Wildcard index pattern matching non-system indices, 7.10.2 edition

Allegedly in Kibana 7.10.2 this pattern is supposed to match only user indices:

but it's definitely picking up fields from system indices:

Is this supposed to work now in 7+ or do we need to keep using this workaround?

Hi Michael. Using the index alias is one way to resolve this. But you can also create a new index pattern and specify multiple patterns separated by commas (e.g. metricbeat-,auditbeat-).

That would work OK if all the names are known in advance.

The frustrating thing about this is that Kibana has this option:
which just doesn't seem to be functional.

Hi Michael,

Today I learned something new. We can ignore indices using a minus sign. System indices are prefixed with a .. So we should be able to ignore those indices using an index pattern like this: *,-.*.

But this workaround shouldn't be necessary since those are system/hidden indices?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.