Combine data views in Timeline Template

Hi Everyone!

I'm implementing the usage of timeline templates in my organization, but when I need to use different indices at the same time, I can't because it is based on data views and not on index patterns. I have some custom index patterns that i want to see along with some basic indices ("logs-*" for example), but the only way I see so far to do so is to create new data view for every rule I want to investigate with timeline template. I do not think that this is an efficient solution though.

I was thinking about creating a data view that covers all my indices but it is limited to 100 index patterns so that is impossible.
Is anyone here had the same problem? Do i miss something?

Thank you for your help!

In this case you have basically 2 options.

  • Add a prefix to all your custom indices
  • Add an alias to all your custom indices

I would say that adding an alias is the easiest since this can be done to all existing indices, and to future indices as well by adding it to the template.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.