Combine data views in Timeline Template

Elastic Security
1

Hi Everyone!

I'm implementing the usage of timeline templates in my organization, but when I need to use different indices at the same time, I can't because it is based on data views and not on index patterns. I have some custom index patterns that i want to see along with some basic indices ("logs-*" for example), but the only way I see so far to do so is to create new data view for every rule I want to investigate with timeline template. I do not think that this is an efficient solution though.

I was thinking about creating a data view that covers all my indices but it is limited to 100 index patterns so that is impossible.
Is anyone here had the same problem? Do i miss something?

Thank you for your help!

2

In this case you have basically 2 options.

  • Add a prefix to all your custom indices
  • Add an alias to all your custom indices

I would say that adding an alias is the easiest since this can be done to all existing indices, and to future indices as well by adding it to the template.