0abdfaea21
* Update tutorial-define-index.asciidoc Forgot to update alt text in previous pr. Additionally, it is unclear in the image where the "time field" dropdown is located. * Update docs/getting-started/tutorial-define-index.asciidoc Co-authored-by: Kaarina Tungseth <kaarina.tungseth@elastic.co> Co-authored-by: ncheckin <68351161+ncheckin@users.noreply.github.com>
51 lines
1.6 KiB
Plaintext
51 lines
1.6 KiB
Plaintext
[[tutorial-define-index]]
|
||
=== Define your index patterns
|
||
|
||
Index patterns tell {kib} which {es} indices you want to explore.
|
||
An index pattern can match the name of a single index, or include a wildcard
|
||
(*) to match multiple indices.
|
||
|
||
For example, Logstash typically creates a
|
||
series of indices in the format `logstash-YYYY.MMM.DD`. To explore all
|
||
of the log data from May 2018, you could specify the index pattern
|
||
`logstash-2018.05*`.
|
||
|
||
[float]
|
||
==== Create the index patterns
|
||
|
||
First you'll create index patterns for the Shakespeare data set, which has an
|
||
index named `shakespeare,` and the accounts data set, which has an index named
|
||
`bank`. These data sets don't contain time series data.
|
||
|
||
. Open the menu, then go to *Stack Management > {kib} > Index Patterns*.
|
||
|
||
. If this is your first index pattern, the *Create index pattern* page opens.
|
||
|
||
. In the *Index pattern name* field, enter `shakes*`.
|
||
+
|
||
[role="screenshot"]
|
||
image::images/tutorial-pattern-1.png[Image showing how to enter shakes* in Index Pattern Name field]
|
||
|
||
. Click *Next step*.
|
||
|
||
. On the *Configure settings* page, *Create index pattern*.
|
||
+
|
||
You’re presented a table of all fields and associated data types in the index.
|
||
|
||
. Create a second index pattern named `ba*`.
|
||
|
||
[float]
|
||
==== Create an index pattern for the time series data
|
||
|
||
Create an index pattern for the Logstash index, which
|
||
contains the time series data.
|
||
|
||
. Create an index pattern named `logstash*`, then click *Next step*.
|
||
|
||
. From the *Time field* dropdown, select *@timestamp, then click *Create index pattern*.
|
||
+
|
||
[role="screenshot"]
|
||
image::images/tutorial_index_patterns.png[Image showing how to create an index pattern]
|
||
|
||
|