Index Pattern might be treated as substring of other Index Pattern

[paolovalladolid]

We have 2 servers running Winlogbeat.

Server 1 Winlogbeat has this index pattern configured: developer-portal-%{+yyyyMMdd}

Server 2 Winlogbeat has this index pattern configured: developer-portal-hydrator-%{+yyyyMMdd}

We have one Kibana dashboard set up to display documents shipped from Server 1, and another dashboard set up to display documents shipped from Server 2.

The Server 1 dashboard is showing documents shipped from Server 2 as well as Server 1. I guess it is because the selected index pattern is developer-portal-*, which would match the index patterns for both servers.

I guess the answer is to change the index pattern config in one of the Winlogbeat instances so that the Kibana index pattern does not match both of them. Can someone confirm?

[eMitch (Eddie Mitchell)]

Renaming the indexes will solve your overlap issue, for sure.

Depending on your configuration, you could also add Aliases to the indexes and create the Kibana Data View (index pattern) to reference the aliases instead of the actual index names.

This may give you a little more flexibility as well.