2016-10-25 03:41:32 +02:00
|
|
|
|
[[index-patterns]]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
== Index patterns
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
To visualize and explore data in {kib}, you must create an index pattern.
|
|
|
|
|
An index pattern tells {kib} which {es} indices contain the data that you want to work with.
|
|
|
|
|
An index pattern can match a single index, multiple indices, and a rollup index.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-06 17:08:18 +02:00
|
|
|
|
[float]
|
|
|
|
|
[[index-patterns-read-only-access]]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
=== [xpack]#Read-only access#
|
|
|
|
|
If you have insufficient privileges to create or save index patterns, a read-only
|
|
|
|
|
indicator appears in Kibana. The buttons to create new index patterns or save
|
|
|
|
|
existing index patterns are not visible. For more information on granting access to
|
2019-06-06 17:08:18 +02:00
|
|
|
|
Kibana see <<xpack-security-authorization>>.
|
|
|
|
|
|
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image::images/management-index-read-only-badge.png[Example of Index Pattern Management's read only access indicator in Kibana's header]
|
|
|
|
|
|
2016-10-25 03:41:32 +02:00
|
|
|
|
[float]
|
|
|
|
|
[[settings-create-pattern]]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
=== Create an index pattern
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
To get started, go to *Management > Kibana > Index Patterns*. You begin with
|
|
|
|
|
an overview of your index patterns, including any that were added when you
|
|
|
|
|
downloaded sample data sets.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
You can create a standard index pattern, and if a rollup index is detected in the
|
|
|
|
|
cluster, a rollup index pattern.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image:management/index-patterns/images/rollup-index-pattern.png["Menu with rollup index pattern"]
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
[float]
|
|
|
|
|
==== Standard index pattern
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
{kib} makes it easy for you to create an index pattern by walking you through
|
|
|
|
|
the process. Just start typing in the *Index pattern* field, and {kib} looks for
|
|
|
|
|
the names of {es} indices that match your input. If you want to include
|
|
|
|
|
system indices in your search, toggle the switch in the upper right.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image:management/index-patterns/images/create-index-pattern.png["Create index pattern"]
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
Your index pattern can match multiple {es} indices.
|
|
|
|
|
Use a comma to separate the names, with no space after the comma. The notation for
|
|
|
|
|
wildcards (`*`) and the ability to "exclude" (`-`) also apply
|
|
|
|
|
(for example, `test*,-test3`).
|
|
|
|
|
|
|
|
|
|
When {kib} detects an index with a timestamp, you’re asked to choose a field to
|
|
|
|
|
filter your data by time. If you don’t specify a field, you won’t be able
|
|
|
|
|
to use the time filter.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
Once you’ve created your index pattern, you can start working with
|
|
|
|
|
your {es} data in {kib}. Here are some things to try:
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
* Interactively explore your data in <<discover, Discover>>.
|
|
|
|
|
* Present your data in charts, tables, gauges, tag clouds, and more in <<visualize, Visualize>>.
|
|
|
|
|
* Show off your data in a <<canvas, Canvas>> presentation.
|
|
|
|
|
* If your data includes geo data, visualize it using <<maps, Maps>>.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
For a walkthrough of creating an index pattern and visualizing the data,
|
|
|
|
|
see <<getting-started, Getting Started>>.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
|
|
|
|
[float]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
==== Rollup index pattern
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
If a rollup index is detected in the cluster, clicking *Create index pattern*
|
|
|
|
|
includes an item for creating a rollup index pattern. You create an
|
|
|
|
|
index pattern for rolled up data the same way you do for any data.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
You can match an index pattern to only rolled up data, or mix both rolled
|
|
|
|
|
up and raw data to visualize all data together. An index pattern can match
|
|
|
|
|
only one rollup index, not multiple. There is no restriction on the
|
|
|
|
|
number of standard indices that an index pattern can match.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
See <<visualize-rollup-data, Creating a visualization using rolled up data>>
|
|
|
|
|
for more detailed information.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
|
|
|
|
[float]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
=== Manage your index pattern
|
2018-05-14 16:38:16 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
Once you’ve created an index pattern, you’re presented a table of all fields
|
|
|
|
|
and associated data types in the index.
|
2018-05-14 16:38:16 +02:00
|
|
|
|
|
2019-06-26 16:14:48 +02:00
|
|
|
|
[role="screenshot"]
|
|
|
|
|
image:management/index-patterns/images/new-index-pattern.png["Index files and data types"]
|
|
|
|
|
|
|
|
|
|
You can perform the following actions:
|
|
|
|
|
|
|
|
|
|
* *Manage the index fields.* Click a column header to sort the table by that column.
|
|
|
|
|
Use the field dropdown menu to limit to display to a specific field.
|
|
|
|
|
See <<managing-fields, Managing fields>> for more detailed information.
|
2016-10-25 03:41:32 +02:00
|
|
|
|
|
2019-06-26 17:48:22 +02:00
|
|
|
|
[[set-default-pattern]]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
* *Set the default index pattern.* {kib} uses a badge to make users
|
|
|
|
|
aware of which index pattern is the default. The first pattern
|
|
|
|
|
you create is automatically designated as the default pattern. The default
|
|
|
|
|
index pattern is loaded when you view the Discover tab.
|
|
|
|
|
|
2019-06-26 17:48:22 +02:00
|
|
|
|
[[reload-fields]]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
* *Reload the index fields list.* You can reload the index fields list to
|
|
|
|
|
pick up any newly-added fields. Doing so also resets Kibana’s popularity counters
|
|
|
|
|
for the fields. The popularity counters keep track of the fields
|
|
|
|
|
you’ve used most often in {kib} and are used to sort fields in lists.
|
|
|
|
|
|
2019-06-26 17:48:22 +02:00
|
|
|
|
[[delete-pattern]]
|
2019-06-26 16:14:48 +02:00
|
|
|
|
* *Delete the index pattern.* This action removes the pattern from the list of
|
|
|
|
|
Saved Objects in {kib}. You will not be able to recover field formatters,
|
|
|
|
|
scripted fields, source filters, and field popularity data associated with the index pattern.
|
|
|
|
|
+
|
|
|
|
|
Deleting an index pattern breaks all visualizations, saved searches, and
|
|
|
|
|
other saved objects that reference the pattern. Deleting an index pattern does
|
|
|
|
|
not remove any indices or data documents from {es}.
|
2017-07-05 23:18:55 +02:00
|
|
|
|
|
|
|
|
|
include::index-patterns/management-cross-cluster-search.asciidoc[]
|