mirror of
https://github.com/elastic/kibana.git
synced 2025-04-23 17:28:26 -04:00
[DOCS] Renames index pattern in management and monitoring (#117939)
* [DOCS] Renames index pattern in management, monitoring, and graph * [DOCS] Renames index pattern on landing page * Updates URL in doc link service * Update docs/management/advanced-options.asciidoc Co-authored-by: Lisa Cawley <lcawley@elastic.co> * Update docs/user/monitoring/kibana-alerts.asciidoc Co-authored-by: Lisa Cawley <lcawley@elastic.co> Co-authored-by: lcawl <lcawley@elastic.co> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
This commit is contained in:
gchaps
GitHub
parent
6b81454795
commit
42168954b4
12 changed files with 90 additions and 85 deletions
|
|
@ -64,7 +64,7 @@
|
|||
</li>
|
||||
<li class="listitem">
|
||||
<a href="https://www.elastic.co/guide/en/kibana/current/index-patterns.html"
|
||||
>Create an index pattern</a
|
||||
>Create a data view</a
|
||||
>
|
||||
</li>
|
||||
<li class="listitem">
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
== Advanced Settings
|
||||
|
||||
*Advanced Settings* control the behavior of {kib}. For example, you can change the format used to display dates,
|
||||
specify the default index pattern, and set the precision for displayed decimal values.
|
||||
specify the default data view, and set the precision for displayed decimal values.
|
||||
|
||||
. Open the main menu, then click *Stack Management > Advanced Settings*.
|
||||
. Scroll or search for the setting.
|
||||
|
|
@ -134,10 +134,6 @@ value by the maximum number of aggregations in each visualization.
|
|||
[[history-limit]]`history:limit`::
|
||||
In fields that have history, such as query inputs, show this many recent values.
|
||||
|
||||
[[indexpattern-placeholder]]`indexPattern:placeholder`::
|
||||
The default placeholder value to use in
|
||||
*Management > Index Patterns > Create Index Pattern*.
|
||||
|
||||
[[metafields]]`metaFields`::
|
||||
Fields that exist outside of `_source`. Kibana merges these fields into the
|
||||
document when displaying it.
|
||||
|
|
@ -283,7 +279,7 @@ value is 5.
|
|||
[[context-tiebreakerfields]]`context:tieBreakerFields`::
|
||||
A comma-separated list of fields to use for breaking a tie between documents
|
||||
that have the same timestamp value. The first field that is present and sortable
|
||||
in the current index pattern is used.
|
||||
in the current data view is used.
|
||||
|
||||
[[defaultcolumns]]`defaultColumns`::
|
||||
The columns that appear by default on the *Discover* page. The default is
|
||||
|
|
@ -296,7 +292,7 @@ The number of rows to show in the *Discover* table.
|
|||
Specifies the maximum number of fields to show in the document column of the *Discover* table.
|
||||
|
||||
[[discover-modify-columns-on-switch]]`discover:modifyColumnsOnSwitch`::
|
||||
When enabled, removes the columns that are not in the new index pattern.
|
||||
When enabled, removes the columns that are not in the new data view.
|
||||
|
||||
[[discover-sample-size]]`discover:sampleSize`::
|
||||
Specifies the number of rows to display in the *Discover* table.
|
||||
|
|
@ -314,7 +310,7 @@ does not have an effect when loading a saved search.
|
|||
When enabled, displays multi-fields in the expanded document view.
|
||||
|
||||
[[discover-sort-defaultorder]]`discover:sort:defaultOrder`::
|
||||
The default sort direction for time-based index patterns.
|
||||
The default sort direction for time-based data views.
|
||||
|
||||
[[doctable-hidetimecolumn]]`doc_table:hideTimeColumn`::
|
||||
Hides the "Time" column in *Discover* and in all saved searches on dashboards.
|
||||
|
|
@ -391,8 +387,8 @@ A custom image to use in the footer of the PDF.
|
|||
==== Rollup
|
||||
|
||||
[horizontal]
|
||||
[[rollups-enableindexpatterns]]`rollups:enableIndexPatterns`::
|
||||
Enables the creation of index patterns that capture rollup indices, which in
|
||||
[[rollups-enabledataviews]]`rollups:enableDataViews`::
|
||||
Enables the creation of data views that capture rollup indices, which in
|
||||
turn enables visualizations based on rollup data. Refresh the page to apply the
|
||||
changes.
