Create global index pattern for specific fields across all indexes

[LuigiDelavega]

Hello,

I'm trying to create a "*" index pattern to use it in my controls for all kind of index, i'll explain myself :
We have 4 generic data fields names application.environment, application.scope, application.name, application.service that we added to every beats, or already in our logs get by filebeat. In our controls, for a global dashboard with data from metricbeat filebeat etc..., we would like to select any of them, but you have to specify an index in the control configuration, and not all beats have the same list, some of our application only have metricbeat or filebeat etc...

I tried to create a "*" index pattern and it worked but he has all the fields that exists in our stack ( more than 100 pages of fields) so if i use it in a control, it wont work well (too slow, some fields are in conflict)
Is there a way to create this "*" pattern with only the 4 generic fields above ?

( In our global dashboards, even if an 'application.' field has a value existing in metricbeat and not filebeat it is not a problem )

Thanks for your time,
Have a good day !

[mattkime (Matthew Kime)]

Hello @LuigiDelavega

You can use a comma delimited list a such - metricbeat-*,filebeat-* - perhaps by specifying only the indices you wish to work with you can select the data you need without incurring a performance penalty.

Thanks,
Matt