Picking latest index in kibana dashboard

Elastic Stack Kibana
1

We are using a rollover indexing strategy where each software run would result in two new indexes everyday, for example

somestaticname-a-.2019.07.16_01.00.04, somestaticname-b-.2019.07.16_01.00.04
somestaticname-a-.2019.07.17_11.00.05, somestaticname-b-.2019.07.17_11.00.05
somestaticname-a-.2019.07.18_01.02.09, somestaticname-b-.2019.07.18_01.02.09

On kibana dashboard, we have a filter to manually select a date, something like below

    query
        "match": {
          "_index": {
            "query": "somestaticname-*-.2019.07.18*>",
            "type": "phrase"
          }
        }
      }
}

The above approach successfully choose the index and render dashboard accordingly but can it automatically take the latest date "now" and render the latest index so that user have less cognitive load of finding whether dashboard is current or of some earlier date. Can you please let us know if it's possible? or suggest any potential solutions.

2

Hi, one idea I have is to set up an Index Alias. For example this will create the alias latest_somestaticname that points to 2019.07.18 indices:

POST /_aliases
{
    "actions" : [
        { "add" : { "index" : "somestaticname-*-.2019.07.18*", "alias" : "latest_somestaticname" } }
    ]
}

Then you can set up an index pattern that uses the alias latest_somestaticname instead of the time series index names and use that index pattern for the dashboard.

However this will require you to update the alias after the new indices are created each day. Would this be possible to integrate into your rollover workflow or a separate cron script?

Another similar idea is to use a Filtered Alias on the pattern somestaticname-*-* and filtering by some date field.

3

Thanks for your response!

Yes, this looks like a promising solution. So I am reading alias documentation here https://www.elastic.co/guide/en/elasticsearch/reference/2.0/indices-aliases.html

So essentially, we have to make two calls

  1. One to find last alias association with index
  2. Remove alias from the old index and associate with the new one.

Is there an option where disassociation with last index happens automatically when we associate alias with the latest index? I don't want to write logic to search and remove last associated index.

4

It can happen in one call where the actions are done in sequence. For example first the remove action removes the alias from all indices with your pattern, and then the add action adds the alias to the most recent index:

POST _aliases
{
  "actions": [
    {
      "remove": {
        "index": "somestaticname-*-*",
        "alias": "latest_somestaticname"
      }
    },
    {
      "add": {
        "index": "somestaticname-*-.2019.07.18*",
        "alias": "latest_somestaticname"
      }
    }
  ]
}
5

Thank you, we can implement this easily.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.