解析ELK（filebeat+logstash+elasticsearch+kibana）日志系統原理以及k8s集群日志采集過程

ELK日志系統解析

ELK 日志系統（現常稱為 Elastic Stack，由 Filebeat、Logstash、Elasticsearch、Kibana 組成）是一套用于日志收集、清洗、存儲、檢索和可視化的開源解決方案。
它的核心價值是將分散在多臺服務器 / 應用中的日志 “匯聚成池、結構化處理、按需分析”，解決傳統日志 “查起來難、用起來亂” 的痛點。

一、ELK 各組件的核心角色

可以把 ELK 類比成 “日志工廠”，每個組件對應一個生產環節，分工明確且環環相扣：

組件	核心角色（工廠類比）	核心功能
Filebeat	日志采集員（前端）	輕量級日志采集工具，部署在每臺需要收集日志的服務器上，實時讀取本地日志文件，發送給后續組件（如 Logstash/Elasticsearch）。
Kafka【按需】	日志緩沖器（中間件）	在大規模場景（如數千臺服務器、每秒數萬條日志）下，直接用 Filebeat 發送日志到 Logstash 可能出現 “日志丟失”（如 Logstash 宕機）。此時會引入 Kafka（消息隊列）作為 “緩沖層”
Logstash	日志加工廠（中間件）	接收 Filebeat 傳來的原始日志，進行 “清洗加工”（如提取字段、過濾無用信息、格式轉換），輸出結構化日志到 Elasticsearch。
Elasticsearch	日志倉庫 + 檢索引擎（后端）	分布式搜索引擎，存儲結構化后的日志數據，支持毫秒級全文檢索（如 “查詢昨天 10 點報錯的日志”），是 ELK 的 “數據核心”。
Kibana	日志可視化面板（前端）	對接 Elasticsearch，提供可視化界面（如柱狀圖、折線圖、日志列表），支持用戶查詢、分析日志，生成監控報表。

1. 高可用模式設計：

在這里插入圖片描述

2. ELK 擴展場景：引入 Kafka 提升穩定性

在大規模場景（如數千臺服務器、每秒數萬條日志）下，直接用 Filebeat 發送日志到 Logstash 可能出現 “日志丟失”（如 Logstash 宕機）。此時會引入 Kafka（消息隊列）作為 “緩沖層”
優化流程為：
Filebeat → Kafka → Logstash → Elasticsearch → Kibana

Kafka 作用：
緩沖日志：Filebeat 將日志發送到 Kafka 后立即返回，無需等待 Logstash 處理；
解耦上下游：Logstash 宕機時，日志暫存 Kafka，恢復后從 Kafka 消費，避免丟失；
削峰填谷：應對日志流量突發（如秒殺活動導致日志量驟增），Kafka 平滑流量到 Logstash。

二、ELK 日志流轉的完整原理

從 “原始日志” 到 “可查詢的可視化圖表”，ELK 需經過 4 個核心步驟，流程如下：
步驟 1：Filebeat 采集日志（前端采集）

部署位置：每臺需要收集日志的服務器（如應用服務器、數據庫服務器、Linux 主機）。
采集邏輯：
1. 配置 “日志路徑”（如 /var/log/nginx/access.log、/opt/app/logs/app.log）；
1. 實時監控日志文件變化（類似 tail -f），按行讀取新產生的日志；
1. 輕量級處理（如添加 “服務器 IP”“日志來源” 等元數據），避免占用過多服務器資源；
1. 將日志發送到下游（默認發送給 Logstash，也可直接發送給 Elasticsearch，適合簡單場景）。

關鍵優勢：輕量（內存占用通常 < 100MB）、穩定（崩潰后自動重啟）、支持多類型日志（文件日志、系統日志、容器日志等）。
步驟 2：Logstash 清洗日志（中間處理）

定位：通常部署在獨立的服務器（或高可用模式采用集群），作為 “日志加工中心”。
核心流程（三階段 Pipeline）：
1. Input（輸入）：接收 Filebeat 發送的日志（也支持接收 Kafka、Redis 等中間件的日志）；
1. Filter（過濾 / 加工）：ELK 最核心的 “結構化” 環節，
  格式轉換：將非結構化日志（如純文本）轉為 JSON 格式（方便 Elasticsearch 存儲和檢索）；
1. Output（輸出）：將加工后的結構化日志發送到 Elasticsearch（也可輸出到 Kafka、文件等）。

關鍵優勢：插件豐富（支持 200+ 插件，滿足各種日志處理需求）、靈活定制（通過配置文件定義加工規則）。

步驟 3：Elasticsearch 存儲與索引（后端存儲）

定位：分布式存儲與檢索引擎，通常部署為集群（至少 3 節點，保證高可用）。
核心邏輯：
1. 日志存儲：接收 Logstash 傳來的 JSON 格式日志，按 “索引（Index）” 組織數據（類似數據庫的 “表”）；
1. 索引策略：通常按時間分片（如每天創建一個索引 log-2024-09-01、log-2024-09-02），方便后續按時間查詢，也便于過期日志清理（如刪除 30 天前的索引）；

