# Index Pattern might be treated as substring of other Index Pattern

**URL:** https://discuss.elastic.co/t/index-pattern-might-be-treated-as-substring-of-other-index-pattern/333220
**Category:** Kibana
**Created:** [May 11, 2023, 3:27pm UTC](https://discuss.elastic.co/t/index-pattern-might-be-treated-as-substring-of-other-index-pattern/333220 "2023-05-11T15:27:04Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![paolovalladolid](https://avatars.discourse-cdn.com/v4/letter/p/edb3f5/32.png) [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)
#### Post date: [May 11, 2023, 3:27pm UTC](https://discuss.elastic.co/t/index-pattern-might-be-treated-as-substring-of-other-index-pattern/333220/1 "2023-05-11T15:27:04Z")

</div>

We have 2 servers running Winlogbeat.

Server 1 Winlogbeat has this index pattern configured: ` developer-portal-%{+yyyyMMdd}`

Server 2 Winlogbeat has this index pattern configured: `developer-portal-hydrator-%{+yyyyMMdd}`

We have one Kibana dashboard set up to display documents shipped from Server 1, and another dashboard set up to display documents shipped from Server 2.

The Server 1 dashboard is showing documents shipped from Server 2 as well as Server 1. I guess it is because the selected index pattern is `developer-portal-*`, which would match the index patterns for both servers.

I guess the answer is to change the index pattern config in one of the Winlogbeat instances so that the Kibana index pattern does not match both of them. Can someone confirm?

---

<div class="post-metadata">

### Author: ![eMitch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/emitch/32/93607_2.png) [@eMitch](https://discuss.elastic.co/u/eMitch)
#### Post date: [May 11, 2023, 7:51pm UTC](https://discuss.elastic.co/t/index-pattern-might-be-treated-as-substring-of-other-index-pattern/333220/2 "2023-05-11T19:51:51Z")

</div>

Renaming the indexes will solve your overlap issue, for sure.

Depending on your configuration, you could also add [Aliases](https://www.elastic.co/guide/en/elasticsearch/reference/current/aliases.html) to the indexes and create the Kibana Data View (index pattern) to reference the aliases instead of the actual index names.

This may give you a little more flexibility as well.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 8, 2023, 7:52pm UTC](https://discuss.elastic.co/t/index-pattern-might-be-treated-as-substring-of-other-index-pattern/333220/3 "2023-06-08T19:52:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
