Time based index pattern + wildcard

Elastic Stack Kibana
1

Hej,

I have multiple indices defined:

logstash-1-day-2015.07.20
logstash-2-day-2015.07.20
logstash-1-day-2015.07.21
logstash-2-day-2015.07.21

Now I wonder how to set up a timebased index pattern in Kibana. I already tried the following without luck:

[logstash-*-day-]YYYY.MM.DD
[logstash-]*[-day-]YYYY.MM.DD

Sadly https://www.elastic.co/guide/en/kibana/current/settings.html doesn't cover this case.

Hope someone can help.

Thanks

2

I do not think wildcards are allowed in these type of patterns. If you want to query across several different time based indices, you could create an alias for each set of filters, e.g. 'alias-2015.07.20' and associate this with both 'logstash-1-day-2015.07.20' and 'logstash-2-day-2015.07.20'. You would need to manage the links between aliases and indices, but you should be able to use the alias with the date pattern in Kibana.

3

Does anyone know if this, or at least the ability to query multiple indices from Kibana4 is on the roadmap?

A similar question was asked here: Search multiple indices in Kibana 4?

4

Yes, this is on the roadmap: https://github.com/elastic/kibana/issues/2017