Kibana 4: missing features from Kibana 3

[flopma]

Hi,

Thank you for this software which is really powerful and useful.

We currently use Kibana 3 to help use understand what is triggering certain problems on the web applications we operates (the Atlassian stack - jira/confluence/bamboo/fisheye/...). The logs Apache HTTPD generates daily are enourmous and Kibana helps us.

I just tried to replace Kibana 3 by Kibana 4 but the new interface does not permit easily to create dynamic multi-queries search with different colors, add markers. Kibana 3 is powerful in this. And digging the access_log of httpd with Kibana 3 like this is mostly useful because the multi-queries you use today maybe be different than the one tomorrow, etc... because the performance (or others) problems arising today in the application we monitor might be different the day after. Kibana 4 does not help in this (or am I just ignorant in its usage ?).

Any information regarding the plans you have for the functionnality Kibana 3 provides ? Are you done with Kibana 3 - no more update (maybe it is mature enough?) ? Or will you integrate this functionnality in Kibana 4 ?

Thx a lot,

Issa

[rashidkpc]

Multi query is implemented as the filters aggregation, see the Visualize tab.

There is a ticket for markers here: #1983

[flopma]

I did saw the Visualize tab - but it is not as dynamic as in Kibana 3, is it ? In Kibana 4, you need to make a search, then prepare the graph from the search, then save it, then import it in a dashboard... And if tomorrow, you need another set of queries, you need to do the same things from 3 differents tabs

In version 3, searching and visualizing is combined....

[ssoto]

@flopma One search could have several visualizations and the same thing with visualizations and dashboards. Did you consider that?

[flopma]

Yes, sure. But if you use kibana to track a new "problem" occuring in your production environnment, Kibana 3 will be more helpful than Kibana 4 because of its flexible way of creating search requests. Kibana 4 seems more geared for dashboards you would stabilized and use day to day, not for fine diagnostics...

[ssoto]

@flopma could you give a specific fail use case?
Maybe useful to dev team and could be a nice enhacement!

[flopma]

Well, we centralised all the Apache HTTPD access_log of 9 different
applications which are part of a big solution for developers at our site
(Atlassian Crowd, Jira, Confluence, Bamboo, Fisheye, Crucible, Nexus,
Subversion, Stash). All apps interconnects and can communicate directly with
each other (the Atlassian one). Also, we have plugins installed for some of
the apps which brings new functionnality but also possible troubles.

So when slowness appear, we never know what to look for initially.

Today it might be 2 jira plugins running awfully bad;
Tomorrow, it might be Crowd being slow because some user send lots of REST
call through Confluence which might have an impact on Crowd, and Crowd being
the authnz application, this will slow all others.

So, having predefined dashboards is useless for those kind of usage. You can
never think about all the different interactions which might create problems;
and even if you do, it would mean to create a lot of visualizations in Kibana
4.

With Kibana 3, easy, you just make use of the multi query functionnality and
the histogram is updated accordingly, and the different colors helps corralate
interacting source of problems.

Really, Kibana 4 seems geared for statistics gathering.
And we prefer Kibana 3 for our work when it comes to look through the logs to
find out why a certain problem arised.