I want to make a pie chart where I count data from the field "indices". I want to exclude all indices which start with a "." like ".kibana" ."monitoring-asdf-" and so on.
How do I have to write it in the exclude part?
"." does not work. .* without the " also does not work.
What index pattern did you select when you went to create your visualization? What index pattern is this "indices" field on? Your index pattern probably naturally excludes the
.* indices, unless you are using just
* as your index pattern?
My index pattern is called "ror-*". In this index, there is a field called "indices" where entries with all indices in the ELK cluster are stored. So I have e.g. entries with logstash-xx.xx.xx ans also have entries with indices called .kibana. As all indices with a . are internal indices, they are not interesting for my visualization, so I want to exlcude them
Ahhh, I see now. You can use a filter, or a query.
For example, all results:
But if you search for
NOT index.keyword:.*, it'll filter out the .* indexes:
Does that help?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.