索引優化：Elasticsearch 會對日志字段建立 “倒排索引”（類似字典的 “拼音索引”），支持快速全文檢索（如輸入 “ERROR”，瞬間找到所有包含 “ERROR” 的日志）；
高可用保障：通過 “分片（Shard）” 和 “副本（Replica）” 實現：
分片：將一個索引拆分為多個分片（如 5 個主分片），分散存儲在不同節點，支持水平擴容；
副本：每個主分片創建 1+ 個副本（如 1 個副本），存儲在不同節點，主分片故障時副本自動接管，確保數據不丟、服務不中斷。
關鍵優勢：檢索速度快（毫秒級）、支持分布式（可擴展到數百節點）、高可用（副本 + 分片機制）。

步驟 4：Kibana 可視化查詢（前端展示）
功能：
●提供日志搜索界面
●創建儀表板和可視化
●設置告警規則
常用功能：
●Discover：搜索和查看日志
●Dashboard：創建監控儀表板
●Index Patterns：管理日志索引模式
●Logs：查看 Kubernetes 應用日志

三、通過ELK采集K8s集群中pod的日志并做可視化展示

step1：filebeat采集pod日志

●監控節點上的 /var/log/pods/ 目錄（默認集群中pod日志存儲位置）
●自動發現新的 Pod 并開始收集其日志
●添加 Kubernetes 元數據（如 Pod 名稱、命名空間、標簽等）
●將日志發送到 Logstash 進行進一步處理
配置要點：

vim filebeat-k8s.yml

#=======================k8s===========================
- type: logenabled: truefields:service: k8srole: podstopic: log-k8sfields_under_root: truepaths:- /var/log/pods/*/*/*.logtail_files: true

step2：Logstash 處理采集到的日志

典型處理流程：
1.接收來自 Filebeat 的日志
2.解析 JSON 格式的日志（如需要）
3.提取特定字段（如時間戳、日志級別等）
4.添加或刪除字段
5.根據條件過濾或路由日志
示例配置：
注：這里對從filebeat接收到的k8s的日志進行特殊處理

vim logstash.conf

input {beats {port => 9696 // 監聽9696端口，接收Filebeat發送的日志}
}
filter {// #### k8s 容器日志  ####if [topic] == "log-k8s" { // 僅處理 topic 字段為 "log-k8s" 的日志if [service] == "k8s" { //進一步篩選 service 字段為 "k8s" 的日志grok{        // 使用 grok 解析日志內容match => {"message" => [// # 模式1：提取時間戳、輸出類型、日志級別、進程ID、來源等"%{TIMESTAMP_ISO8601:date} %{WORD:output} %{WORD} %{NOTSPACE:level}%{NUMBER} %{NOTSPACE}%{SPACE}[T ]%{NUMBER:pid} %{NOTSPACE:source} %{GREEDYDATA:msg}",// # 模式2（簡化版）：僅提取時間戳和消息"%{TIMESTAMP_ISO8601:date} %{WORD:output} %{WORD} %{GREEDYDATA:msg}"]}}date {  // 將原始時間戳轉換為 @timestampmatch => ["date","ISO8601"] // 匹配 ISO8601 格式的時間target => [ "@timestamp" ] // 存儲到 Elasticsearch 的標準時間字段}}
}else {drop {} // # 丟棄所有不滿足 topic=="log-k8s" 的日志}if [log][offset] {mutate {add_field => {"offset" =>"%{[log][offset]}"}}}mutate {remove_field => ["@version", "event", "log", "message"] // # 刪除冗余字段}}output {
#  stdout {
#    codec => rubydebug
#  }elasticsearch {hosts => ["es1:9200", // # ES集群地址"es2:9200", "es3:9200" ]user => "elastic" // # 認證用戶名password => "6suq6twSe4Xk"  // # 認證密碼index => "%{topic}-%{+YYYY.MM.dd}" // # 按天創建索引（如 log-k8s-2023.10.30）}
}

功能說明：
●對 Kubernetes 容器日志進行結構化解析。
●提取關鍵字段（如時間戳、日志級別、進程ID等）。
●標準化時間字段。
Grok 模式說明：
●TIMESTAMP_ISO8601: 匹配 ISO8601 時間格式（如 2023-10-30T12:00:00.000Z）。
●WORD/NOTSPACE: 匹配單詞或非空格字符。
●GREEDYDATA: 捕獲剩余所有內容。
完整配置流程圖
在這里插入圖片描述

step3：Elasticsearch進行日志存儲以及檢索

功能：
●存儲所有日志數據
●提供強大的搜索和聚合能力
●管理索引生命周期
示例配置

vim elasticsearch.yml

#-----------------------Cluster-------------------
cluster.name: TDP  # 集群命名
cluster.max_shards_per_node: 10000
#-----------------------Node-------------------
node.name: 10.127.188.xxx
# -----------------------Paths-------------------
path.logs: /var/log/elasticsearch   # 日志路徑
path.data:- /data01/elasticsearch
action.auto_create_index: true#---------------Network----------------------
network.host: 10.127.188.xxx# Set a custom port for HTTP
http.port: 9200
transport.port: 9300network.host: 0.0.0.0
discovery.seed_hosts: ["node-1", "node-2"]  # ES節點列表
# --------- 內存和堆大小配置，為 Elasticsearch 設置合適的堆大小，以避免內存溢出-------------
bootstrap.memory_lock: true
ES_JAVA_OPTS: "-Xms512m -Xmx512m"

