Does doing a POST query likes these via the devtools update index-pattern?
If the answer is yes.
Does it impact the data in Elasticsearch?
Or its purely visualization?
POST /_query?format=txt
{
"query": """
FROM .ml-notifications*
| WHERE (job_id) == "kibana-logs"
AND message IN ("Datafeed stopped", "Job opened")
| LIMIT 10
"""
}
POST /_query?format=txt
{
"query": """
FROM ABCD:.monitoring-*
| WHERE @timestamp > NOW() - 8 hours
AND (node_stats.process.cpu.percent) > 50
OR (node_stats.jvm.mem.heap_used_percent) > 50
| STATS
process_cpu = AVG(node_stats.process.cpu.percent),
jvm_mem = AVG(node_stats.jvm.mem.heap_used_percent),
fs_avail = AVG(elasticsearch.node.stats.fs.total.available_in_bytes)
BY elasticsearch.node.name
EVAL fs_avail_gb = ROUND((TO_DOUBLE(fs_avail) / 1,073,741,824) * 100, 2)
| WHERE process_cpu > 50
| SORT process_cpu DESC
| LIMIT 100
"""
}