[SOLVED] Can Kibana discover documents from an index alias name?

Elastic Stack Kibana
1

Hi,

I've an index named logstash-1480234219918 and an alias named logstash-current pointing to it.

The two URLs below return the same document:

Kibana 5 is setup with logstash-* index pattern.

I can retrieve documents when discovering with _index:logstash-1480234219918 query in the search bar, but no document can be fetched when discovering with _index:logstash-current query.

Can Kibana fetch documents from an alias name as an _index value?

Thanks,
Christophe

2

No, that won't work unfortunately. _index is a part of the document itself, so even if you query the alias you'll see that the _index meta field in each hit still refers to the concrete index.

3

Alright I understand, thank you Matt.

Is there any way to make Kibana read from the "latest" index?

4

You could create an index pattern that points specifically to the "logstash-current" alias. Would that work for you?

5

That could be a solution, yes. I'll try to do so, thank you Matt!

6

I have another question Matt: is possible to tell Kibana to discover on a particular index pattern?

7

If I understand the question correctly, yes you can toggle the index pattern in the top left corner of the Discover app:

8

You've totally understood the point, thank you Matt all your answers were very helpful. Our dashboard journey can start!