Kibana 根据日志值计算唯一记录

Question

I want to create a Kibana metric for the unique users visiting my site. I have an index collecting logs from a service in format

<date> <user1@gmail.com> - <log message> <client>

and I want to count unique user emails ignoring the rest of the fields.

Is it possible to do such a regex via some of the aggregations? Currently I was able to find only unique count based on some specific field which is not an option for me.

Answer 1

You can create a separate field first:

1. Either by using kibana scripted fields.
2. Or by using logstash mutate filter plugin.

And then you can apply terms aggregation on data table visualization to achieve this.