11[[index-patterns]]
2- == Index patterns
2+ == Creating an index pattern
33
4- To visualize and explore data in {kib}, you must create an index pattern.
5- An index pattern tells {kib} which {es} indices contain the data that you want to work with.
6- An index pattern can match a single index, multiple indices, and a rollup index.
4+ To explore and visualize data in {kib}, you must create an index pattern.
5+ An index pattern tells {kib} which {es} indices contain the data that
6+ you want to work with.
7+ Once you create an index pattern, you're ready to:
8+
9+ * Interactively explore your data in <<discover, Discover>>.
10+ * Analyze your data in charts, tables, gauges, tag clouds, and more in <<visualize, Visualize>>.
11+ * Show off your data in a <<canvas, Canvas>> workpad.
12+ * If your data includes geo data, visualize it with <<maps, Maps>>.
713
814[float]
915[[index-patterns-read-only-access]]
1016=== [xpack]#Read-only access#
11- If you have insufficient privileges to create or save index patterns, a read-only
17+ If you have insufficient privileges to create or save index patterns, a read-only
1218indicator appears in Kibana. The buttons to create new index patterns or save
13- existing index patterns are not visible. For more information on granting access to
14- Kibana see <<xpack-security-authorization>>.
19+ existing index patterns are not visible. For more information, see <<xpack-security-authorization>>.
1520
1621[role="screenshot"]
1722image::images/management-index-read-only-badge.png[Example of Index Pattern Management's read only access indicator in Kibana's header]
@@ -20,96 +25,103 @@ image::images/management-index-read-only-badge.png[Example of Index Pattern Mana
2025[[settings-create-pattern]]
2126=== Create an index pattern
2227
23- To get started, go to *Management > Kibana > Index Patterns*. You begin with
24- an overview of your index patterns, including any that were added when you
25- downloaded sample data sets.
26-
27- You can create a standard index pattern, and if a rollup index is detected in the
28- cluster, a rollup index pattern.
28+ If you are in an app that requires an index pattern, and you don't have one yet,
29+ {kib} prompts you to create one. Or, you can go directly to
30+ *Management > Kibana > Index Patterns*.
2931
3032[role="screenshot"]
3133image:management/index-patterns/images/rollup-index-pattern.png["Menu with rollup index pattern"]
3234
3335[float]
3436==== Standard index pattern
3537
36- {kib} makes it easy for you to create an index pattern by walking you through
37- the process. Just start typing in the *Index pattern* field, and {kib} looks for
38- the names of {es} indices that match your input. Make sure that the name of the
38+ Just start typing in the *Index pattern* field, and {kib} looks for
39+ the names of {es} indices that match your input. Make sure that the name of the
3940index pattern is unique.
40-
41- If you want to include system indices in your search, toggle the switch in the
42- upper right.
41+ To include system indices in your search, toggle the switch in the upper right.
4342
4443[role="screenshot"]
4544image:management/index-patterns/images/create-index-pattern.png["Create index pattern"]
4645
47- Your index pattern can match multiple {es} indices.
48- Use a comma to separate the names, with no space after the comma. The notation for
49- wildcards (`*`) and the ability to "exclude" (`-`) also apply
46+ Your index pattern can match multiple {es} indices.
47+ Use a comma to separate the names, with no space after the comma. The notation for
48+ wildcards (`*`) and the ability to "exclude" (`-`) also apply
5049(for example, `test*,-test3`).
5150
52- When {kib} detects an index with a timestamp, you’re asked to choose a field to
53- filter your data by time. If you don’t specify a field, you won’t be able
51+ If {kib} detects an index with a timestamp, you’re asked to choose a field to
52+ filter your data by time. If you don’t specify a field, you won’t be able
5453to use the time filter.
5554
56- Once you’ve created your index pattern, you can start working with
57- your {es} data in {kib}. Here are some things to try:
5855
59- * Interactively explore your data in <<discover, Discover>>.
60- * Present your data in charts, tables, gauges, tag clouds, and more in <<visualize, Visualize>>.
61- * Show off your data in a <<canvas, Canvas>> presentation.
62- * If your data includes geo data, visualize it using <<maps, Maps>>.
63-
64- For a walkthrough of creating an index pattern and visualizing the data,
65- see <<getting-started, Getting Started>>.
6656
6757[float]
6858==== Rollup index pattern
6959
70- If a rollup index is detected in the cluster, clicking *Create index pattern*
71- includes an item for creating a rollup index pattern. You create an
72- index pattern for rolled up data the same way you do for any data.
60+ If a rollup index is detected in the cluster, clicking *Create index pattern*
61+ includes an item for creating a rollup index pattern.
