Kibana
- Docker & Kubernetes course
- Advanced
- Lesson 58/70
- 4 min
Learn log search with Kibana.
Kibana
Kibana is the web interface for searching and visualizing logs in Elasticsearch. First a data view (formerly index pattern) is defined: loglar-* and the time field. Then you search with KQL on the Discover screen:
kubernetes.namespace_name : "magaza" and seviye : "error"
kubernetes.labels.app : "api" and not mesaj : "saglik"
istek_id : "a1b2c3"Charts like the error rate or the paths with the most errors can be added to dashboards.
Accessing Kibana
Kibana runs inside as a Service; in development it's opened with port-forward, in production with an authenticated Ingress. Since logs may contain personal data, access must be limited:
kubectl port-forward -n loglama svc/kibana 5601:5601
# http://localhost:5601 -> Discover
# Stack Management -> Data Views -> loglar-*Practice Open Kibana
Write two commands: forward the svc/kibana service in loglama from local 5601 to 5601; query http://localhost:5601/api/status with curl -s.
Starter code
# buraya yazSample solution
kubectl port-forward -n loglama svc/kibana 5601:5601
curl -s http://localhost:5601/api/statusExpected output
Forwarding from 127.0.0.1:5601 -> 5601
{"name":"kibana-7f9c","version":{"number":"8.15.3"},"status":{"overall":{"level":"available"}}}
Questions and answers
Review the lesson questions together with their answers. To test yourself, solve the lesson interactively.
1 What is the fastest way to follow a single request a user complained about across all services?
- Searching by the istek_id field Correct answer
- Downloading all logs
- Restarting the pods
- kubectl logs -A
Explanation: If every service writes the same request ID to its log, one query is enough.
2 Combine two conditions in KQL.
kubernetes.namespace_name : "magaza" ____ seviye : "error"kubernetes.namespace_name : "magaza" and seviye : "error"Explanation: KQL uses and, or, not.
3 Match.
| Term | Meaning |
|---|---|
Kibana |
Log interface |
data view |
Index pattern |
Discover |
Search screen |
KQL |
Query language |