2016-10-25 03:41:32 +02:00
|
|
|
|
[[index-patterns]]
|
2021-04-21 20:02:00 +02:00
|
|
|
|
=== Create an index pattern
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-11-03 19:17:55 +01:00
|
|
|
|
{kib} requires an index pattern to access the {es} data that you want to explore.
|
|
|
|
|
An index pattern selects the data to use and allows you to define properties of the fields.
|
2020-01-07 19:43:40 +01:00
|
|
|
|
|
2021-08-23 23:31:36 +02:00
|
|
|
|
An index pattern can point to one or more indices, {ref}/data-streams.html[data stream], or {ref}/alias.html[index aliases].
|
|
|
|
|
For example, an index pattern can point to your log data from yesterday,
|
|
|
|
|
or all indices that contain your data.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-06 17:08:18 +02:00
|
|
|
|
[float]
|
|
|
|
|
[[index-patterns-read-only-access]]
|
2021-08-23 23:31:36 +02:00
|
|
|
|
=== Required permissions
|
|
|
|
|
|
|
|
|
|
* Access to *Index Patterns* requires the <<xpack-kibana-role-management, {kib} privilege>>
|
|
|
|
|
`Index Pattern Management`.
|
2019-06-06 17:08:18 +02:00
|
|
|
|
|
2021-08-23 23:31:36 +02:00
|
|
|
|
* To create an index pattern, you must have the <<xpack-kibana-role-management,{es} privilege>>
|
|
|
|
|
`view_index_metadata`.
|
2020-11-03 19:17:55 +01:00
|
|
|
|
|
|
|
|
|
* If a read-only indicator appears in {kib}, you have insufficient privileges
|
|
|
|
|
to create or save index patterns. The buttons to create new index patterns or
|
|
|
|
|
save existing index patterns are not visible. For more information,
|
|
|
|
|
refer to <<xpack-security-authorization,Granting access to {kib}>>.
|
2019-06-06 17:08:18 +02:00
|
|
|
|
|
2016-10-25 03:41:32 +02:00
|
|
|
|
[float]
|
|
|
|
|
[[settings-create-pattern]]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
=== Create an index pattern
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2021-08-23 23:31:36 +02:00
|
|
|
|
If you collected data using one of the {kib} <<connect-to-elasticsearch,ingest options>>,
|
|
|
|
|
uploaded a file, or added sample data,
|
2020-11-03 19:17:55 +01:00
|
|
|
|
you get an index pattern for free, and can start exploring your data.
|
|
|
|
|
If you loaded your own data, follow these steps to create an index pattern.
|
|
|
|
|
|
|
|
|
|
. Open the main menu, then click to *Stack Management > Index Patterns*.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-11-03 19:17:55 +01:00
|
|
|
|
. Click *Create index pattern*.
|
|
|
|
|
+
|
2019-06-26 16:14:48 +02:00
|
|
|
|
[role="screenshot"]
|
2020-11-03 19:17:55 +01:00
|
|
|
|
image:management/index-patterns/images/create-index-pattern.png["Create index pattern"]
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-11-03 19:17:55 +01:00
|
|
|
|
. Start typing in the *Index pattern* field, and {kib} looks for the names of
|
2021-08-23 23:31:36 +02:00
|
|
|
|
indices, data streams, and aliases that match your input.
|
|
|
|
|
+
|
|
|
|
|
** To match multiple sources, use a wildcard (*). For example, `filebeat-*` matches
|
|
|
|
|
`filebeat-apache-a`, `filebeat-apache-b`, and so on.
|
|
|
|
|
+
|
|
|
|
|
** To match multiple single sources, enter their names,
|
|
|
|
|
separated with a comma. Do not include a space after the comma.
|
|
|
|
|
`filebeat-a,filebeat-b` matches two indices, but not match `filebeat-c`.
|
|
|
|
|
+
|
|
|
|
|
** To exclude a source, use a minus sign (-), for example, `-test3`.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2021-08-23 23:31:36 +02:00
|
|
|
|
. If {kib} detects an index with a timestamp, expand the *Timestamp field* menu,
|
|
|
|
|
and then select the default field for filtering your data by time.
|
2020-11-03 19:17:55 +01:00
|
|
|
|
+
|
2021-08-23 23:31:36 +02:00
|
|
|
|
** If your index doesn’t have time-based data, choose *I don’t want to use the time filter*.
|
2020-11-03 19:17:55 +01:00
|
|
|
|
+
|
2021-08-23 23:31:36 +02:00
|
|
|
|
** If you don’t set a default time field, you can't use
|
2020-11-03 19:17:55 +01:00
|
|
|
|
global time filters on your dashboards. This is useful if
|
|
|
|
|
you have multiple time fields and want to create dashboards that combine visualizations
|
|
|
|
|
based on different timestamps.
|
2019-06-26 16:14:48 +02:00
|
|
|
|
|
2020-11-03 19:17:55 +01:00
|
|
|
|
. Click *Create index pattern*.
|
|
|
|
|
+
|
2021-08-23 23:31:36 +02:00
|
|
|
|
[[reload-fields]] {kib} is now configured to use your {es} data. When a new field is added to an index,
|
|
|
|
|
the index pattern field list is updated
|
|
|
|
|
the next time the index pattern is loaded, for example, when you load the page or
|
|
|
|
|
move between {kib} apps.