|
||||
|
||||
|
|
@ -408,7 +404,7 @@ to use when `courier:setRequestPreference` is set to "custom".
|
|||
[[courier-ignorefilteriffieldnotinindex]]`courier:ignoreFilterIfFieldNotInIndex`::
|
||||
Skips filters that apply to fields that don't exist in the index for a
|
||||
visualization. Useful when dashboards consist of visualizations from multiple
|
||||
index patterns.
|
||||
data views.
|
||||
|
||||
[[courier-maxconcurrentshardrequests]]`courier:maxConcurrentShardRequests`::
|
||||
Controls the {ref}/search-multi-search.html[max_concurrent_shard_requests]
|
||||
|
|
|
|||
Binary file not shown.
|
Before Width: | Height: | Size: 58 KiB |
|
|
@ -1,26 +1,29 @@
|
|||
[[managing-index-patterns]]
|
||||
== Manage index pattern data fields
|
||||
[[managing-data-views]]
|
||||
== Manage data views
|
||||
|
||||
To customize the data fields in your index pattern, you can add runtime fields to the existing documents, add scrited fields to compute data on the fly, and change how {kib} displays the data fields.
|
||||
To customize the data fields in your data view,
|
||||
you can add runtime fields to the existing documents,
|
||||
add scripted fields to compute data on the fly, and change how {kib} displays the data fields.
|
||||
|
||||
[float]
|
||||
[[runtime-fields]]
|
||||
=== Explore your data with runtime fields
|
||||
=== Explore your data with runtime fields
|
||||
|
||||
Runtime fields are fields that you add to documents after you've ingested your data, and are evaluated at query time. With runtime fields, you allow for a smaller index and faster ingest time so that you can use less resources and reduce your operating costs. You can use runtime fields anywhere index patterns are used, for example, you can explore runtime fields in *Discover* and create visualizations with runtime fields for your dashboard.
|
||||
Runtime fields are fields that you add to documents after you've ingested your data, and are evaluated at query time. With runtime fields, you allow for a smaller index and faster ingest time so that you can use less resources and reduce your operating costs.
|
||||
You can use runtime fields anywhere data views are used, for example, you can explore runtime fields in *Discover* and create visualizations with runtime fields for your dashboard.
|
||||
|
||||
With runtime fields, you can:
|
||||
|
||||
* Define fields for a specific use case without modifying the underlying schema.
|
||||
* Define fields for a specific use case without modifying the underlying schema.
|
||||
|
||||
* Override the returned values from index fields.
|
||||
|
||||
* Start working on your data without understanding the structure.
|
||||
* Start working on your data without understanding the structure.
|
||||
|
||||
* Add fields to existing documents without reindexing your data.
|
||||
* Add fields to existing documents without reindexing your data.
|
||||
|
||||
WARNING: Runtime fields can impact {kib} performance. When you run a query, {es} uses the fields you index first to shorten the response time.
|
||||
Index the fields that you commonly search for and filter on, such as `timestamp`, then use runtime fields to limit the number of fields {es} uses to calculate values.
|
||||
WARNING: Runtime fields can impact {kib} performance. When you run a query, {es} uses the fields you index first to shorten the response time.
|
||||
Index the fields that you commonly search for and filter on, such as `timestamp`, then use runtime fields to limit the number of fields {es} uses to calculate values.
|
||||
|
||||
For detailed information on how to use runtime fields with {es}, refer to {ref}/runtime.html[Runtime fields].
|
||||
|
||||
|
|
@ -28,17 +31,21 @@ For detailed information on how to use runtime fields with {es}, refer to {ref}/
|
|||
[[create-runtime-fields]]
|
||||
==== Add runtime fields
|
||||
|
||||
To add runtime fields to your index patterns, open the index pattern you want to change, then define the field values by emitting a single value using the {ref}/modules-scripting-painless.html[Painless scripting language]. You can also add runtime fields in <<add-field-in-discover,*Discover*>> and <<change-the-fields,*Lens*>>.
|
||||
To add runtime fields to your data views, open the data view you want to change,
|
||||
then define the field values by emitting a single value using
|
||||
the {ref}/modules-scripting-painless.html[Painless scripting language].
