267 lines
8.5 KiB
Plaintext
267 lines
8.5 KiB
Plaintext
[role="xpack"]
|
||
[[managing-indices]]
|
||
== Index Management
|
||
|
||
*Index Management* features are an easy, convenient way to manage your
|
||
{es} cluster's indices, data streams, and index templates. Practicing good index
|
||
management ensures your data is stored correctly and in the most cost-effective
|
||
way possible.
|
||
|
||
[float]
|
||
=== What you'll learn
|
||
|
||
This page shows you how to use *Index Management* features to:
|
||
|
||
* View and edit index settings.
|
||
* View mappings and statistics for an index.
|
||
* Perform index-level operations, such as refreshes and freezes.
|
||
* View and manage data streams.
|
||
* Create index templates to automatically configure new data streams and
|
||
indices.
|
||
|
||
To manage your indices, open the menu, then click *Stack Management > Index
|
||
Management*.
|
||
|
||
[role="screenshot"]
|
||
image::images/management_index_labels.png[Index Management UI]
|
||
|
||
[float]
|
||
=== Before you start
|
||
|
||
Before using this feature, you should be familiar with index management
|
||
operations. Refer to the {ref}/indices.html[index management APIs], the
|
||
{ref}/indices-templates.html[index template APIs], and the
|
||
{ref}/data-streams.html[data streams documentation].
|
||
|
||
[float]
|
||
=== Required permissions
|
||
|
||
The minimum required permissions to access *Index Management* are
|
||
the `monitor` cluster privilege and the `view_index_metadata`
|
||
and `manage` index privileges to view the data.
|
||
For index templates, you must have the `manage_index_templates` cluster privilege.
|
||
See {ref}/security-privileges.html[Security privileges] for more
|
||
information.
|
||
|
||
You can add these privileges in *Stack Management > Security > Roles*.
|
||
|
||
[float]
|
||
=== View and edit indices
|
||
|
||
When you open *Index Management*, you’re presented an overview of your configured indices.
|
||
Badges indicate if an index is {ref}/frozen-indices.html[frozen],
|
||
a {ref}/ccr-put-follow.html[follower index],
|
||
or a {ref}/rollup-get-rollup-index-caps.html[rollup index].
|
||
|
||
Clicking a badge narrows the list to only indices of that type.
|
||
You can also filter your indices using the search bar.
|
||
|
||
You can drill down into each index to investigate the index
|
||
{ref}/index-modules.html#index-modules-settings[settings], {ref}/mapping.html[mapping], and statistics.
|
||
From this view, you can also edit the index settings.
|
||
|
||
[role="screenshot"]
|
||
image::images/management_index_details.png[Index Management UI]
|
||
|
||
[float]
|
||
=== Perform index-level operations
|
||
|
||
Use the *Manage* menu to perform index-level operations. This menu
|
||
is available in the index details view, or when you select the checkbox of one or more
|
||
indices on the overview page. The menu includes the following actions:
|
||
|
||
* *Close index*. Blocks the index from read/write operations.
|
||
A closed index exists in the cluster, but doesn't consume resources
|
||
other than disk space. If you reopen a closed index, it goes through the
|
||
normal recovery process.
|
||
|
||
* *Force merge index*. Reduces the number of segments in your shard by
|
||
merging smaller files and clearing deleted ones. Only force merge a read-only index.
|
||
|
||
* *Refresh index*. Writes the operations in the indexing buffer to the
|
||
filesystem cache. This action is automatically performed once per second. Forcing a manual
|
||
refresh is useful during testing, but should not be routinely done in
|
||
production because it has a performance impact.
|
||
|
||
* *Clear index cache*. Clears all caches associated with the index.
|
||
|
||
* *Flush index*. Frees memory by syncing the filesystem cache to disk and
|
||
clearing the cache. Once the sync is complete, the internal transaction log is reset.
|
||
|
||
* *Freeze index*. Makes the index read-only and reduces its memory footprint
|
||
by moving shards to disk. Frozen indices remain
|
||
searchable, but queries take longer.
|
||
|
||
* *Delete index*. Permanently removes the index and all of its documents.
|
||
|
||
* *Add lifecycle policy*. Specifies a policy for managing the lifecycle of the
|
||
index.
|
||
|
||
[float]
|
||
[[manage-data-streams]]
|
||
=== Manage data streams
|
||
|
||
A {ref}/data-streams.html[data stream] lets you store time series data across
|
||
multiple backing indices while giving you a single named resource to use in
|
||
requests. The *Data Streams* view lists your data streams and lets you examine
|
||
or delete them.
|
||
|
||
To view more information about a data stream, such as its generation or its
|
||
current index lifecycle policy, click the stream's name.
|
||
|
||
[role="screenshot"]
|
||
image::images/management_index_data_stream_stats.png[Data stream details]
|
||
|
||
To view information about the stream's backing indices, click the number in the
|
||
*Indices* column.
