I was trying an experiment to query multiple indices from kibana4 ala kibana3. These are 2 different data sources that are stored in separate daily indices (see snippet). They have different fields, different mappings, and different "_type" values.
There are other approaches to the bigger problem (re-indexing the 2 data sources into a single unified daily index is the primary one I guess), but for the purpose of this post, I merely wish to establish the constraints I observe in using aliases.
So I issued the following:
curl -XPUT elk/duo-2015.10.09/_alias/alias1-2015.10.09 curl -XPUT elk/cisco-2015.10.09/_alias/alias1-2015.10.09
Then I point kibana4 at the alias from the "Settings" pane ("add new index pattern"). It finds the pattern ("[alias1-]YYYY.MM.DD") and offers up the various date fields as options for the timestamp. When I look at the data in the Discover pane, only data and field names from one of the indices are present.
I suspect that an alias can only work for a group of indices if they have the same mapping? same _type? Or some other constraint that I am expressing poorly?
Thanks for any help, hints, and/or benign hooliganism.