Kibana 3 index settings


(spezam .) #1

Hello,
in Kibana 3 is possible to set from the dashboard settings, the index
settings.
I'm using for this a day based timestamping, with an index pattern such as
[dc1_logstash-]YYYY.MM.DD

Now, we added a new datacenter to the elasticsearch cluster, with different
index names. Is it possible to use a regexp, or an array of indexes like in
kibana2
Smart_index_pattern = ['dc1_logstash-%Y.%m.%d', 'dc2_logstash-%Y.%m.%d']

I tried with
[*_logstash-]YYYY.MM.DD]

but I got a no indices error.

Thanks,
Matteo

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/e6c62f7f-7d75-4ec5-8c2e-8f16bf40d2fb%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Ryan Schneider) #2

I would like to know how to make this possible as well. For non-production,
all environments share the same logstash/elasticsearch cluster. Therefore
our patten is:

%{env}-logstash-%{+YYYY.MM.dd}"

On Thursday, January 2, 2014 3:50:59 AM UTC-5, spezam . wrote:

Hello,
in Kibana 3 is possible to set from the dashboard settings, the index
settings.
I'm using for this a day based timestamping, with an index pattern such as
[dc1_logstash-]YYYY.MM.DD

Now, we added a new datacenter to the elasticsearch cluster, with
different index names. Is it possible to use a regexp, or an array of
indexes like in kibana2
Smart_index_pattern = ['dc1_logstash-%Y.%m.%d', 'dc2_logstash-%Y.%m.%d']

I tried with
[*_logstash-]YYYY.MM.DD]

but I got a no indices error.

Thanks,
Matteo

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/21cb1116-d42b-46a0-8724-25d920d3b282%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Ryan Schneider) #3

I would like to know how to make this possible as well. For non-production,
all environments share the same logstash/elasticsearch cluster. Therefore
our patten is:

%{env}-logstash-%{+YYYY.MM.dd}"

On Thursday, January 2, 2014 3:50:59 AM UTC-5, spezam . wrote:

Hello,
in Kibana 3 is possible to set from the dashboard settings, the index
settings.
I'm using for this a day based timestamping, with an index pattern such as
[dc1_logstash-]YYYY.MM.DD

Now, we added a new datacenter to the elasticsearch cluster, with
different index names. Is it possible to use a regexp, or an array of
indexes like in kibana2
Smart_index_pattern = ['dc1_logstash-%Y.%m.%d', 'dc2_logstash-%Y.%m.%d']

I tried with
[*_logstash-]YYYY.MM.DD]

but I got a no indices error.

Thanks,
Matteo

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/9b921596-09b9-46b5-a05a-08110da6087e%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Pascal Larivee) #4

I am looking for the same answer. ever got to find out how?

On Thursday, January 2, 2014 3:50:59 AM UTC-5, spezam . wrote:

Hello,
in Kibana 3 is possible to set from the dashboard settings, the index
settings.
I'm using for this a day based timestamping, with an index pattern such as
[dc1_logstash-]YYYY.MM.DD

Now, we added a new datacenter to the elasticsearch cluster, with
different index names. Is it possible to use a regexp, or an array of
indexes like in kibana2
Smart_index_pattern = ['dc1_logstash-%Y.%m.%d', 'dc2_logstash-%Y.%m.%d']

I tried with
[*_logstash-]YYYY.MM.DD]

but I got a no indices error.

Thanks,
Matteo

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/698504ac-48ea-49ab-a092-9402815997e3%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(spezam .) #5

Not yet, I'm still using Kibana 2 because of this "issue".

On Friday, February 14, 2014 2:21:38 PM UTC+1, Pascal Larivee wrote:

I am looking for the same answer. ever got to find out how?

On Thursday, January 2, 2014 3:50:59 AM UTC-5, spezam . wrote:

Hello,
in Kibana 3 is possible to set from the dashboard settings, the index
settings.
I'm using for this a day based timestamping, with an index pattern such as
[dc1_logstash-]YYYY.MM.DD

Now, we added a new datacenter to the elasticsearch cluster, with
different index names. Is it possible to use a regexp, or an array of
indexes like in kibana2
Smart_index_pattern = ['dc1_logstash-%Y.%m.%d', 'dc2_logstash-%Y.%m.%d']

I tried with
[*_logstash-]YYYY.MM.DD]

but I got a no indices error.

Thanks,
Matteo

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/6e143a28-db8a-4b2a-9c84-8f1d2cb80744%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Binh Ly) #6

Can you try something like this:

[logstash-]YYYY.MM.DD,[dc1_logstash-]YYYY.MM.DD,[dc2_logstash-]YYYY.MM.DD

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/c43a1533-edbe-4d65-9be9-dba173f6f076%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(spezam .) #7

Doesn't look right...

No results There were no results because no indices were found that match
your selected time span

On Friday, February 14, 2014 4:23:48 PM UTC+1, Binh Ly wrote:

Can you try something like this:

[logstash-]YYYY.MM.DD,[dc1_logstash-]YYYY.MM.DD,[dc2_logstash-]YYYY.MM.DD

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/7106e47d-3bab-4315-98d8-f30b32800aa6%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Binh Ly) #8

Strange, I just downloaded the latest Kibana, and I created 2 simple
logstash indexes, logstash-2014.01.29 and a_logstash-2014.01.29. Then I
went into Kibana with a new dashboard and set the index timestampping to
day and pattern to [a_logstash-]YYYY.MM.DD,[logstash-]YYYY.MM.DD

My histogram shows some data and when I inspect the query, it says:

curl -XGET 'http://localhost:9200/logstash-2014.01.29,a_logstash-2014.01.29/_search?pretty' -d '{...}'