|
||||
You can also add runtime fields in <<add-field-in-discover,*Discover*>> and <<change-the-fields,*Lens*>>.
|
||||
|
||||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||||
. Open the main menu, then click *Stack Management > Data Views*.
|
||||
|
||||
. Select the index pattern you want to add the runtime field to, then click *Add field*.
|
||||
. Select the data view that you want to add the runtime field to, then click *Add field*.
|
||||
|
||||
. Enter the field *Name*, then select the *Type*.
|
||||
|
||||
. Select *Set custom label*, then enter the label you want to display where the index pattern is used, such as *Discover*.
|
||||
. Select *Set custom label*, then enter the label you want to display where the data view is used,
|
||||
such as *Discover*.
|
||||
|
||||
. Select *Set value*, then define the script. The script must match the *Type*, or the index pattern fails anywhere it is used.
|
||||
. Select *Set value*, then define the script. The script must match the *Type*, or the data view fails anywhere it is used.
|
||||
|
||||
. To help you define the script, use the *Preview*:
|
||||
|
||||
|
|
@ -46,7 +53,8 @@ To add runtime fields to your index patterns, open the index pattern you want to
|
|||
|
||||
* To filter the fields list, enter the keyword in *Filter fields*.
|
||||
|
||||
* To pin frequently used fields to the top of the list, hover over the field, then click image:images/stackManagement-indexPatterns-pinRuntimeField-7.15.png[Icon to pin field to the top of the list].
|
||||
* To pin frequently used fields to the top of the list, hover over the field,
|
||||
then click image:images/stackManagement-indexPatterns-pinRuntimeField-7.15.png[Icon to pin field to the top of the list].
|
||||
|
||||
. Click *Create field*.
|
||||
|
||||
|
|
@ -54,7 +62,7 @@ To add runtime fields to your index patterns, open the index pattern you want to
|
|||
[[runtime-field-examples]]
|
||||
==== Runtime field examples
|
||||
|
||||
Try the runtime field examples on your own using the <<gs-get-data-into-kibana,*Sample web logs*>> data index pattern.
|
||||
Try the runtime field examples on your own using the <<gs-get-data-into-kibana,*Sample web logs*>> data.
|
||||
|
||||
[float]
|
||||
[[simple-hello-world-example]]
|
||||
|
|
@ -110,7 +118,7 @@ if (source != null) {
|
|||
emit(source);
|
||||
return;
|
||||
}
|
||||
else {
|
||||
else {
|
||||
emit("None");
|
||||
}
|
||||
----
|
||||
|
|
@ -123,7 +131,7 @@ def source = doc['machine.os.keyword'].value;
|
|||
if (source != "") {
|
||||
emit(source);
|
||||
}
|
||||
else {
|
||||
else {
|
||||
emit("None");
|
||||
}
|
||||
----
|
||||
|
|
@ -132,15 +140,15 @@ else {
|
|||
[[manage-runtime-fields]]
|
||||
==== Manage runtime fields
|
||||
|
||||
Edit the settings for runtime fields, or remove runtime fields from index patterns.
|
||||
Edit the settings for runtime fields, or remove runtime fields from data views.
|
||||
|
||||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||||
. Open the main menu, then click *Stack Management > Data Views*.
|
||||
|
||||
. Select the index pattern that contains the runtime field you want to manage, then open the runtime field edit options or delete the runtime field.
|
||||
. Select the data view that contains the runtime field you want to manage, then open the runtime field edit options or delete the runtime field.
|
||||
|
||||
[float]
|
||||
[[scripted-fields]]
|
||||
=== Add scripted fields to index patterns
|
||||
=== Add scripted fields to data views
|
||||
|
||||
deprecated::[7.13,Use {ref}/runtime.html[runtime fields] instead of scripted fields. Runtime fields support Painless scripts and provide greater flexibility.]
|
||||
|
||||
|
|
@ -168,11 +176,11 @@ https://www.elastic.co/blog/using-painless-kibana-scripted-fields[Using Painless
|
|||
[[create-scripted-field]]
|
||||
==== Create scripted fields
|
||||
|
||||
Create and add scripted fields to your index patterns.
|
||||
Create and add scripted fields to your data views.
|
||||
|
||||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||||
. Open the main menu, then click *Stack Management > Data Views*.