|
||
|
||
[role="screenshot"]
|
||
image::images/management_index_data_stream_backing_index.png[Backing index]
|
||
|
||
[float]
|
||
[[manage-index-templates]]
|
||
=== Manage index templates
|
||
|
||
An index template defines {ref}/index-modules.html#index-modules-settings[settings],
|
||
{ref}/mapping.html[mappings], and {ref}/indices-add-alias.html[aliases]
|
||
that you can automatically apply when creating a new index. {es} applies a
|
||
template to a new index based on an index pattern that matches the index name.
|
||
|
||
The *Index Templates* view lists your templates and enables you to examine, edit, clone, and
|
||
delete them. Changes you make to an index template
|
||
do not affect existing indices.
|
||
|
||
[role="screenshot"]
|
||
image::images/management-index-templates.png[Index templates]
|
||
|
||
If you don't have any templates, you can create one using the *Create template* wizard.
|
||
Index templates are applied during index creation,
|
||
so you must create the
|
||
template before you create the indices.
|
||
|
||
[float]
|
||
==== Try it: Create an index template
|
||
|
||
In this tutorial, you’ll create an index template for randomly generated log
|
||
files. You'll then use the template to configure two new indices.
|
||
|
||
*Step 1. Add a name and index pattern*
|
||
|
||
. In the *Index Templates* view, open the *Create template* wizard.
|
||
+
|
||
[role="screenshot"]
|
||
image::images/management_index_create_wizard.png[Create wizard]
|
||
|
||
. In the *Name* field, enter `my-index-template`.
|
||
|
||
. Set *Index pattern* to `my-index-*` so the template matches any index
|
||
with that index pattern.
|
||
|
||
. Leave *Data Stream*, *Priority*, *Version*, and *_meta field* as-is or blank.
|
||
|
||
. Click *Next*.
|
||
|
||
*Step 2. Add settings, mappings, and index aliases*
|
||
|
||
. Add component templates to your index template.
|
||
+
|
||
{ref}/indices-component-template.html[Component templates] are pre-configured
|
||
sets of mappings, index settings, and index aliases you can reuse across
|
||
multiple index templates. Badges indicate whether a component template contains
|
||
mappings (*M*), index settings (*S*), index aliases (*A*), or a combination of
|
||
the three.
|
||
+
|
||
Component templates are optional. For this tutorial, do not add any component
|
||
templates.
|
||
+
|
||
[role="screenshot"]
|
||
image::images/management_index_component_template.png[Component templates page]
|
||
|
||
. Define index settings. These are optional. For this tutorial, leave this
|
||
section blank.
|
||
|
||
. Define a mapping that contains an object field named `geo` with a child
|
||
geo-point field named `coordinates`:
|
||
+
|
||
[role="screenshot"]
|
||
image::images/management-index-templates-mappings.png[Mapped fields page]
|
||
+
|
||
Alternatively, you can click the *Load JSON* link and define the mapping as JSON:
|
||
+
|
||
[source,js]
|
||
----
|
||
{
|
||
"properties": {
|
||
"geo": {
|
||
"properties": {
|
||
"coordinates": {
|
||
"type": "geo_point"
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
----
|
||
+
|
||
You can create additional mapping configurations in the *Dynamic templates* and
|
||
*Advanced options* tabs. No additional mappings are required for this tutorial.
|
||
|
||
. Define an index alias named `my-index`:
|
||
+
|
||
[source,js]
|
||
----
|
||
{
|
||
"my-index": {}
|
||
}
|
||
----
|
||
|
||
. On the review page, check the summary. If everything looks right, click
|
||
*Create template*.
|
||
|
||
*Step 3. Create new indices*
|
||
|
||
You’re now ready to load the logs data and create new indices using your index
|
||
template.
|
||
|
||
. In the {kib} *Console*, index the following documents:
|
||
+
|
||
[source,js]
|
||
----
|
||
POST /my-index-000001/_doc
|
||
{
|
||
"@timestamp": "2019-05-18T15:57:27.541Z",
|
||
"ip": "225.44.217.191",
|
||
"extension": "jpg",
|
||
"response": "200",
|
||
"geo": {
|
||
"coordinates": {
|
||
"lat": 38.53146222,
|
||
"lon": -121.7864906
|
||
}
|
||
},
|
||
"url": "https://media-for-the-masses.theacademyofperformingartsandscience.org/uploads/charles-fullerton.jpg"
|
||
}
|
||
|
||
POST /my-index-000002/_doc
|
||
{
|
||
"@timestamp": "2019-05-20T03:44:20.844Z",
|
||
"ip": "198.247.165.49",
|
||
"extension": "php",
|
||
"response": "200",
|
||
"geo": {
|
||
"coordinates": {
|
||
"lat": 37.13189556,
|
||
"lon": -76.4929875
|
||
}
|
||
},
|
||
"memory": 241720,
|
||
"url": "https://theacademyofperformingartsandscience.org/people/type:astronauts/name:laurel-b-clark/profile"
|
||
}
|
||
----
|
||
+
|
||
These requests create two indices: `my-index-000001` and `my-index-000002`.
|
||
|
||
. Use the {es} {ref}/indices-get-index.html#indices-get-index[get index API] to
|
||
view one of the newly created indices. The index's mappings and alias are
|
||
configured automatically based on the template.
|