
- '_source.tag'
- '_source.image_id'
- '_source.container_id'
- '_source.short_message'
- 'fields.created'
- 'fields.@timestamp'
In [9]:
head(jsonData[,c("_source.created","_source.message")])
_source.created _source.message
2016-12-18T12:10:35.454949019Z worker:ready Worker started.
2016-12-18T12:10:35.058709599Z worker:ready Worker started.
2016-12-18T12:10:35.528087556Z NA
2016-12-18T12:10:35.528087556Z > node app.js
2016-12-18T12:10:35.058709599Z npm info lifecycle elastic-worker@1.0.0~start: elastic-worker@1.0.0
2016-12-18T12:10:35.528087556Z > elastic-worker@1.0.0 start /usr/src/app
In [55]:
workerStart <- jsonData[grep("worker:start", jsonData$"_source.message", ignore.case=T),]
head(workerStart[,c("_source.created","_source.host","_source.message")])
cat("N:", nrow(workerStart))
Error in `[.data.frame`(workerStart, , c("@timestamp", "_source.host", : undefined columns selected
Traceback:
1. head(workerStart[, c("@timestamp", "_source.host", "_source.message")])
2. workerStart[, c("@timestamp", "_source.host", "_source.message")]
3. `[.data.frame`(workerStart, , c("@timestamp", "_source.host",
. "_source.message"))
4. stop("undefined columns selected")
In [41]:
workerDone <- jsonData[grep("worker:done", jsonData$"_source.message", ignore.case=T),]
head(workerDone[,c("_source.created","_source.host","_source.message")])
cat("N:", nrow(workerDone))
_source.created _source.host _source.message
4178 2016-12-18T11:08:00.109593474Z node-01 worker:done Finished with task H:CC:S for workflow 08359320-c516-11e6-99c6-755b0ed3b6d2
4222 2016-12-18T11:08:00.254009919Z node-09 worker:done Finished with task H:CC:S for workflow e1c24850-c515-11e6-99c6-755b0ed3b6d2
4223 2016-12-18T11:08:00.109593474Z node-01 worker:done Finished with task G:CC:M for workflow 08359320-c516-11e6-99c6-755b0ed3b6d2
4271 2016-12-18T11:08:00.254009919Z node-09 worker:done Finished with task G:CC:M for workflow e1c24850-c515-11e6-99c6-755b0ed3b6d2
4360 2016-12-18T11:08:00.449816519Z node-09 worker:done Finished with task D:CC:M for workflow 08359320-c516-11e6-99c6-755b0ed3b6d2
4368 2016-12-18T11:08:02.211040263Z node-05 worker:done Finished with task G:CC:S for workflow 1911fb20-c516-11e6-99c6-755b0ed3b6d2
N: 436
In [50]:
workerStart$start <- 1
In [51]:
workerStart$time <- as.POSIXlt(workerStart$"_source.created", format="%Y-%m-%dT%H:%M:%S",
origin="1970-01-01",tz="GMT")
In [54]:
workerStart[,c("time","start")]
time start
4221 2016-12-18 11:08:00 1
4270 2016-12-18 11:08:00 1
4359 2016-12-18 11:08:00 1
4414 2016-12-18 11:08:02 1
4419 2016-12-18 11:08:00 1
4423 2016-12-18 11:08:02 1
4424 2016-12-18 11:07:59 1
4428 2016-12-18 11:08:00 1
4523 2016-12-18 11:07:59 1
4527 2016-12-18 11:07:59 1
4568 2016-12-18 11:08:00 1
4574 2016-12-18 11:08:00 1
4577 2016-12-18 11:07:59 1
4578 2016-12-18 11:07:59 1
4581 2016-12-18 11:08:00 1
4582 2016-12-18 11:07:59 1
4583 2016-12-18 11:07:59 1
4585 2016-12-18 11:07:59 1
4586 2016-12-18 11:08:00 1
4587 2016-12-18 11:08:02 1
4629 2016-12-18 11:08:02 1
4634 2016-12-18 11:08:02 1
4675 2016-12-18 11:08:02 1
4681 2016-12-18 11:08:02 1
4689 2016-12-18 11:08:00 1
4710 2016-12-18 11:08:00 1
4711 2016-12-18 11:08:00 1
4723 2016-12-18 11:07:59 1
4724 2016-12-18 11:08:02 1
4725 2016-12-18 11:08:00 1
... ... ...
10166 2016-12-18 11:08:00 1
10167 2016-12-18 11:08:00 1
10202 2016-12-18 11:08:00 1
10221 2016-12-18 11:08:01 1
10245 2016-12-18 11:08:00 1
10247 2016-12-18 11:08:00 1
10249 2016-12-18 11:08:02 1
10255 2016-12-18 11:08:00 1
10256 2016-12-18 11:08:00 1
10257 2016-12-18 11:08:00 1
10259 2016-12-18 11:07:59 1
10306 2016-12-18 11:08:00 1
10307 2016-12-18 11:08:00 1
10314 2016-12-18 11:08:00 1
10316 2016-12-18 11:07:59 1
10317 2016-12-18 11:08:00 1
10319 2016-12-18 11:08:00 1
10321 2016-12-18 11:07:59 1
10323 2016-12-18 11:08:02 1
10348 2016-12-18 11:07:59 1
10351 2016-12-18 11:08:02 1
10368 2016-12-18 11:07:59 1
10377 2016-12-18 11:08:00 1
10398 2016-12-18 11:08:00 1
10399 2016-12-18 11:08:00 1
10400 2016-12-18 11:08:02 1
10417 2016-12-18 11:08:00 1
10491 2016-12-18 11:08:00 1
10492 2016-12-18 11:07:59 1
10588 2016-12-18 11:08:02 1
In [53]:
plot(workerStart$time, workerStart$start)
In [ ]:
Content source: elastic-bpm/results
Similar notebooks: