Loading index patterns to use in Kibana

Elastic Stack Kibana
1

Hi,

Is there any point/need/advantage for loading index patterns for filebeat etc. if we use custom index names in elasticsearch output like shown below? For example, If I won't use any of "packetbeat-", "topbeat-", "filebeat-" and "winlogbeat-" in Kibana, why should I load them?

Thanks

Logstash config

output {
    elasticsearch {
        hosts => ["localhost:9200"]
        sniffing => true
        manage_template => false
        index => "my-index"
    }
}
2

If you use custom patterns then you need to add them in manually.

That's probably not a good idea if it's time based data.

3

I add them manually but never use them. Instead I use my-index in Kibana dashboard. Hence reason I am asking. If I won't use them why should I add them in first place anyway? I want to know if I am missing out some great features when I ignore them.

4

If you don't add the index pattern for the data in Elasticsearch then you can't do much with Kibana.

5

I still don't understand the difference between index => "my-index" and index => "filebeat-my-index".

I don't see any difference between selecting filebeat-* and my-index for "Index name or pattern" field in Kibana GUI. Both logs have exactly the same fields/data in Elasticsearch.

6

It depends on which index you are sending the data to.

That is what you have in your config, so that is what you should set in Kibana.

7

I meant;

Whether I sent the data to

  • my-index and select my-index
    OR
  • filebeat-my-index and select filebeat-*

as index pattern in Kibana GUI, there is no difference in logs. Logs in both Elasticsearch indexes have exactly the same fields/data. That's why I don't understand why I cannot do mush with Kibana as you said above.

If you don't add the index pattern for the data in Elasticsearch then you can't do much with Kibana.

8

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.