[SOLVED] Can Kibana discover documents from an index alias name?


I've an index named logstash-1480234219918 and an alias named logstash-current pointing to it.

The two URLs below return the same document:

Kibana 5 is setup with logstash-* index pattern.

I can retrieve documents when discovering with _index:logstash-1480234219918 query in the search bar, but no document can be fetched when discovering with _index:logstash-current query.

Can Kibana fetch documents from an alias name as an _index value?


No, that won't work unfortunately. _index is a part of the document itself, so even if you query the alias you'll see that the _index meta field in each hit still refers to the concrete index.

Alright I understand, thank you Matt.

Is there any way to make Kibana read from the "latest" index?

You could create an index pattern that points specifically to the "logstash-current" alias. Would that work for you?

That could be a solution, yes. I'll try to do so, thank you Matt!

I have another question Matt: is possible to tell Kibana to discover on a particular index pattern?

If I understand the question correctly, yes you can toggle the index pattern in the top left corner of the Discover app:

You've totally understood the point, thank you Matt all your answers were very helpful. Our dashboard journey can start!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.