Allegedly in Kibana 7.10.2 this pattern is supposed to match only user indices:
but it's definitely picking up fields from system indices:
Is this supposed to work now in 7+ or do we need to keep using this workaround?
Hi Michael. Using the index alias is one way to resolve this. But you can also create a new index pattern and specify multiple patterns separated by commas (e.g. metricbeat-,auditbeat-).
That would work OK if all the names are known in advance.
The frustrating thing about this is that Kibana has this option:
which just doesn't seem to be functional.
Hi Michael,
Today I learned something new. We can ignore indices using a minus sign. System indices are prefixed with a .. So we should be able to ignore those indices using an index pattern like this: *,-.*.
But this workaround shouldn't be necessary since those are system/hidden indices?
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.