Kibana view surronding documents global index

I have an issue with Kibana viewing surrounding documents, it turns out it only does lookup on the "_id" part not using the "_index", so it only shows data from latest index in the the index group here "proxylog-*"

https://<elasticserver:port>/app/kibana#/context/f1a079c0-f233-11e8-8bf8-43571a2d76e4/proxylog/209463

turns out it needs a globally unique index on the _id field, currently our indexes look like this:

'{
 "index": {
  "_index": "proxylog-sensiowfdev02-2019-02-08",
  "_type": "proxylog",
  "_id": 209463
 }
}'

This refers to the line number in the massive *.gz file i read in, it is important in duplicate handling and restart. How can I make this composite in a fast way
Can I just add "_index" I have no time doing a uuid() generation for all because I need insert rate of >10K/lines/sec.

Best practices greatly appriciated

I just added: _index to _id, then it logs up correctly:

'{
"index": {
"_index": "proxylog-sensiowfdev02-2019-02-08",
"_type": "proxylog",
"_id": "proxylog-sensiowfdev02-2019-02-08:589491"
}
}'

Now the link in Kibana looks like this:

https:///app/kibana#/context/f1a079c0-f233-11e8-8bf8-43571a2d76e4/proxylog/proxylog-sensiowfdev02-2019-02-08:594940

1 Like

Glad you were able to find a solution. Thanks for sharing it!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.