|
||||
|
||||
. Select the index pattern you want to add a scripted field to.
|
||||
. Select the data view you want to add a scripted field to.
|
||||
|
||||
. Select the *Scripted fields* tab, then click *Add scripted field*.
|
||||
|
||||
|
|
@ -186,9 +194,9 @@ For more information about scripted fields in {es}, refer to {ref}/modules-scrip
|
|||
[[update-scripted-field]]
|
||||
==== Manage scripted fields
|
||||
|
||||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||||
. Open the main menu, then click *Stack Management > Data Views*.
|
||||
|
||||
. Select the index pattern that contains the scripted field you want to manage.
|
||||
. Select the data view that contains the scripted field you want to manage.
|
||||
|
||||
. Select the *Scripted fields* tab, then open the scripted field edit options or delete the scripted field.
|
||||
|
||||
|
|
@ -202,9 +210,9 @@ exceptions when you view the dynamically generated data.
|
|||
{kib} uses the same field types as {es}, however, some {es} field types are unsupported in {kib}.
|
||||
To customize how {kib} displays data fields, use the formatting options.
|
||||
|
||||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||||
. Open the main menu, then click *Stack Management > Data Views*.
|
||||
|
||||
. Click the index pattern that contains the field you want to change.
|
||||
. Click the data view that contains the field you want to change.
|
||||
|
||||
. Find the field, then open the edit options (image:management/index-patterns/images/edit_icon.png[Data field edit icon]).
|
||||
|
||||
|
|
@ -261,4 +269,4 @@ include::field-formatters/string-formatter.asciidoc[]
|
|||
|
||||
include::field-formatters/duration-formatter.asciidoc[]
|
||||
|
||||
include::field-formatters/color-formatter.asciidoc[]
|
||||
include::field-formatters/color-formatter.asciidoc[]
|
||||
|
|
@ -2,10 +2,10 @@
|
|||
== Saved Objects
|
||||
|
||||
The *Saved Objects* UI helps you keep track of and manage your saved objects. These objects
|
||||
store data for later use, including dashboards, visualizations, maps, index patterns,
|
||||
store data for later use, including dashboards, visualizations, maps, data views,
|
||||
Canvas workpads, and more.
|
||||
|
||||
To get started, open the main menu, then click *Stack Management > Saved Objects*.
|
||||
To get started, open the main menu, then click *Stack Management > Saved Objects*.
|
||||
|
||||
[role="screenshot"]
|
||||
image::images/management-saved-objects.png[Saved Objects]
|
||||
|
|
@ -85,7 +85,7 @@ You have two options for exporting saved objects.
|
|||
* Click *Export x objects*, and export objects by type.
|
||||
|
||||
This action creates an NDJSON with all your saved objects. By default, the NDJSON includes child objects that are related to the saved
|
||||
objects. Exported dashboards include their associated index patterns.
|
||||
objects. Exported dashboards include their associated data views.
|
||||
|
||||
NOTE: The <<savedObjects-maxImportExportSize, `savedObjects.maxImportExportSize`>> configuration setting
|
||||
limits the number of saved objects which may be exported.
|
||||
|
|
@ -120,7 +120,7 @@ If you access an object whose index has been deleted, you can:
|
|||
* Recreate the index so you can continue using the object.
|
||||
* Delete the object and recreate it using a different index.
|
||||
* Change the index name in the object's `reference` array to point to an existing
|
||||
index pattern. This is useful if the index you were working with has been renamed.
|
||||
data view. This is useful if the index you were working with has been renamed.
|
||||
|
||||
WARNING: Validation is not performed for object properties. Submitting an invalid
|
||||
change will render the object unusable. A more failsafe approach is to use
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ they are now maintained by {kib}.
|
|||
Numeral formatting patterns are used in multiple places in {kib}, including:
|
||||
|
||||
* <<advanced-options, Advanced settings>>
|
||||
* <<field-formatters-numeric, Index pattern formatters>>
|
||||
* <<field-formatters-numeric, Data view formatters>>
|
||||
* <<tsvb, *TSVB*>>
|
||||
* <<canvas, *Canvas*>>
|
||||
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
experimental::[]
|
||||
|
||||
A rollup job is a periodic task that aggregates data from indices specified
|
||||
by an index pattern, and then rolls it into a new index. Rollup indices are a good way to
|
||||
by a data view, and then rolls it into a new index. Rollup indices are a good way to
|
||||
compactly store months or years of historical
|
||||
data for use in visualizations and reports.