I'm curious, which version of Kibana are you using?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/ef7a4b55-9cc7-45d8-b783-7df6bf406253%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Pascal Larivee) #9

I was told that Milestone 5 have the support for the list version

""

No, wildcards are not supported in the pattern, you can however supply
multiple patterns:

"pattern": "[logstash-1-]YYYY.MM.DD,[logstash-2-]YYYY.MM.DD,",

""

On Friday, February 14, 2014 11:55:03 AM UTC-5, Binh Ly wrote:

Strange, I just downloaded the latest Kibana, and I created 2 simple
logstash indexes, logstash-2014.01.29 and a_logstash-2014.01.29. Then I
went into Kibana with a new dashboard and set the index timestampping to
day and pattern to [a_logstash-]YYYY.MM.DD,[logstash-]YYYY.MM.DD

My histogram shows some data and when I inspect the query, it says:

curl -XGET 'http://localhost:9200/logstash-2014.01.29,a_logstash-2014.01.29/_search?pretty' -d '{...}'

I'm curious, which version of Kibana are you using?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/31327d6a-0c8d-4b37-835e-e0ac1e39e903%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(spezam .) #10

My previous installation was around 3 weeks old, after upgrading to the
latest Kibana it seems it started working just great.

Thanks a million!

On Friday, February 14, 2014 5:55:03 PM UTC+1, Binh Ly wrote:

Strange, I just downloaded the latest Kibana, and I created 2 simple
logstash indexes, logstash-2014.01.29 and a_logstash-2014.01.29. Then I
went into Kibana with a new dashboard and set the index timestampping to
day and pattern to [a_logstash-]YYYY.MM.DD,[logstash-]YYYY.MM.DD

My histogram shows some data and when I inspect the query, it says:

curl -XGET 'http://localhost:9200/logstash-2014.01.29,a_logstash-2014.01.29/_search?pretty' -d '{...}'

I'm curious, which version of Kibana are you using?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/3bd3a91d-6c03-480d-9bcf-f57972fa8651%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(tom rkba) #11

""

No, wildcards are not supported in the pattern, you can however supply
multiple patterns:

"pattern": "[logstash-1-]YYYY.MM.DD,[logstash-2-]YYYY.MM.DD,",

""

I do not understand what you are doing here. Is this in a querystring
field? What exactly are you entering?

For example, I have an index called "test-2014.02.27" that contains one
event:

_index
_type

_id _score
message
@timestamp
@version
type
host

test-2014.02.27
test_log
1EIFYscWTaKYltB4e_AF3g
1
hello
2014-02-27T23:03:24.141Z
1
test_log
mytesthost

What query do I need to construct in Kibana to pull this information? The
following failed (using custom time search):

index:"test-2014.02.27"

_index:"test-2014.02.27"

index:"test-2014.02.27" AND hello

_index:"test-2014.02.27" AND hello

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/75129b0f-a4ab-4644-b9f6-ddf2da3fc8d1%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(Binh Ly-2) #12

Tom, that is a name mask to tell Kibana which indexes it should be looking
at. That setting is accessible from your dashboard - upper right -
Configure Dashboard | Index | Default Index.

On Friday, February 28, 2014 10:22:15 AM UTC-5, tom rkba wrote:

""

No, wildcards are not supported in the pattern, you can however supply
multiple patterns:

"pattern": "[logstash-1-]YYYY.MM.DD,[logstash-2-]YYYY.MM.DD,",

""

I do not understand what you are doing here. Is this in a querystring
field? What exactly are you entering?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/e71e6e64-a642-4e98-9369-af6e453164b6%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(spezam .) #13

Tom,
as Binh wrote, those are indexes name of my three ES cluster nodes. Indexes
that I want to query all at once via Kibana 3.

On Friday, February 28, 2014 5:16:10 PM UTC+1, Binh Ly wrote:

Tom, that is a name mask to tell Kibana which indexes it should be looking
at. That setting is accessible from your dashboard - upper right -
Configure Dashboard | Index | Default Index.

On Friday, February 28, 2014 10:22:15 AM UTC-5, tom rkba wrote:

""

No, wildcards are not supported in the pattern, you can however supply
multiple patterns:

"pattern": "[logstash-1-]YYYY.MM.DD,[logstash-2-]YYYY.MM.DD,",

""

I do not understand what you are doing here. Is this in a querystring
field? What exactly are you entering?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/b8ed8be3-989d-49db-98f0-029b53ea55c5%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(tom rkba) #14

Thanks!

On Friday, February 28, 2014 1:28:59 PM UTC-5, spezam . wrote:

Tom,
as Binh wrote, those are indexes name of my three ES cluster nodes.
Indexes that I want to query all at once via Kibana 3.

On Friday, February 28, 2014 5:16:10 PM UTC+1, Binh Ly wrote:

Tom, that is a name mask to tell Kibana which indexes it should be
looking at. That setting is accessible from your dashboard - upper right -
Configure Dashboard | Index | Default Index.

On Friday, February 28, 2014 10:22:15 AM UTC-5, tom rkba wrote:

""

No, wildcards are not supported in the pattern, you can however supply
multiple patterns:

"pattern": "[logstash-1-]YYYY.MM.DD,[logstash-2-]YYYY.MM.DD,",

""

I do not understand what you are doing here. Is this in a querystring
field? What exactly are you entering?

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/79c18594-3657-407f-96e5-f522b151d5cd%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(tom rkba) #15

I have it working now. Thanks

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/26448f0a-0caf-46ef-91d8-5237434cda64%40googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.


(system) #16