|
2020-11-03 19:17:55 +01:00
|
|
|
|
|
|
|
|
|
. Select this index pattern when you search and visualize your data.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
|
|
|
|
[float]
|
2020-03-10 22:37:17 +01:00
|
|
|
|
[[rollup-index-pattern]]
|
2020-11-03 19:17:55 +01:00
|
|
|
|
==== Create an index pattern for rolled up data
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-11-03 19:17:55 +01:00
|
|
|
|
An index pattern can match one rollup index. For a combination rollup
|
|
|
|
|
index pattern with both raw and rolled up data, use the standard notation:
|
2020-03-10 22:37:17 +01:00
|
|
|
|
|
2020-11-03 19:17:55 +01:00
|
|
|
|
```ts
|
|
|
|
|
rollup_logstash,kibana_sample_data_logs
|
|
|
|
|
```
|
|
|
|
|
For an example, refer to <<rollup-data-tutorial,Create and visualize rolled up data>>.
|
2020-01-07 19:43:40 +01:00
|
|
|
|
|
|
|
|
|
[float]
|
|
|
|
|
[[management-cross-cluster-search]]
|
2020-11-03 19:17:55 +01:00
|
|
|
|
==== Create an index pattern that searches across clusters
|
|
|
|
|
|
|
|
|
|
If your {es} clusters are configured for {ref}/modules-cross-cluster-search.html[{ccs}],
|
|
|
|
|
you can create an index pattern to search across the clusters of your choosing. Use the
|
2021-08-23 23:31:36 +02:00
|
|
|
|
same syntax that you use in a raw {ccs} request in {es}:
|
2020-01-07 19:43:40 +01:00
|
|
|
|
|
2020-11-03 19:17:55 +01:00
|
|
|
|
```ts
|
|
|
|
|
<cluster-names>:<pattern>
|
|
|
|
|
```
|
2020-01-07 19:43:40 +01:00
|
|
|
|
|
2021-08-23 23:31:36 +02:00
|
|
|
|
To query {ls} indices across two {es} clusters
|
|
|
|
|
that you set up for {ccs}, named `cluster_one` and `cluster_two`:
|
2020-11-03 19:17:55 +01:00
|
|
|
|
|
|
|
|
|
```ts
|
|
|
|
|
cluster_one:logstash-*,cluster_two:logstash-*
|
|
|
|
|
```
|
2020-01-07 19:43:40 +01:00
|
|
|
|
|
2021-08-23 23:31:36 +02:00
|
|
|
|
Use wildcards in your cluster names
|
|
|
|
|
to match any number of clusters. To search {ls} indices across
|
|
|
|
|
clusters named `cluster_foo`, `cluster_bar`, and so on:
|
2020-11-03 19:17:55 +01:00
|
|
|
|
|
|
|
|
|
```ts
|
|
|
|
|
cluster_*:logstash-*
|
|
|
|
|
```
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-01-07 19:43:40 +01:00
|
|
|
|
To query across all {es} clusters that have been configured for {ccs},
|
2021-08-23 23:31:36 +02:00
|
|
|
|
use a standalone wildcard for your cluster name:
|
2020-11-03 19:17:55 +01:00
|
|
|
|
|
|
|
|
|
```ts
|
|
|
|
|
*:logstash-*
|
|
|
|
|
```
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2021-08-23 23:31:36 +02:00
|
|
|
|
To match indices starting with `logstash-`, but exclude those starting with `logstash-old`, from
|
|
|
|
|
all clusters having a name starting with `cluster_`:
|
2021-04-12 19:14:03 +02:00
|
|
|
|
|
2021-08-23 23:31:36 +02:00
|
|
|
|
```ts
|
|
|
|
|
`cluster_*:logstash-*,cluster_*:-logstash-old*`
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
To exclude a cluster having a name starting with `cluster_`:
|
|
|
|
|
|
|
|
|
|
```ts
|
|
|
|
|
`cluster_*:logstash-*,cluster_one:-*`
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
Once you configure an index pattern to use the {ccs} syntax, all searches and
|
2020-01-07 19:43:40 +01:00
|
|
|
|
aggregations using that index pattern in {kib} take advantage of {ccs}.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-11-03 19:17:55 +01:00
|
|
|
|
[float]
|
2021-05-12 22:48:13 +02:00
|
|
|
|
[[delete-index-pattern]]
|
|
|
|
|
=== Delete index patterns
|
2020-11-03 19:17:55 +01:00
|
|
|
|
|
2021-08-23 23:31:36 +02:00
|
|
|
|
When you delete an index pattern, you cannot recover the associated field formatters, runtime fields, source filters,
|
2021-05-12 22:48:13 +02:00
|
|
|
|
and field popularity data. Deleting an index pattern does not remove any indices or data documents from {es}.
|
2020-11-03 19:17:55 +01:00
|
|
|
|
|
2021-05-12 22:48:13 +02:00
|
|
|
|
WARNING: Deleting an index pattern breaks all visualizations, saved searches, and other saved objects that reference the index pattern.
|
2020-11-03 19:17:55 +01:00
|
|
|
|
|
2021-05-12 22:48:13 +02:00
|
|
|
|
. Open the main menu, then click *Stack Management > Index Patterns*.
|
2020-11-03 19:17:55 +01:00
|
|
|
|
|
2021-08-23 23:31:36 +02:00
|
|
|
|
. Click the index pattern to delete.
|
2020-11-03 19:17:55 +01:00
|
|
|
|
|
2021-05-12 22:48:13 +02:00
|
|
|
|
. Delete (image:management/index-patterns/images/delete.png[Delete icon]) the index pattern.
|