檢查集群狀態
使用 Kibana 或直接通過 Elasticsearch 的 REST API 檢查集群狀態：

curl -X GET "localhost:9200/_cat/nodes?v&pretty"

step4： Kibana (日志可視化和分析)界面構建

功能：
●提供日志搜索界面
●創建儀表板和可視化
●設置告警規則
常用功能：
●Discover：搜索和查看日志
●Dashboard：創建監控儀表板
●Index Patterns：管理日志索引模式
●Logs：查看 Kubernetes 應用日志
配置要點（kibana.yml）：

server.host: "0.0.0.0"  # 允許外部訪問
server.name: "k8s01" # 主機名
elasticsearch.hosts: ["http://es01:9200"]  # ES地址
monitoring.ui.container.elasticsearch.enabled: true  # 啟用容器監控
xpack.security.enabled: true  # 啟用安全功能（若ES開啟安全）
i18n.locale: "zh-CN"  # 中文界面（可選）

Dashboard可視化界面集成：
在這里插入圖片描述
登錄要導入的Kibana，點擊左下角齒輪圖標-管理->已保存對象->導入
會在右側彈出一個窗口。
這里采用ndjson形式導入收集的日志策略。

vim kibana.ndjson

{"attributes":{"buildNum":63337,"context:defaultSize":50,"context:step":50,"dateFormat":"YYYY-MM-DD HH:mm:ss.SSS","defaultIndex":null,"discover:rowHeightOption":-1,"discover:sampleRowsPerPage":500,"discover:sampleSize":5000,"fileUpload:maxFileSize":"1GB","isDefaultIndexMigrated":true,"timepicker:timeDefaults":"{\n  \"from\": \"now-24h/h\",\n  \"to\": \"now\"\n}"},"coreMigrationVersion":"8.8.0","created_at":"2023-09-23T16:24:07.183Z","id":"8.8.2","managed":false,"references":[],"type":"config","typeMigrationVersion":"8.7.0","updated_at":"2023-09-25T06:29:11.563Z","version":"WzI0ODgsMl0="}
{"attributes":{"fieldAttrs":"{\"msg\":{\"count\":2}}","fieldFormatMap":"{}","fields":"[]","name":"log-yarn-container-stderr","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"log-yarn-container-20*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2023-09-25T07:34:17.212Z","id":"d59f6539-5474-4681-8495-5836e17386b5","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2023-09-25T07:50:23.228Z","version":"WzI5MCwxXQ=="}
{"attributes":{"fieldAttrs":"{\"app_id\":{\"count\":1},\"cluster\":{\"count\":1},\"container_id\":{\"count\":1},\"hostname\":{\"count\":1},\"ip\":{\"count\":1},\"level\":{\"count\":1},\"msg\":{\"count\":1},\"role\":{\"count\":1},\"service\":{\"count\":1}}","fieldFormatMap":"{}","fields":"[]","name":"log-yarn-container-stdout","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"log-yarn-container-stdout-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2023-09-25T07:47:06.731Z","id":"6f398493-35aa-4c6a-ad98-108856826395","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2023-09-25T07:49:39.486Z","version":"WzI4NiwxXQ=="}
{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"log-yarn-container-flink","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"log-yarn-container-flink-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2023-09-25T07:46:46.699Z","id":"194f03ec-afa2-4a5d-9bfa-5649850f3e23","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2023-09-25T07:46:46.699Z","version":"WzI2OSwxXQ=="}
{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"log-yarn-container-mr","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"log-yarn-container-mr-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2023-09-25T07:33:39.635Z","id":"4dcb2fed-b1bb-41f1-b65c-c819d240c350","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2023-09-25T07:33:39.635Z","version":"WzI1NSwxXQ=="}
{"attributes":{"fieldAttrs":"{\"body_sent_bytes\":{\"count\":5}}","fieldFormatMap":"{}","fields":"[]","name":"log-nginx","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"log-nginx-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2023-09-25T06:21:49.684Z","id":"0965c927-4b2b-4839-baea-502f617d3e96","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2023-09-25T07:18:27.811Z","version":"WzIzOSwxXQ=="}
{"attributes":{"fieldAttrs":"{\"cluster\":{\"count\":2},\"date\":{\"count\":2},\"hostname\":{\"count\":1},\"ip\":{\"count\":1},\"level\":{\"count\":2},\"msg\":{\"count\":3},\"role\":{\"count\":1},\"service\":{\"count\":1},\"tag\":{\"count\":2}}","fieldFormatMap":"{}","fields":"[]","name":"log-app","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"log-app-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2023-09-25T06:21:08.513Z","id":"182d5cbb-a5a0-4951-a413-3206c270b2c7","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2023-09-25T06:31:19.823Z","version":"WzIxMywxXQ=="}
{"attributes":{"fieldAttrs":"{}","fieldFormatMap":"{}","fields":"[]","name":"log-k8s","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"log-k8s-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2023-09-25T12:09:54.496Z","id":"97946394-c6b0-4164-a29b-fb15261e22b3","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2023-09-25T12:09:54.496Z","version":"WzkyLDFd"}