62+ You can match an index pattern to only rolled up data, or mix both rolled
63+ up and raw data to explore and visualize all data together.
64+ An index pattern can match
65+ only one rollup index.
66+
67+ [float]
68+ [[management-cross-cluster-search]]
69+ ==== {ccs-cap} index pattern
70+
71+ If your {es} clusters are configured for {ref}/modules-cross-cluster-search.html[{ccs}], you can create
72+ index patterns to search across the clusters of your choosing. Using the
73+ same syntax that you'd use in a raw {ccs} request in {es}, create your
74+ index pattern with the convention `<cluster-names>:<pattern>`.
75+
76+ For example, to query {ls} indices across two {es} clusters
77+ that you set up for {ccs}, which are named `cluster_one` and `cluster_two`,
78+ you would use `cluster_one:logstash-*,cluster_two:logstash-*` as your index pattern.
79+
80+ You can use wildcards in your cluster names
81+ to match any number of clusters, so if you want to search {ls} indices across
82+ clusters named `cluster_foo`, `cluster_bar`, and so on, you would use `cluster_*:logstash-*`
83+ as your index pattern.
7384
74- You can match an index pattern to only rolled up data, or mix both rolled
75- up and raw data to visualize all data together. An index pattern can match
76- only one rollup index, not multiple. There is no restriction on the
77- number of standard indices that an index pattern can match.
85+ To query across all {es} clusters that have been configured for {ccs},
86+ use a standalone wildcard for your cluster name in your index
87+ pattern: `*:logstash-*`.
7888
79- See <<visualize-rollup-data, Creating a visualization using rolled up data>>
80- for more detailed information .
89+ Once an index pattern is configured using the {ccs} syntax, all searches and
90+ aggregations using that index pattern in {kib} take advantage of {ccs} .
8191
8292[float]
8393=== Manage your index pattern
8494
85- Once you’ve created an index pattern, you’re presented a table of all fields
86- and associated data types in the index.
95+ Once you create an index pattern, manually or with a sample data set,
96+ you can look at its fields and associated data types.
97+ You can also perform housekeeping tasks, such as making the
98+ index pattern the default or deleting it when you longer need it.
99+ To drill down into the details of an index pattern, click its name in
100+ the *Index patterns* overview.
87101
88102[role="screenshot"]
89103image:management/index-patterns/images/new-index-pattern.png["Index files and data types"]
90104
91- You can perform the following actions:
105+ From the detailed view, you can perform the following actions:
92106
93- * *Manage the index fields.* Click a column header to sort the table by that column.
94- Use the field dropdown menu to limit to display to a specific field.
95- See <<managing-fields, Managing fields>> for more detailed information.
107+ * *Manage the index fields.* You can add formatters to format values and create
108+ scripted fields.
109+ See <<managing-fields, Managing fields>> for more information.
96110
97- * [[set-default-pattern]]*Set the default index pattern.* {kib} uses a badge to make users
98- aware of which index pattern is the default. The first pattern
99- you create is automatically designated as the default pattern. The default
100- index pattern is loaded when you view the Discover tab.
111+ * [[set-default-pattern]]*Set the default index pattern.* {kib} uses a badge to make users
112+ aware of which index pattern is the default. The first pattern
113+ you create is automatically designated as the default pattern. The default
114+ index pattern is loaded when you open * Discover*.
101115
102- * [[reload-fields]]*Reload the index fields list.* You can reload the index fields list to
103- pick up any newly-added fields. Doing so also resets Kibana’s popularity counters
104- for the fields. The popularity counters keep track of the fields
105- you’ve used most often in {kib} and are used to sort fields in lists.
116+ * [[reload-fields]]*Refresh the index fields list.* You can refresh the index fields list to
117+ pick up any newly-added fields. Doing so also resets Kibana’s popularity counters
118+ for the fields. The popularity counters are used in *Discover* to sort fields in lists.
106119
107- * [[delete-pattern]]*Delete the index pattern.* This action removes the pattern from the list of
108- Saved Objects in {kib}. You will not be able to recover field formatters,
120+ * [[delete-pattern]]*Delete the index pattern.* This action removes the pattern from the list of
121+ Saved Objects in {kib}. You will not be able to recover field formatters,
109122scripted fields, source filters, and field popularity data associated with the index pattern.
110- +
111- Deleting an index pattern breaks all visualizations, saved searches, and
112- other saved objects that reference the pattern. Deleting an index pattern does
123+ Deleting an index pattern does
113124not remove any indices or data documents from {es}.
114-
115- include::index-patterns/management-cross-cluster-search.asciidoc[]
125+ +
126+ WARNING: Deleting an index pattern breaks all visualizations, saved searches, and
127+ other saved objects that reference the pattern.
0 commit comments