Configure an index pattern using event times to create index names

Elastic Stack Kibana
1

Hi,

My question is can I define a unique pattern that uses the option "Use event times to create index names" for different pattern names? Or when the indices have variable parts in addition to the timestamp, I have to use a pattern for each of them? I didn't find any answers online, but it looks like a question that might be quite common, so sorry if I'm repeating myself.

I'm using Kibana 4.0.3

For example, I want to include both of these in only one pattern:
myapp-YYYY.MM.DD
myapp-elb-YYYY.MM.DD

Best regards and thanks!

Jorge

2

Would something like myapp-* work in this scenerio?

In future versions we have moved to using wildcards over time patterns.

3

Hi Tyler,

Thanks for your answer

Yeah, that is what I have configured in the meanwhile. But that is not so performant as having the timestamp in the name.

I read that having YYYY.MM.DD in the pattern improves performance because Kibana will query only the indices that match the timestamp specified in the filter.

But maybe the difference is only significant when there are indices that correspond to months or years, and if there is only a few weeks of indices without many data each, there is almost no difference. Can you confirm it?

Best,

Jorge

4

This inefficiency has been resolved in recent versions of Elasticsearch. You should expect the same performance using a wildcard.

5

ok. then we'll have to push more for the update. thanks!

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.