{"attributes":{"fieldAttrs":"{\"fault\":{\"count\":2},\"ip\":{\"count\":1},\"msg\":{\"count\":1}}","fieldFormatMap":"{}","fields":"[]","name":"log-system","runtimeFieldMap":"{}","sourceFilters":"[]","timeFieldName":"@timestamp","title":"log-system-*","typeMeta":"{}"},"coreMigrationVersion":"8.8.0","created_at":"2023-09-25T11:35:19.484Z","id":"2412a190-e7db-412f-a469-97b9385e0401","managed":false,"references":[],"type":"index-pattern","typeMigrationVersion":"8.0.0","updated_at":"2023-09-25T11:35:19.484Z","version":"WzMxLDFd"}
{"attributes":{"controlGroupInput":{"chainingSystem":"HIERARCHICAL","controlStyle":"oneLine","ignoreParentSettingsJSON":"{\"ignoreFilters\":false,\"ignoreQuery\":false,\"ignoreTimerange\":false,\"ignoreValidations\":false}","panelsJSON":"{\"7545f1c0-94e5-4ca9-a768-263bfc8848bf\":{\"order\":0,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"cluster\",\"title\":\"cluster\",\"id\":\"7545f1c0-94e5-4ca9-a768-263bfc8848bf\",\"selectedOptions\":[],\"enhancements\":{}}},\"7af175da-1032-4588-91e0-010d9bcd324d\":{\"order\":1,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"ip\",\"title\":\"ip\",\"id\":\"7af175da-1032-4588-91e0-010d9bcd324d\",\"selectedOptions\":[],\"enhancements\":{}}},\"ef6cad3e-6daa-4f19-9e57-401aaabcb661\":{\"order\":2,\"width\":\"medium\",\"grow\":true,\"type\":\"optionsListControl\",\"explicitInput\":{\"fieldName\":\"hostname\",\"title\":\"hostname\",\"id\":\"ef6cad3e-6daa-4f19-9e57-401aaabcb661\",\"enhancements\":{}}}}"},"description":"","hits":0,"kibanaSavedObjectMeta":{"searchSourceJSON":"{\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filter\":[]}"},"optionsJSON":"{\"useMargins\":true,\"syncColors\":false,\"syncTooltips\":false,\"hidePanelTitles\":false}","panelsJSON":"[{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":0,\"w\":24,\"h\":8,\"i\":\"2dcfd041-f2bd-4c96-97ac-4917cfaff148\"},\"panelIndex\":\"2dcfd041-f2bd-4c96-97ac-4917cfaff148\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\",\"accessors\":[\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"splitAccessor\":\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and fault :\\\"機器重啟\\\" \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\":{\"columns\":{\"937a521b-ceef-40ff-8235-f823c7a70da9\":{\"label\":\"ip-date\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]},\"customLabel\":true},\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\":{\"label\":\"cluster 的排名前 30  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}},\"0c407e83-1275-4b75-aa0d-595ddb2ac560\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\",\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"hidePanelTitles\":false,\"type\":\"lens\"},\"title\":\"操作系統重啟\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":0,\"w\":24,\"h\":8,\"i\":\"f4c9ef04-4916-46da-948f-e24dc785975a\"},\"panelIndex\":\"f4c9ef04-4916-46da-948f-e24dc785975a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-168ae8ed-8a06-4642-9047-945a34274bfa\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"168ae8ed-8a06-4642-9047-945a34274bfa\",\"accessors\":[\"9fb9615b-104f-4351-91b2-9c2373a69d48\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"47d6dd4c-5e4b-44f2-9f2d-25306348ace7\",\"splitAccessor\":\"63c88414-31e3-4124-a5da-1ce843323d49\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and fault : \\\"硬盤壞道錯誤\\\"    \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"168ae8ed-8a06-4642-9047-945a34274bfa\":{\"columns\":{\"47d6dd4c-5e4b-44f2-9f2d-25306348ace7\":{\"label\":\"ip-device\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"9fb9615b-104f-4351-91b2-9c2373a69d48\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"multi_terms\"},\"secondaryFields\":[\"device\"]},\"customLabel\":true},\"9fb9615b-104f-4351-91b2-9c2373a69d48\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"63c88414-31e3-4124-a5da-1ce843323d49\":{\"label\":\"cluster 的排名前 30  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"9fb9615b-104f-4351-91b2-9c2373a69d48\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}}},\"columnOrder\":[\"47d6dd4c-5e4b-44f2-9f2d-25306348ace7\",\"63c88414-31e3-4124-a5da-1ce843323d49\",\"9fb9615b-104f-4351-91b2-9c2373a69d48\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"type\":\"lens\"},\"title\":\"硬盤壞道錯誤\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":8,\"w\":24,\"h\":8,\"i\":\"34528c93-0ed9-46fe-9a33-f9e17ddb6b1a\"},\"panelIndex\":\"34528c93-0ed9-46fe-9a33-f9e17ddb6b1a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\",\"accessors\":[\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"splitAccessor\":\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and fault : \\\"硬盤扇區錯誤\\\"   \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\":{\"columns\":{\"937a521b-ceef-40ff-8235-f823c7a70da9\":{\"label\":\"ip-device\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"multi_terms\"},\"secondaryFields\":[\"device\"],\"accuracyMode\":false},\"customLabel\":true},\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\":{\"label\":\"cluster 