Recipes for ELK

Memcached Recipes

Metric Recipe Notes
Hit rate Script Field: HIT Rate 
doc['get_hits'].value/
((doc['get_hits'].value+
doc['get_misses'].value)>0?(doc['get_hits'].value
+doc['get_misses'].value):1)

Define an alter for a condition where Hit rate > 0

Example: 
tag:tmgc-cache.metrics.stat.memcached.11214 and memcached_hit_rate > 0

ELK Tuning

If an index has more than 1000 separate fields, then Elasticsearch doesn't accept the new messages. This is due to default setting on the index at Elasticsearch side. Increase the number of fields for metrics_index in order to get all the logs in ELK stack. 
curl -XPUT '{ElasticSearch_hostname}:9200/{metrics_index}/_settings' -H 'Content-Type: application/json' -d'
{
"index" : {
"mapping" : {
"total_fields" : {
"limit" : "10000"
}
}
}
}'