User Guide
ELMA is a logging and syslog framework complemented by a range of free
and open-source tools that can help you aggregate and deliver metrics,
analytics and vital performance data.
Log normalization and a web-based query interface makes searching
billions of log events for arbitrary strings as easy as searching the
web.
Supported web browsers
ELMA user and admin interfaces should work in all modern web browsers as
long as they support SVG:
- Tested with Firefox > 19.x.
- IE8 & IE9 don’t work correctly!
ELMA user interfaces
Depending on integration into your corporate infrastructure you have to
login with single sign on user credentials provided by your operation or
administration team.
Kibana
Point your browser at your local webserver, the one with ELMA and Kibana
already installed. Kibana will auto connect to existing ElasticSearch
cluster.

Kibana a user friendly way to view, search and visualize your log data.
Click on an event to expand a details pane with all of your fields laid out nicely.
Kibana query syntax
Terms
A query is broken up into terms and operators. There are two types of terms: Single Terms and Phrases.
A Single Term is a single word such as “test” or “hello”.
A Phrase is a group of words surrounded by double quotes such as “hello dolly”.
Wildcard Searches
To perform a single character wildcard search use the “?” symbol.
To perform a multiple character wildcard search use the “*” symbol.
Boolean operators
Boolean operators allow terms to be combined through logic operators to form a more complex query.
AND, “+”, OR, NOT and “-” are supported.
“-” excludes documents that contain the term after.
“+” requires that the term after exist somewhere in a the field of a single document.
Grouping
Round brackets let us group terms, double quotes group terms into whole phrases.
Some useful query examples:
4.3.2.1 AND 1.2.3.4
4.3.2.1 AND NOT 1.2.3.4
(4.3.2.1 AND 443) OR (1.2.3.4 AND 80) AND "Deny tcp"
@source_host:"s2811.nms.bdc-services.net"
@source_host:m* OR @source_host:s*
1.1.1.*
1.1.1.??
*kibana.org*
Important:
- Boolean operators such as AND and/or OR must be ALL CAPITALIZED.
- Not use a ``*`` or ``?`` symbol as the first character of a search.
- Special characters ``+ - && || ! ( ) { } [ ] ^ ” ~ * ? : `` has to be escaped by \ using the \.
Learn lots more about Lucene query
syntax
at the Apache Lucene and Kibana
documentation.