的排名前 30  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}},\"0c407e83-1275-4b75-aa0d-595ddb2ac560\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\",\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"hidePanelTitles\":false,\"type\":\"lens\"},\"title\":\"硬盤扇區錯誤\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":8,\"w\":24,\"h\":8,\"i\":\"b8f2b869-84af-43a1-82b4-34ed4cabde4a\"},\"panelIndex\":\"b8f2b869-84af-43a1-82b4-34ed4cabde4a\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\",\"accessors\":[\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"splitAccessor\":\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and fault : \\\"硬盤邏輯塊錯誤\\\"   \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\":{\"columns\":{\"937a521b-ceef-40ff-8235-f823c7a70da9\":{\"label\":\"ip-device\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"multi_terms\"},\"secondaryFields\":[\"device\"]},\"customLabel\":true},\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\":{\"label\":\"cluster 的排名前 30  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}},\"0c407e83-1275-4b75-aa0d-595ddb2ac560\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\",\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"hidePanelTitles\":false,\"type\":\"lens\"},\"title\":\"硬盤邏輯塊錯誤\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":16,\"w\":24,\"h\":8,\"i\":\"a8a8d212-2e68-4c1e-9242-58bf9c050ca9\"},\"panelIndex\":\"a8a8d212-2e68-4c1e-9242-58bf9c050ca9\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\",\"accessors\":[\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"splitAccessor\":\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and fault: \\\"硬盤EXT4-fs錯誤\\\"   \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\":{\"columns\":{\"937a521b-ceef-40ff-8235-f823c7a70da9\":{\"label\":\"ip-device\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"multi_terms\"},\"secondaryFields\":[\"device\"]},\"customLabel\":true},\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\":{\"label\":\"cluster 的排名前 30  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}},\"0c407e83-1275-4b75-aa0d-595ddb2ac560\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\",\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"hidePanelTitles\":false,\"type\":\"lens\"},\"title\":\"硬盤EXT4-fs錯誤\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":16,\"w\":24,\"h\":8,\"i\":\"b711b58e-4b03-40fc-a94f-f63db50a99ec\"},\"panelIndex\":\"b711b58e-4b03-40fc-a94f-f63db50a99ec\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-f06a1128-fbc8-4eb1-9d0c-2d42c8454207\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"f06a1128-fbc8-4eb1-9d0c-2d42c8454207\",\"accessors\":[\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"5ae4413f-6d4d-41ec-b6be-ececc27b70cf\",\"splitAccessor\":\"93946270-75b2-4027-b3b3-18c537317691\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and msg: \\\"Uncorrectable medium error\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f06a1128-fbc8-4eb1-9d0c-2d42c8454207\":{\"columns\":{\"5ae4413f-6d4d-41ec-b6be-ececc27b70cf\":{\"label\":\"ip\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"}},\"customLabel\":true},\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"93946270-75b2-4027-b3b3-18c537317691\":{\"label\":\"cluster 的排名前 100  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":100,\"orderBy\":{\"type\":\"column\",\"columnId\":\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}}},\"columnOrder\":[\"5ae4413f-6d4d-41ec-b6be-ececc27b70cf\",\"93946270-75b2-4027-b3b3-18c537317691\",\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"type\":\"lens\"},\"title\":\"不可恢復的扇區錯誤\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":24,\"w\":24,\"h\":8,\"i\":\"8760670f-db89-4b35-be5a-10f06650e109\"},\"panelIndex\":\"8760670f-db89-4b35-be5a-10f06650e109\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-f06a1128-fbc8-4eb1-9d0c-2d42c8454207\"},{\"type\":\"index-pattern\",\"name\":\"e56074f2-5094-4007-85ec-c6b90720dd41\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"f06a1128-fbc8-4eb1-9d0c-2d42c8454207\",\"accessors\":[\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"5ae4413f-6d4d-41ec-b6be-ececc27b70cf\",\"splitAccessor\":\"93946270-75b2-4027-b3b3-18c537317691\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and msg :\\\"hrtimer: interrupt took\\\" \",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"e56074f2-5094-4007-85ec-c6b90720dd41\",\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"msg\",\"params\":{\"query\":\"hrtimer: interrupt