|
||||
|
||||
|
|
@ -33,9 +33,9 @@ the process. You fill in the name, data flow, and how often you want to roll
|
|||
up the data. Then you define a date histogram aggregation for the rollup job
|
||||
and optionally define terms, histogram, and metrics aggregations.
|
||||
|
||||
When defining the index pattern, you must enter a name that is different than
|
||||
When defining the data view, you must enter a name that is different than
|
||||
the output rollup index. Otherwise, the job
|
||||
will attempt to capture the data in the rollup index. For example, if your index pattern is `metricbeat-*`,
|
||||
will attempt to capture the data in the rollup index. For example, if your data view is `metricbeat-*`,
|
||||
you can name your rollup index `rollup-metricbeat`, but not `metricbeat-rollup`.
|
||||
|
||||
[role="screenshot"]
|
||||
|
|
@ -66,7 +66,7 @@ You can read more at {ref}/rollup-job-config.html[rollup job configuration].
|
|||
This example creates a rollup job to capture log data from sample web logs.
|
||||
Before you start, <<add-sample-data, add the web logs sample data set>>.
|
||||
|
||||
In this example, you want data that is older than 7 days in the target index pattern `kibana_sample_data_logs`
|
||||
In this example, you want data that is older than 7 days in the target data view `kibana_sample_data_logs`
|
||||
to roll up into the `rollup_logstash` index. You’ll bucket the
|
||||
rolled up data on an hourly basis, using 60m for the time bucket configuration.
|
||||
This allows for more granular queries, such as 2h and 12h.
|
||||
|
|
@ -85,7 +85,7 @@ As you walk through the *Create rollup job* UI, enter the data:
|
|||
|Name
|
||||
|`logs_job`
|
||||
|
||||
|Index pattern
|
||||
|Data view
|
||||
|`kibana_sample_data_logs`
|
||||
|
||||
|Rollup index name
|
||||
|
|
@ -139,27 +139,23 @@ rollup index, or you can remove or archive it using <<creating-index-lifecycle-p
|
|||
Your next step is to visualize your rolled up data in a vertical bar chart.
|
||||
Most visualizations support rolled up data, with the exception of Timelion and Vega visualizations.
|
||||
|
||||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||||
. Open the main menu, then click *Stack Management > Data Views*.
|
||||
|
||||
. Click *Create index pattern*, and select *Rollup index pattern* from the dropdown.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image::images/management-rollup-index-pattern.png[][Create rollup index pattern]
|
||||
. Click *Create data view*, and select *Rollup data view* from the dropdown.
|
||||
|
||||
. Enter *rollup_logstash,kibana_sample_logs* as your *Index Pattern* and `@timestamp`
|
||||
. Enter *rollup_logstash,kibana_sample_logs* as your *Data View* and `@timestamp`
|
||||
as the *Time Filter field name*.
|
||||
+
|
||||
The notation for a combination index pattern with both raw and rolled up data
|
||||
is `rollup_logstash,kibana_sample_data_logs`. In this index pattern, `rollup_logstash`
|
||||
matches the rolled up index pattern and `kibana_sample_data_logs` matches the index
|
||||
pattern for raw data.
|
||||
The notation for a combination data view with both raw and rolled up data
|
||||
is `rollup_logstash,kibana_sample_data_logs`. In this data view, `rollup_logstash`
|
||||
matches the rolled up data view and `kibana_sample_data_logs` matches the data view for raw data.
|
||||
|
||||
. Open the main menu, click *Dashboard*, then *Create dashboard*.
|
||||
|
||||
. Set the <<set-time-filter,time filter>> to *Last 90 days*.
|
||||
|
||||
. On the dashboard, click *Create visualization*.
|
||||
|
||||
|
||||
. Choose `rollup_logstash,kibana_sample_data_logs`
|
||||
as your source to see both the raw and rolled up data.
|
||||
+
|
||||
|
|
|
|||
|
|
@ -363,3 +363,8 @@ This content has moved. Refer to <<xpack-profiler>>.
|
|||
== Index patterns has been renamed to data views.
|
||||
|
||||
This content has moved. Refer to <<data-views>>.
|
||||
|
||||
[role="exclude",id="managing-index-patterns"]
|
||||
== Index patterns has been renamed to data views.
|
||||
|
||||
This content has moved. Refer to <<managing-data-views>>.
