2016-10-25 03:41:32 +02:00
|
|
|
|
[[index-patterns]]
|
2020-06-10 16:20:55 +02:00
|
|
|
|
== Create an index pattern
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-01-07 19:43:40 +01:00
|
|
|
|
To explore and visualize data in {kib}, you must create an index pattern.
|
|
|
|
|
An index pattern tells {kib} which {es} indices contain the data that
|
|
|
|
|
you want to work with.
|
|
|
|
|
Once you create an index pattern, you're ready to:
|
|
|
|
|
|
|
|
|
|
* Interactively explore your data in <<discover, Discover>>.
|
2020-09-03 23:34:25 +02:00
|
|
|
|
* Analyze your data in charts, tables, gauges, tag clouds, and more in <<dashboard, Dashboard>>.
|
2020-01-07 19:43:40 +01:00
|
|
|
|
* Show off your data in a <<canvas, Canvas>> workpad.
|
|
|
|
|
* If your data includes geo data, visualize it with <<maps, Maps>>.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-06 17:08:18 +02:00
|
|
|
|
[float]
|
|
|
|
|
[[index-patterns-read-only-access]]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
=== [xpack]#Read-only access#
|
2020-01-07 19:43:40 +01:00
|
|
|
|
If you have insufficient privileges to create or save index patterns, a read-only
|
2019-06-26 16:14:48 +02:00
|
|
|
|
indicator appears in Kibana. The buttons to create new index patterns or save
|
2020-01-07 19:43:40 +01:00
|
|
|
|
existing index patterns are not visible. For more information, see <<xpack-security-authorization>>.
|
2019-06-06 17:08:18 +02:00
|
|
|
|
|
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image::images/management-index-read-only-badge.png[Example of Index Pattern Management's read only access indicator in Kibana's header]
|
|
|
|
|
|
2016-10-25 03:41:32 +02:00
|
|
|
|
[float]
|
|
|
|
|
[[settings-create-pattern]]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
=== Create an index pattern
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-06-12 16:39:36 +02:00
|
|
|
|
When you don't have an index pattern, {kib} prompts you to create one. Or, you can open the menu,
|
|
|
|
|
then go to *Stack Management > {kib} > Index Patterns* to go directly to the *Index Patterns* UI.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image:management/index-patterns/images/rollup-index-pattern.png["Menu with rollup index pattern"]
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
[float]
|
|
|
|
|
==== Standard index pattern
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-01-07 19:43:40 +01:00
|
|
|
|
Just start typing in the *Index pattern* field, and {kib} looks for
|
|
|
|
|
the names of {es} indices that match your input. Make sure that the name of the
|
2019-10-03 22:36:59 +02:00
|
|
|
|
index pattern is unique.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image:management/index-patterns/images/create-index-pattern.png["Create index pattern"]
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-01-07 19:43:40 +01:00
|
|
|
|
Your index pattern can match multiple {es} indices.
|
|
|
|
|
Use a comma to separate the names, with no space after the comma. The notation for
|
|
|
|
|
wildcards (`*`) and the ability to "exclude" (`-`) also apply
|
2019-06-26 16:14:48 +02:00
|
|
|
|
(for example, `test*,-test3`).
|
|
|
|
|
|
2020-01-07 19:43:40 +01:00
|
|
|
|
If {kib} detects an index with a timestamp, you’re asked to choose a field to
|
|
|
|
|
filter your data by time. If you don’t specify a field, you won’t be able
|
2019-06-26 16:14:48 +02:00
|
|
|
|
to use the time filter.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
|
|
|
|
[float]
|
2020-03-10 22:37:17 +01:00
|
|
|
|
[[rollup-index-pattern]]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
==== Rollup index pattern
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-01-07 19:43:40 +01:00
|
|
|
|
If a rollup index is detected in the cluster, clicking *Create index pattern*
|
|
|
|
|
includes an item for creating a rollup index pattern.
|
|
|
|
|
You can match an index pattern to only rolled up data, or mix both rolled
|
|
|
|
|
up and raw data to explore and visualize all data together.
|
|
|
|
|
An index pattern can match
|
2020-03-10 22:37:17 +01:00
|
|
|
|
only one rollup index. When matching multiple indices,
|
|
|
|
|
use a comma to separate the names, with no space after the comma.
|
|
|
|
|
|
|
|
|
|
For specific fields, the data in a rollup index includes only summarized metrics.
|
|
|
|
|
From the original raw data, you are unable to search any other field.
|
2020-01-07 19:43:40 +01:00
|
|
|
|
|
|
|
|
|
[float]
|
|
|
|
|
[[management-cross-cluster-search]]
|
|
|
|
|
==== {ccs-cap} index pattern
|
|
|
|
|
|
|
|
|
|
If your {es} clusters are configured for {ref}/modules-cross-cluster-search.html[{ccs}], you can create
|
|
|
|
|
index patterns to search across the clusters of your choosing. Using the
|
|
|
|
|
same syntax that you'd use in a raw {ccs} request in {es}, create your
|
|
|
|
|
index pattern with the convention `<cluster-names>:<pattern>`.
|
|
|
|
|
|
|
|
|
|
For example, to query {ls} indices across two {es} clusters
|
|
|
|
|
that you set up for {ccs}, which are named `cluster_one` and `cluster_two`,
|
|
|
|
|
you would use `cluster_one:logstash-*,cluster_two:logstash-*` as your index pattern.
|
|
|
|
|
|
|
|
|
|
You can use wildcards in your cluster names
|
|
|
|
|
to match any number of clusters, so if you want to search {ls} indices across
|
|
|
|
|
clusters named `cluster_foo`, `cluster_bar`, and so on, you would use `cluster_*:logstash-*`
|
|
|
|
|
as your index pattern.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-01-07 19:43:40 +01:00
|
|
|
|
To query across all {es} clusters that have been configured for {ccs},
|
|
|
|
|
use a standalone wildcard for your cluster name in your index
|
|
|
|
|
pattern: `*:logstash-*`.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-01-07 19:43:40 +01:00
|
|
|
|
Once an index pattern is configured using the {ccs} syntax, all searches and
|
|
|
|
|
aggregations using that index pattern in {kib} take advantage of {ccs}.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2020-02-06 18:16:32 +01:00
|
|
|
|
|
2016-10-25 03:41:32 +02:00
|
|
|
|
[float]
|
2020-02-06 18:16:32 +01:00
|
|
|
|
[[reload-fields]]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
=== Manage your index pattern
|
2018-05-14 16:38:16 +02:00
|
|
|
|
|
2020-02-06 18:16:32 +01:00
|
|
|
|
To drill down into the fields and associated data types in an index pattern,
|
|
|
|
|
click its name in the *Index patterns* overview page.
|
|
|
|
|
For more information, refer to <<managing-fields, Index Patterns and Fields>>.
|