took\"}},\"query\":{\"match_phrase\":{\"msg\":\"hrtimer: interrupt took\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f06a1128-fbc8-4eb1-9d0c-2d42c8454207\":{\"columns\":{\"5ae4413f-6d4d-41ec-b6be-ececc27b70cf\":{\"label\":\"ip\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"}},\"customLabel\":true},\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"93946270-75b2-4027-b3b3-18c537317691\":{\"label\":\"cluster 的排名前 3  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}}},\"columnOrder\":[\"5ae4413f-6d4d-41ec-b6be-ececc27b70cf\",\"93946270-75b2-4027-b3b3-18c537317691\",\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"type\":\"lens\"},\"title\":\"hrtimer: interrupt took\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":24,\"w\":24,\"h\":8,\"i\":\"71ce72fa-734c-4bb5-81d6-c07abb674404\"},\"panelIndex\":\"71ce72fa-734c-4bb5-81d6-c07abb674404\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-034ce497-577a-4793-ab7f-03f172c8df4f\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"034ce497-577a-4793-ab7f-03f172c8df4f\",\"accessors\":[\"b9d7ac36-4f0b-407d-94f4-fbff08791c97\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"12073ac9-9e0f-46aa-8f27-02c4bdac2a66\",\"splitAccessor\":\"e1861f66-317f-427b-89ec-27b837d62dab\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and fault : \\\"內存錯誤\\\"  and msg : \\\"kernel: EDAC\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"034ce497-577a-4793-ab7f-03f172c8df4f\":{\"columns\":{\"12073ac9-9e0f-46aa-8f27-02c4bdac2a66\":{\"label\":\"ip\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"b9d7ac36-4f0b-407d-94f4-fbff08791c97\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"}},\"customLabel\":true},\"b9d7ac36-4f0b-407d-94f4-fbff08791c97\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"e1861f66-317f-427b-89ec-27b837d62dab\":{\"label\":\"cluster 的排名前 30  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"b9d7ac36-4f0b-407d-94f4-fbff08791c97\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"}}}},\"columnOrder\":[\"12073ac9-9e0f-46aa-8f27-02c4bdac2a66\",\"e1861f66-317f-427b-89ec-27b837d62dab\",\"b9d7ac36-4f0b-407d-94f4-fbff08791c97\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"type\":\"lens\"},\"title\":\"內存錯誤\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":32,\"w\":24,\"h\":8,\"i\":\"798f0711-044c-4b2c-be27-324bfb55d5bb\"},\"panelIndex\":\"798f0711-044c-4b2c-be27-324bfb55d5bb\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\",\"accessors\":[\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"splitAccessor\":\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and msg: \\\"Out of memory\\\"   \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\":{\"columns\":{\"937a521b-ceef-40ff-8235-f823c7a70da9\":{\"label\":\"ip\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"}},\"customLabel\":true},\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\":{\"label\":\"cluster 的排名前 30  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}},\"0c407e83-1275-4b75-aa0d-595ddb2ac560\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\",\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"hidePanelTitles\":false,\"type\":\"lens\"},\"title\":\"Out of memory\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":32,\"w\":24,\"h\":8,\"i\":\"831f6d98-2afd-4176-b868-12b4f8f647fe\"},\"panelIndex\":\"831f6d98-2afd-4176-b868-12b4f8f647fe\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-034ce497-577a-4793-ab7f-03f172c8df4f\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"034ce497-577a-4793-ab7f-03f172c8df4f\",\"accessors\":[\"b9d7ac36-4f0b-407d-94f4-fbff08791c97\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"12073ac9-9e0f-46aa-8f27-02c4bdac2a66\",\"splitAccessor\":\"e1861f66-317f-427b-89ec-27b837d62dab\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and fault: \\\"CPU內存\\\"\",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"034ce497-577a-4793-ab7f-03f172c8df4f\":{\"columns\":{\"12073ac9-9e0f-46aa-8f27-02c4bdac2a66\":{\"label\":\"ip\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":50,\"orderBy\":{\"type\":\"column\",\"columnId\":\"b9d7ac36-4f0b-407d-94f4-fbff08791c97\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"}},\"customLabel\":true},\"b9d7ac36-4f0b-407d-94f4-fbff08791c97\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"e1861f66-317f-427b-89ec-27b837d62dab\":{\"label\":\"cluster 的排名前 30  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"b9d7ac36-4f0b-407d-94f4-fbff08791c97\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"}}}},\"columnOrder\":[\"12073ac9-9e0f-46aa-8f27-02c4bdac2a66\",\"e1861f66-317f-427b-89ec-27b837d62dab\",\"b9d7ac36-4f0b-407d-94f4-fbff08791c97\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"type\":\"lens\"},\"title\":\"CPU