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ By default, both the configuration and data are saved for the workspace:
|
|||
|
||||
[horizontal]
|
||||
*configuration*::
|
||||
The selected index pattern, fields, colors, icons,
|
||||
The selected data view, fields, colors, icons,
|
||||
and settings.
|
||||
*data*::
|
||||
The visualized content (the vertices and connections displayed in
|
||||
|
|
|
|||
|
|
@ -4,7 +4,7 @@
|
|||
[partintro]
|
||||
--
|
||||
*Stack Management* is home to UIs for managing all things Elastic Stack—
|
||||
indices, clusters, licenses, UI settings, index patterns, spaces, and more.
|
||||
indices, clusters, licenses, UI settings, data views, spaces, and more.
|
||||
|
||||
|
||||
Access to individual features is governed by {es} and {kib} privileges.
|
||||
|
|
@ -128,12 +128,12 @@ Kerberos, PKI, OIDC, and SAML.
|
|||
[cols="50, 50"]
|
||||
|===
|
||||
|
||||
a| <<managing-index-patterns, Manage index pattern data fields>>
|
||||
|Manage the data fields in the index patterns that retrieve your data from {es}.
|
||||
a| <<data-views, Data Views>>
|
||||
|Manage the fields in the data views that retrieve your data from {es}.
|
||||
|
||||
| <<managing-saved-objects, Saved Objects>>
|
||||
| Copy, edit, delete, import, and export your saved objects.
|
||||
These include dashboards, visualizations, maps, index patterns, Canvas workpads, and more.
|
||||
These include dashboards, visualizations, maps, data views, Canvas workpads, and more.
|
||||
|
||||
| <<managing-tags, Tags>>
|
||||
|Create, manage, and assign tags to your saved objects.
|
||||
|
|
@ -183,7 +183,7 @@ include::{kib-repo-dir}/management/action-types.asciidoc[]
|
|||
|
||||
include::{kib-repo-dir}/management/managing-licenses.asciidoc[]
|
||||
|
||||
include::{kib-repo-dir}/management/manage-index-patterns.asciidoc[]
|
||||
include::{kib-repo-dir}/management/manage-data-views.asciidoc[]
|
||||
|
||||
include::{kib-repo-dir}/management/numeral.asciidoc[]
|
||||
|
||||
|
|
|
|||
|
|
@ -5,21 +5,21 @@
|
|||
The {stack} {monitor-features} provide
|
||||
<<alerting-getting-started,{kib} alerting rules>> out-of-the box to notify you
|
||||
of potential issues in the {stack}. These rules are preconfigured based on the
|
||||
best practices recommended by Elastic. However, you can tailor them to meet your
|
||||
best practices recommended by Elastic. However, you can tailor them to meet your
|
||||
specific needs.
|
||||
|
||||
[role="screenshot"]
|
||||
image::user/monitoring/images/monitoring-kibana-alerting-notification.png["{kib} alerting notifications in {stack-monitor-app}"]
|
||||
|
||||
When you open *{stack-monitor-app}* for the first time, you will be asked to acknowledge the creation of these default rules. They are initially configured to detect and notify on various
|
||||
When you open *{stack-monitor-app}* for the first time, you will be asked to acknowledge the creation of these default rules. They are initially configured to detect and notify on various
|
||||
conditions across your monitored clusters. You can view notifications for: *Cluster health*, *Resource utilization*, and *Errors and exceptions* for {es}
|
||||
in real time.
|
||||
|
||||
NOTE: The default {watcher} based "cluster alerts" for {stack-monitor-app} have
|
||||
been recreated as rules in {kib} {alert-features}. For this reason, the existing
|
||||
{watcher} email action
|
||||
NOTE: The default {watcher} based "cluster alerts" for {stack-monitor-app} have
|
||||
been recreated as rules in {kib} {alert-features}. For this reason, the existing
|
||||
{watcher} email action
|
||||
`monitoring.cluster_alerts.email_notifications.email_address` no longer works.
