* [DOCS] Updates create index pattern (#106935) * [DOCS] Updates create index pattern * [DOCS] Adds info on refresh * Update docs/concepts/index-patterns.asciidoc Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com> * Update docs/concepts/index-patterns.asciidoc Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com> * Update docs/concepts/index-patterns.asciidoc Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com> * Update docs/concepts/index-patterns.asciidoc Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com> * Update docs/concepts/index-patterns.asciidoc Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com> * [DOCS] Addresses more review comments * [DOCS] Updates images Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com> * Update docs/concepts/index-patterns.asciidoc * Update docs/concepts/index-patterns.asciidoc Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: James Rodewig <40268737+jrodewig@users.noreply.github.com>
149 lines
5.2 KiB
Plaintext
149 lines
5.2 KiB
Plaintext
[[index-patterns]]
|
||
=== Create an index pattern
|
||
|
||
{kib} requires an index pattern to access the {es} data that you want to explore.
|
||
An index pattern selects the data to use and allows you to define properties of the fields.
|
||
|
||
An index pattern can point to one or more indices, {ref}/data-streams.html[data stream], or {ref}/alias.html[index aliases].
|
||
For example, an index pattern can point to your log data from yesterday,
|
||
or all indices that contain your data.
|
||
|
||
[float]
|
||
[[index-patterns-read-only-access]]
|
||
=== Required permissions
|
||
|
||
* Access to *Index Patterns* requires the <<xpack-security-authorization, {kib} privilege>>
|
||
`Index Pattern Management`.
|
||
|
||
* To create an index pattern, you must have the <<xpack-security-authorization,{es} privilege>>
|
||
`view_index_metadata`.
|
||
|
||
* If a read-only indicator appears in {kib}, you have insufficient privileges
|
||
to create or save index patterns. The buttons to create new index patterns or
|
||
save existing index patterns are not visible. For more information,
|
||
refer to <<xpack-security-authorization,Granting access to {kib}>>.
|
||
|
||
[float]
|
||
[[settings-create-pattern]]
|
||
=== Create an index pattern
|
||
|
||
If you collected data using one of the {kib} <<connect-to-elasticsearch,ingest options>>,
|
||
uploaded a file, or added sample data,
|
||
you get an index pattern for free, and can start exploring your data.
|
||
If you loaded your own data, follow these steps to create an index pattern.
|
||
|
||
. Open the main menu, then click to *Stack Management > Index Patterns*.
|
||
|
||
. Click *Create index pattern*.
|
||
+
|
||
[role="screenshot"]
|
||
image:management/index-patterns/images/create-index-pattern.png["Create index pattern"]
|
||
|
||
. Start typing in the *Index pattern* field, and {kib} looks for the names of
|
||
indices, data streams, and aliases that match your input.
|
||
+
|
||
** To match multiple sources, use a wildcard (*). For example, `filebeat-*` matches
|
||
`filebeat-apache-a`, `filebeat-apache-b`, and so on.
|
||
+
|
||
** To match multiple single sources, enter their names,
|
||
separated with a comma. Do not include a space after the comma.
|
||
`filebeat-a,filebeat-b` matches two indices, but not match `filebeat-c`.
|
||
+
|
||
** To exclude a source, use a minus sign (-), for example, `-test3`.
|
||
|
||
. If {kib} detects an index with a timestamp, expand the *Timestamp field* menu,
|
||
and then select the default field for filtering your data by time.
|
||
+
|
||
** If your index doesn’t have time-based data, choose *I don’t want to use the time filter*.
|
||
+
|
||
** If you don’t set a default time field, you can't use
|
||
global time filters on your dashboards. This is useful if
|
||
you have multiple time fields and want to create dashboards that combine visualizations
|
||
based on different timestamps.
|
||
|
||
. Click *Create index pattern*.
|
||
+
|
||
[[reload-fields]] {kib} is now configured to use your {es} data. When a new field is added to an index,
|
||
the index pattern field list is updated
|
||
the next time the index pattern is loaded, for example, when you load the page or
|
||
move between {kib} apps.
|
||
|
||
. Select this index pattern when you search and visualize your data.
|
||
|
||
[float]
|
||
[[rollup-index-pattern]]
|
||
==== Create an index pattern for rolled up data
|
||
|
||
An index pattern can match one rollup index. For a combination rollup
|
||
index pattern with both raw and rolled up data, use the standard notation:
|
||
|
||
```ts
|
||
rollup_logstash,kibana_sample_data_logs
|
||
```
|
||
For an example, refer to <<rollup-data-tutorial,Create and visualize rolled up data>>.
|
||
|
||
[float]
|
||
[[management-cross-cluster-search]]
|
||
==== Create an index pattern that searches across clusters
|
||
|
||
If your {es} clusters are configured for {ref}/modules-cross-cluster-search.html[{ccs}],
|
||
you can create an index pattern to search across the clusters of your choosing. Use the
|
||
same syntax that you use in a raw {ccs} request in {es}:
|
||
|
||
```ts
|
||
<cluster-names>:<pattern>
|
||
```
|
||
|
||
To query {ls} indices across two {es} clusters
|
||
that you set up for {ccs}, named `cluster_one` and `cluster_two`:
|
||
|
||
```ts
|
||
cluster_one:logstash-*,cluster_two:logstash-*
|
||
```
|
||
|
||
Use wildcards in your cluster names
|
||
to match any number of clusters. To search {ls} indices across
|
||
clusters named `cluster_foo`, `cluster_bar`, and so on:
|
||
|
||
```ts
|
||
cluster_*:logstash-*
|
||
```
|
||
|
||
To query across all {es} clusters that have been configured for {ccs},
|
||
use a standalone wildcard for your cluster name:
|
||
|
||
```ts
|
||
*:logstash-*
|
||
```
|
||
|
||
To match indices starting with `logstash-`, but exclude those starting with `logstash-old`, from
|
||
all clusters having a name starting with `cluster_`:
|
||
|
||
```ts
|
||
`cluster_*:logstash-*,cluster_*:-logstash-old*`
|
||
```
|
||
|
||
To exclude a cluster having a name starting with `cluster_`:
|
||
|
||
```ts
|
||
`cluster_*:logstash-*,cluster_one:-*`
|
||
```
|
||
|
||
Once you configure an index pattern to use the {ccs} syntax, all searches and
|
||
aggregations using that index pattern in {kib} take advantage of {ccs}.
|
||
|
||
[float]
|
||
[[delete-index-pattern]]
|
||
=== Delete index patterns
|
||
|
||
When you delete an index pattern, you cannot recover the associated field formatters, runtime fields, source filters,
|
||
and field popularity data. Deleting an index pattern does not remove any indices or data documents from {es}.
|
||
|
||
WARNING: Deleting an index pattern breaks all visualizations, saved searches, and other saved objects that reference the index pattern.
|
||
|
||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||
|
||
. Click the index pattern to delete.
|
||
|
||
. Delete (image:management/index-patterns/images/delete.png[Delete icon]) the index pattern.
|