APEI Generic Hardware Error\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":40,\"w\":24,\"h\":8,\"i\":\"bce91200-7b43-4647-8077-f0e5f78aa017\"},\"panelIndex\":\"bce91200-7b43-4647-8077-f0e5f78aa017\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\",\"accessors\":[\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"splitAccessor\":\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and fault : \\\"磁盤IO超時\\\"   \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\":{\"columns\":{\"937a521b-ceef-40ff-8235-f823c7a70da9\":{\"label\":\"ip\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"}},\"customLabel\":true},\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\":{\"label\":\"cluster 的排名前 30  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}},\"0c407e83-1275-4b75-aa0d-595ddb2ac560\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\",\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"hidePanelTitles\":false,\"type\":\"lens\"},\"title\":\"磁盤IO超時\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":40,\"w\":24,\"h\":8,\"i\":\"a4efd9ed-1933-410a-a124-3ffe07449785\"},\"panelIndex\":\"a4efd9ed-1933-410a-a124-3ffe07449785\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\",\"accessors\":[\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"splitAccessor\":\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and msg : \\\"Battery\\\"   \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\":{\"columns\":{\"937a521b-ceef-40ff-8235-f823c7a70da9\":{\"label\":\"ip\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"}},\"customLabel\":true},\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\":{\"label\":\"cluster 的排名前 30  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}},\"0c407e83-1275-4b75-aa0d-595ddb2ac560\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\",\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"hidePanelTitles\":false,\"type\":\"lens\"},\"title\":\"Raid卡電池故障\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":0,\"y\":48,\"w\":24,\"h\":8,\"i\":\"6722d07c-c866-4b42-897e-00ec35761014\"},\"panelIndex\":\"6722d07c-c866-4b42-897e-00ec35761014\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-f06a1128-fbc8-4eb1-9d0c-2d42c8454207\"},{\"type\":\"index-pattern\",\"name\":\"e0c611d4-4efa-40e4-bade-a76067c83741\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\",\"legendSize\":\"large\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"f06a1128-fbc8-4eb1-9d0c-2d42c8454207\",\"accessors\":[\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"5ae4413f-6d4d-41ec-b6be-ececc27b70cf\",\"splitAccessor\":\"93946270-75b2-4027-b3b3-18c537317691\"}]},\"query\":{\"query\":\"\",\"language\":\"kuery\"},\"filters\":[{\"meta\":{\"index\":\"e0c611d4-4efa-40e4-bade-a76067c83741\",\"alias\":null,\"negate\":false,\"disabled\":false,\"type\":\"phrase\",\"key\":\"msg\",\"params\":{\"query\":\"Slot Number\"}},\"query\":{\"match_phrase\":{\"msg\":\"Slot Number\"}},\"$state\":{\"store\":\"appState\"}}],\"datasourceStates\":{\"formBased\":{\"layers\":{\"f06a1128-fbc8-4eb1-9d0c-2d42c8454207\":{\"columns\":{\"5ae4413f-6d4d-41ec-b6be-ececc27b70cf\":{\"label\":\"ip\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"}},\"customLabel\":true},\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}},\"93946270-75b2-4027-b3b3-18c537317691\":{\"label\":\"cluster 的排名前 3  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":3,\"orderBy\":{\"type\":\"column\",\"columnId\":\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}}},\"columnOrder\":[\"5ae4413f-6d4d-41ec-b6be-ececc27b70cf\",\"93946270-75b2-4027-b3b3-18c537317691\",\"67a40b4a-57c4-46c5-825c-ecbb7b68367b\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"hidePanelTitles\":false,\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"type\":\"lens\"},\"title\":\"RAID卡掉盤\"},{\"version\":\"8.7.0\",\"type\":\"lens\",\"gridData\":{\"x\":24,\"y\":48,\"w\":24,\"h\":8,\"i\":\"e3aabfdf-0dad-42b8-b527-bb82c975a1a1\"},\"panelIndex\":\"e3aabfdf-0dad-42b8-b527-bb82c975a1a1\",\"embeddableConfig\":{\"attributes\":{\"title\":\"\",\"visualizationType\":\"lnsXY\",\"type\":\"lens\",\"references\":[{\"type\":\"index-pattern\",\"id\":\"bdf46ced-2337-4c36-a933-e71960839878\",\"name\":\"indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894\"}],\"state\":{\"visualization\":{\"title\":\"Empty XY