We have two timestamps in our document, during the index pattern creation we can only choose one timestamp for each index pattern, and that timestamp will affect the Kibana's Discover graph and the upper right corner time filter of all the visualizations created with the time filter is base on the time filter that we set at the index pattern.
I would like to know is there a way to interchange the default timestamp easily on the index filter, without resetting the index pattern itself.
I am also thinking maybe it is possible to create two index pattern, one index pattern with timestamp1 , the second index pattern with the timestamp2, on the same index. But I am not able to find a way to create two index patterns for the same index. Just wondering is this supported?
Any suggestions would be really appreciated! Thanks!
It's not supported well right now, but there's a workaround. Let's say your data is stored in indices like this: my-data-01-2021, my-data-02-2021, my-data-03-2021, ...
Then you can create one index pattern my-data* and another one my-dat* - it's different patterns, so you can assign different default time fields, but they are matching the same set of actual data indices.
I would like to know if my index call prefix_groupid_metadata_202001, can I have the index pattern name call prefix_groupid_metadata_startedTime1 and another index pattern call prefix_groupid_metadata_modifiedTime, to me it seems like in ES the index pattern name must matched part of the exact index name, I am not able to put other name.
Besides, I tried the way recommended by you, but I got error message below. Right now we have a created index pattern with the format like this prefix--metadata- with a date field as time filter, and I tried to add a new index pattern with another date field as time filter with the name below, prefix--metadat-* , but I got the error message below.
For now the index pattern has to match the actual index names, so it's not possible to put descriptions in there. We are working on being able to give a free name to index patterns independent of the actual underlying pattern though.
The error message seems to be caused by missing permissions, make sure your user is allowed to access the indices matching the pattern.
I have these two roles [admin], [superuser]. And you can see the privilege of superuser role in the screenshot below. I don't think it is privilege issue, just wonderin do you think is there any other reason to cause the "xError Forbidden" error that I mentioned previously?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
