ASSIGNMENT: ELK - Kibana Query Language (KQL)

It is on the basis of Apache Log data ( https://logz.io/sample-data ).

Run below queries on different time interval (today, last 15 mins...) and check the count of Hits and also check the visualization in form of bar chart.

1. Find all the records for US users (geoip.country_code2 and geoip.country_code3)
2. Find all the records for users other than US users  (geoip.country_code2 and geoip.country_code3)
3. Find all the records for users in CountryCode3( geoip.country_code3) is either US or IN
4. Find all the records for verb GET.
5. Find all the records with the request is /category/software and response is 200 for today.
6. Find all the records where message contains Mozilla
7. Find all the records where verb is not GET
8. Find all the records where verb is either GET or POST
9. Find all the records where clientip is 184.153.198.34 and geoip.cityname Watertown.
10. Find records with geoip.country_code is US and time zone is America/New_York

Answers:

1.  geoip.country_code2:"US" and geoip.country_code3:"US"
last 15minutes: 106 hits
today: 6,272 hits
last 30 days: 1,759 hits

2. not geoip.country_code2:"US" and not geoip.country_code3:"US"
last 15minutes: 77 hits
today: 5,245 hits
last 30 days: 1,457 hits

3. geoip.country_code3:"US" or geoip.country_code3:"IN"

last 15minutes: 100 hits
today: 6,328 hits
last 30 days: 1,827 hits

4. verb:"GET"

last 15minutes: 162 hits
today: 10,747 hits
last 30 days: 3,074 hits

5. request:"/category/software" and response:200

last 15minutes: 24 hits
today: 1064 hits
last 30 days: 326 hits

6. message:"mozilla"

last 15minutes: 180 hits
today: 720 hits
last 30 days: 3393 hits

7. not verb:"GET"

last 15minutes: 17 hits
today: 770 hits
last 30 days: 237 hits

8. verb:"GET" or verb:"POST"

last 15minutes: 180 hits
today: 11,517 hits
last 30 days: 3426 hits

9. clientip:184.153.198.34 and geoip.city_name:"Watertown"

last 15minutes: 0 hits
today: 12 hits
last 30 days: 2 hits

10. (geoip.country_code2:"US" or geoip.country_code3:"US")  and  geoip.timezone:"America/New_York"

last 15minutes: 9 hits
today: 639 hits
last 30 days: 196 hits