Rollup job not visable in Kibana

Elastic Stack Kibana
1

Hi community,

I have followed the guidelines on https://www.elastic.co/guide/en/kibana/current/data-rollups.html
I try the example first to get a grip on how these rollup jobs function.
However when I try to Visualize the rolled up data I am unable to find the index called rollup_logstash as shown in the example.
Is there a step I am missing? Do I need to do anything manual in Kibana with the index called rollup_logstash?

Love to get a reaction. Thank you.

greeting,
Erwin

2

You have to go to Management > Index pattern and create a rollup index pattern first - it's very easy to miss that part:

Using the information from the example rollup configuration, you can use rollup_logstash to match the rolled up index pattern, and kibana_sample_data_logs to match the index pattern for raw data. The notation for a combination index pattern with both raw and rolled up data is rollup_logstash,kibana_sample_data_logs .

Thanks for making us aware of the issue in the docs.

3

Hi Joe,

Thank you for the extra information. I created a new index (rollup_logstash), deleted the created rollup job and created a new rollup job, with a new ID and rollup index named rollup_logstash. I activated this rollup job.
However I am still unable to create a visualization as mentioned in the documentation: " Using the information from the example rollup configuration, you can use rollup_logstash to match the rolled up index pattern, and kibana_sample_data_logs to match the index pattern for raw data. The notation for a combination index pattern with both raw and rolled up data is rollup_logstash,kibana_sample_data_logs .", because I am unable to select the index rollup_logstash. I only have the indexe kibana_sample_data_logs available to me.

Is there anything else I am missing?

4

An index pattern in Kibana is an additional meta information, it's not the index in Elasticsearch itself: https://www.elastic.co/guide/en/kibana/current/index-patterns.html When the actual data is there in the index, you have to additionally create it.

5

Thanks Joe, that works perfectly.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.