* eui to v30.0.0 * removed unused RecentLinks component * update compressed -> display prop * euiformrow compressed -> display * euipopover remove withtitle * euibuttongroup prop updates * remove euibuttontoggle * src snapshot updates * tutorial euibuttongroup update * x-pack snapshot updates * euibuttongroup test updates * TODO * misc. js file updates * remove euinavdrawer scss references * translation removals * more x-pack snapshot updates * update data-test-subj lookup * icons logoAMP -> logoObservability * cypress selector updates * update euibuttontoggle onchange, test interaction * Fix auto-update toggle in Visualize * some more change -> click test updates * idtoselectedmap change * Fix feature table button group * Remove empty SASS file * Fix feature table button group II * Using `compressed` to also dictate dual range row * Fix a few security labels * An ML fix * Apply suggestions from code review Co-authored-by: Caroline Horn <549577+cchaos@users.noreply.github.com> * remove unused translation * update view_type_toggle snapshot * more snapshot updates * eui to 30.1.0 * undo temp ts-ignore * more x-pack snapshot updates * eui to 30.1.1 * update feature privilege text * Update x-pack/plugins/security/public/management/roles/edit_role/privileges/kibana/feature_table/sub_feature_form.tsx Co-authored-by: Joe Portner <5295965+jportner@users.noreply.github.com> * reuse i18n token * Adapt log entry action button to new `minWidth` prop * clean up label * Combine auto apply strings into one * ternary fix * cases status useCallback Co-authored-by: cchaos <caroline.horn@elastic.co> Co-authored-by: Caroline Horn <549577+cchaos@users.noreply.github.com> Co-authored-by: Joe Portner <5295965+jportner@users.noreply.github.com> Co-authored-by: Felix Stürmer <stuermer@weltenwort.de> Co-authored-by: cchaos <caroline.horn@elastic.co> Co-authored-by: Caroline Horn <549577+cchaos@users.noreply.github.com> Co-authored-by: Joe Portner <5295965+jportner@users.noreply.github.com> Co-authored-by: Felix Stürmer <stuermer@weltenwort.de> |
||
---|---|---|
.. | ||
common | ||
fixtures | ||
public | ||
server | ||
kibana.json | ||
README.md |
Rollup
Summary
Welcome to the Kibana rollup plugin! This plugin provides Kibana support for Elasticsearch's rollup feature. Please refer to the Elasticsearch documentation to understand rollup indices and how to create rollup jobs.
This plugin allows Kibana to:
- Create and manage rollup jobs
- Create rollup index patterns
- Create visualizations from rollup index patterns
- Identify rollup indices in Index Management
The rest of this doc dives into the implementation details of each of the above functionality.
Quick steps for testing
The pattern for creating a rollup job and rollup index pattern is:
- Install sample data (web logs is a good one).
- Create a rollup job with an index pattern that captures this index (e.g.
k*
). - Set frequency to "minute". Clear the latency buffer field.
- Select the time field which is the same time field selected in the installed index pattern (
timestamp
without an@
in the case of web logs). - Specify a time bucket size (
10m
will do). - Select a few terms, histogram, and metrics fields.
- Create and start the rollup job. Wait a minute for the job to run. You should see the numbers for documents and pages processed change in the detail panel.
- Create a rollup index pattern in the Index Patterns app.
- Now you can create visualizations using this index pattern.
Create and manage rollup jobs
The most straight forward part of this plugin! A new app called Rollup Jobs is registered in the Management section and follows a typical CRUD UI pattern. This app allows users to create, start, stop, clone, and delete rollup jobs. There is no way to edit an existing rollup job; instead, the UI offers a cloning ability. The client-side portion of this app lives in public/crud_app and uses endpoints registered in server/routes/api/jobs.
Refer to the Elasticsearch documentation to understand rollup indices and how to create rollup jobs.
Create rollup index patterns
Kibana uses index patterns to consume and visualize rollup indices. Typically, Kibana can inspect the indices captured by an index pattern, identify its aggregations and fields, and determine how to consume the data. Rollup indices don't contain this type of information, so we predefine how to consume a rollup index pattern with the type and typeMeta fields on the index pattern saved object. All rollup index patterns have type
defined as "rollup" and typeMeta
defined as an object of the index pattern's capabilities.
In the Index Pattern app, the "Create index pattern" button includes a context menu when a rollup index is detected. This menu offers items for creating a standard index pattern and a rollup index pattern. A rollup config is registered to index pattern creation extension point. The context menu behavior in particular uses the getIndexPatternCreationOption()
method. When the user chooses to create a rollup index pattern, this config changes the behavior of the index pattern creation wizard:
- Adds a
Rollup
badge to rollup indices usinggetIndexTags()
. - Enforces index pattern rules using
checkIndicesForErrors()
. Rollup index patterns must match one rollup index, and optionally, any number of regular indices. A rollup index pattern configured with one or more regular indices is known as a "hybrid" index pattern. This allows the user to visualize historical (rollup) data and live (regular) data in the same visualization. - Routes to this plugin's rollup
_fields_for_wildcard
endpoint, instead of the standard one, usinggetFetchForWildcardOptions()
, so that the internal rollup data field names are mapped to the original field names. - Writes additional information about aggregations, fields, histogram interval, and date histogram interval and timezone to the rollup index pattern saved object using
getIndexPatternMappings()
. This collection of information is referred to as its "capabilities".
Once a rollup index pattern is created, it is tagged with Rollup
in the list of index patterns, and its details page displays capabilities information. This is done by registering yet another config for the index pattern list extension points.
Create visualizations from rollup index patterns
This plugin enables the user to create visualizations from rollup data using the Visualize app, excluding TSVB, Vega, and Timelion. When Visualize sends search requests, this plugin routes the requests to the Elasticsearch rollup search endpoint, which searches the special document structure within rollup indices. The visualization options available to users are based on the capabilities of the rollup index pattern they're visualizing.
Routing to the Elasticsearch rollup search endpoint is done by creating an extension point in Courier, effectively allowing multiple "search strategies" to be registered. A rollup search strategy is registered by this plugin that queries this plugin's rollup search endpoint.
Limiting visualization editor options is done by registering configs to various vis extension points. These configs use information stored on the rollup index pattern to limit:
- Available aggregation types
- Available fields for a particular aggregation
- Default and base interval for histogram aggregation
- Default and base interval, and time zone, for date histogram aggregation
Identify rollup indices in Index Management
In Index Management, similar to system indices, rollup indices are hidden by default. A toggle is provided to show rollup indices and add a badge to the table rows. This is done by using Index Management's extension points.
The toggle and badge are registered on the client-side in public/extend_index_management.
Additional data needed to filter rollup indices in Index Management is provided with a data enricher.