Chapter 3.  Business Analytics with Kibana 5.0

At this point, you should have the Elastic Stack installed and be able to start creating dashboards and visualizations. We will focus on the logging analytics use case in this chapter and dig into two examples: the Paris accidentology, which gives insights into traffic accidents in Paris; and server logging analytics, which gives insights into traffic over an Apache server.

The main topics we are going to see in this chapter are:

• How to import data in Elasticsearch with Logstash

• Building a Kibana dashboard from end to end

• Analyzing business data in Kibana

As a quick introduction to this chapter, I would like to devote few lines to the following question: What is a log?

A log is an event that contains a timestamp and a description of the event itself. It is appended to a journal or log file sequentially, and in which all lines of logs are ordered based on the timestamp. As an example, here is an Apache server log:

83.149.9.216 - - [28/May/2014:16...

Business use case - Paris accidentology

You might wonder why I took Paris accidentology to illustrate the logging analytics use case. Well, I want to break into pieces the unfair reputation that sometimes sticks in people's minds when it comes to visualization with Kibana. Kibana is a visualization application; it's not only meant to be used by IT operations teams to monitor their application's health.

The name of the use case you are dealing with is just an abstraction that defines the use profile over your data. You can do logging analytics and actually deal with healthcare data, and do application monitoring with the same logs. It just depends on the nature and content of your data, also on the use profile of your visualization. If I put on my security hat, then I'll do security analytics on top of the ingested logs.

The Paris accidentology use case will help us to go through most of the visualizations and features that Kibana offers to implement logging analytics.

Data modeling - entity...

Summary

Here ends our business analysis chapter on Paris accidentology. You should have a good vision of how to build a pipeline in Logstash to import data from a CSV file or any other sources. Also, we have seen how to compose a dashboard with different types of visualization, with the aim of applying business analytics questions to our data.

The next chapter addresses a more technical topic, namely Apache server logging analytics. The methodology is the same; we'll just use a different approach to import data and obviously ask different questions.