chart\",\"legend\":{\"isVisible\":true,\"position\":\"right\"},\"valueLabels\":\"hide\",\"preferredSeriesType\":\"bar_stacked\",\"layers\":[{\"layerId\":\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\",\"accessors\":[\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"position\":\"top\",\"seriesType\":\"bar_stacked\",\"showGridlines\":false,\"layerType\":\"data\",\"xAccessor\":\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"splitAccessor\":\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\"}]},\"query\":{\"query\":\"role : \\\"dmesg\\\" and fault : \\\"CPU軟鎖死\\\"   \",\"language\":\"kuery\"},\"filters\":[],\"datasourceStates\":{\"formBased\":{\"layers\":{\"439ddaf7-554c-49a3-b3d4-370ddb4ae894\":{\"columns\":{\"937a521b-ceef-40ff-8235-f823c7a70da9\":{\"label\":\"ip\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"ip\",\"isBucketed\":true,\"params\":{\"size\":500,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"}},\"customLabel\":true},\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\":{\"label\":\"cluster 的排名前 30  的值\",\"dataType\":\"string\",\"operationType\":\"terms\",\"scale\":\"ordinal\",\"sourceField\":\"cluster\",\"isBucketed\":true,\"params\":{\"size\":30,\"orderBy\":{\"type\":\"column\",\"columnId\":\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"},\"orderDirection\":\"desc\",\"otherBucket\":true,\"missingBucket\":false,\"parentFormat\":{\"id\":\"terms\"},\"secondaryFields\":[]}},\"0c407e83-1275-4b75-aa0d-595ddb2ac560\":{\"label\":\"記錄計數\",\"customLabel\":false,\"dataType\":\"number\",\"operationType\":\"count\",\"isBucketed\":false,\"scale\":\"ratio\",\"sourceField\":\"___records___\",\"params\":{\"emptyAsNull\":true}}},\"columnOrder\":[\"937a521b-ceef-40ff-8235-f823c7a70da9\",\"1faa0897-99a0-4bc9-abb6-5c8796f028e9\",\"0c407e83-1275-4b75-aa0d-595ddb2ac560\"],\"incompleteColumns\":{}}}}},\"internalReferences\":[],\"adHocDataViews\":{}}},\"enhancements\":{\"dynamicActions\":{\"events\":[]}},\"hidePanelTitles\":false,\"type\":\"lens\"},\"title\":\"CPU軟鎖死\"}]","timeRestore":false,"title":"硬件故障","version":1},"coreMigrationVersion":"8.8.0","created_at":"2023-09-25T11:35:19.484Z","id":"ab847810-8fc8-11ed-9d0b-8153e2bf35fc","managed":false,"references":[{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"2dcfd041-f2bd-4c96-97ac-4917cfaff148:indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"f4c9ef04-4916-46da-948f-e24dc785975a:indexpattern-datasource-layer-168ae8ed-8a06-4642-9047-945a34274bfa","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"34528c93-0ed9-46fe-9a33-f9e17ddb6b1a:indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"b8f2b869-84af-43a1-82b4-34ed4cabde4a:indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"a8a8d212-2e68-4c1e-9242-58bf9c050ca9:indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"b711b58e-4b03-40fc-a94f-f63db50a99ec:indexpattern-datasource-layer-f06a1128-fbc8-4eb1-9d0c-2d42c8454207","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"8760670f-db89-4b35-be5a-10f06650e109:indexpattern-datasource-layer-f06a1128-fbc8-4eb1-9d0c-2d42c8454207","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"8760670f-db89-4b35-be5a-10f06650e109:e56074f2-5094-4007-85ec-c6b90720dd41","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"71ce72fa-734c-4bb5-81d6-c07abb674404:indexpattern-datasource-layer-034ce497-577a-4793-ab7f-03f172c8df4f","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"798f0711-044c-4b2c-be27-324bfb55d5bb:indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"831f6d98-2afd-4176-b868-12b4f8f647fe:indexpattern-datasource-layer-034ce497-577a-4793-ab7f-03f172c8df4f","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"bce91200-7b43-4647-8077-f0e5f78aa017:indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"a4efd9ed-1933-410a-a124-3ffe07449785:indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"6722d07c-c866-4b42-897e-00ec35761014:indexpattern-datasource-layer-f06a1128-fbc8-4eb1-9d0c-2d42c8454207","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"6722d07c-c866-4b42-897e-00ec35761014:e0c611d4-4efa-40e4-bade-a76067c83741","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"e3aabfdf-0dad-42b8-b527-bb82c975a1a1:indexpattern-datasource-layer-439ddaf7-554c-49a3-b3d4-370ddb4ae894","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"controlGroup_7545f1c0-94e5-4ca9-a768-263bfc8848bf:optionsListDataView","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"controlGroup_7af175da-1032-4588-91e0-010d9bcd324d:optionsListDataView","type":"index-pattern"},{"id":"2412a190-e7db-412f-a469-97b9385e0401","name":"controlGroup_ef6cad3e-6daa-4f19-9e57-401aaabcb661:optionsListDataView","type":"index-pattern"}],"type":"dashboard","typeMigrationVersion":"8.7.0","updated_at":"2023-09-25T11:35:19.484Z","version":"WzM4LDFd"}

把剛才導出的配置文件kibana.ndjson 拖到紅框處進行上傳。
在這里插入圖片描述
也可以點擊導入自己根據查找具體路徑來選擇目標文件。

等待文件上傳完畢，點擊導入按鈕,等待導入完畢。

導入成功

然后刷新頁面，即可看到采集的k8s的日志信息已經檢索出來了。