|
||||
The default action for all {stack-monitor-app} rules is to write to {kib} logs
|
||||
The default action for all {stack-monitor-app} rules is to write to {kib} logs
|
||||
and display a notification in the UI.
|
||||
|
||||
To review and modify existing *{stack-monitor-app}* rules, click *Enter setup mode* on the *Cluster overview* page.
|
||||
|
|
@ -47,21 +47,21 @@ checks on a schedule time of 1 minute with a re-notify interval of 1 day.
|
|||
|
||||
This rule checks for {es} nodes that use a high amount of JVM memory. By
|
||||
default, the condition is set at 85% or more averaged over the last 5 minutes.
|
||||
The default rule checks on a schedule time of 1 minute with a re-notify interval of 1 day.
|
||||
The default rule checks on a schedule time of 1 minute with a re-notify interval of 1 day.
|
||||
|
||||
[discrete]
|
||||
[[kibana-alerts-missing-monitoring-data]]
|
||||
== Missing monitoring data
|
||||
|
||||
This rule checks for {es} nodes that stop sending monitoring data. By default,
|
||||
This rule checks for {es} nodes that stop sending monitoring data. By default,
|
||||
the condition is set to missing for 15 minutes looking back 1 day. The default rule checks on a schedule
|
||||
time of 1 minute with a re-notify interval of 6 hours.
|
||||
time of 1 minute with a re-notify interval of 6 hours.
|
||||
|
||||
[discrete]
|
||||
[[kibana-alerts-thread-pool-rejections]]
|
||||
== Thread pool rejections (search/write)
|
||||
|
||||
This rule checks for {es} nodes that experience thread pool rejections. By
|
||||
This rule checks for {es} nodes that experience thread pool rejections. By
|
||||
default, the condition is set at 300 or more over the last 5 minutes. The default rule
|
||||
checks on a schedule time of 1 minute with a re-notify interval of 1 day. Thresholds can be set
|
||||
independently for `search` and `write` type rejections.
|
||||
|
|
@ -72,14 +72,14 @@ independently for `search` and `write` type rejections.
|
|||
|
||||
This rule checks for read exceptions on any of the replicated {es} clusters. The
|
||||
condition is met if 1 or more read exceptions are detected in the last hour. The
|
||||
default rule checks on a schedule time of 1 minute with a re-notify interval of 6 hours.
|
||||
default rule checks on a schedule time of 1 minute with a re-notify interval of 6 hours.
|
||||
|
||||
[discrete]
|
||||
[[kibana-alerts-large-shard-size]]
|
||||
== Large shard size
|
||||
|
||||
This rule checks for a large average shard size (across associated primaries) on
|
||||
any of the specified index patterns in an {es} cluster. The condition is met if
|
||||
any of the specified data views in an {es} cluster. The condition is met if
|
||||
an index's average shard size is 55gb or higher in the last 5 minutes. The default rule
|
||||
matches the pattern of `-.*` by running checks on a schedule time of 1 minute with a re-notify interval of 12 hours.
|
||||
|
||||
|
|
@ -124,8 +124,8 @@ valid for 30 days.
|
|||
== Alerts and rules
|
||||
[discrete]
|
||||
=== Create default rules
|
||||
This option can be used to create default rules in this kibana space. This is
|
||||
useful for scenarios when you didn't choose to create these default rules initially
|
||||
This option can be used to create default rules in this Kibana space. This is
|
||||
useful for scenarios when you didn't choose to create these default rules initially
|
||||
or anytime later if the rules were accidentally deleted.
|
||||
|
||||
NOTE: Some action types are subscription features, while others are free.
|
||||
|
|
|
|||
|
|
@ -158,7 +158,7 @@ export class DocLinksService {
|
|||
introduction: `${KIBANA_DOCS}index-patterns.html`,
|
||||
fieldFormattersNumber: `${KIBANA_DOCS}numeral.html`,
|
||||
fieldFormattersString: `${KIBANA_DOCS}field-formatters-string.html`,
|
||||
runtimeFields: `${KIBANA_DOCS}managing-index-patterns.html#runtime-fields`,
|
||||
runtimeFields: `${KIBANA_DOCS}managing-data-views.html#runtime-fields`,
|
||||
},
|
||||
addData: `${KIBANA_DOCS}connect-to-elasticsearch.html`,
|
||||
kibana: `${KIBANA_DOCS}index.html`,
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue