I would like to have two indexes, one with timestamp field defined and one without it. Is it possible?
If you are using two different indices, then they can have two different mappings, that's not a problem. If you are trying to query them together though, and you are using the timestamp field, the index without that field simply won't return any hits.
But how do I create one under same name? Currently my 'little hack' is by creating two indexes by using different range of characters inside Kibana GUI.
Lets say ES stores data as my_little_db_test. Then, in Kibana, I create index by using two wildcards:
- my_little_db_test
- my_little_db_te*
But there must be a 'cleaner' way of doing this
Ah, I get what you're saying. If you're querying the same data from effectively the indices, I don't understand why you need a version of the data with and without a time field. I know there are some subtle differences in the way Kibana handles non-timeseries data, but is there something you can't do when you pick a time field on the index pattern?
Lets just say I have no choice 
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.