mirror of
https://github.com/elastic/kibana.git
synced 2025-04-23 17:28:26 -04:00
* [user docs - index patterns] index pattern => data view (#110421)
This commit is contained in:
parent
87c7289b74
commit
e53771df2d
13 changed files with 63 additions and 58 deletions
|
@ -1,45 +1,45 @@
|
|||
[[index-patterns]]
|
||||
=== Create an index pattern
|
||||
[[data-views]]
|
||||
=== Create a data view
|
||||
|
||||
{kib} requires an index pattern to access the {es} data that you want to explore.
|
||||
An index pattern selects the data to use and allows you to define properties of the fields.
|
||||
{kib} requires a data view to access the {es} data that you want to explore.
|
||||
A data view selects the data to use and allows you to define properties of the fields.
|
||||
|
||||
An index pattern can point to one or more indices, {ref}/data-streams.html[data stream], or {ref}/alias.html[index aliases].
|
||||
For example, an index pattern can point to your log data from yesterday,
|
||||
A data view can point to one or more indices, {ref}/data-streams.html[data stream], or {ref}/alias.html[index aliases].
|
||||
For example, a data view can point to your log data from yesterday,
|
||||
or all indices that contain your data.
|
||||
|
||||
[float]
|
||||
[[index-patterns-read-only-access]]
|
||||
[[data-views-read-only-access]]
|
||||
=== Required permissions
|
||||
|
||||
* Access to *Index Patterns* requires the <<xpack-kibana-role-management, {kib} privilege>>
|
||||
`Index Pattern Management`.
|
||||
* Access to *Data Views* requires the <<xpack-kibana-role-management, {kib} privilege>>
|
||||
`Data View Management`.
|
||||
|
||||
* To create an index pattern, you must have the <<xpack-kibana-role-management,{es} privilege>>
|
||||
* To create a data view, you must have the <<xpack-kibana-role-management,{es} privilege>>
|
||||
`view_index_metadata`.
|
||||
|
||||
* If a read-only indicator appears in {kib}, you have insufficient privileges
|
||||
to create or save index patterns. The buttons to create new index patterns or
|
||||
save existing index patterns are not visible. For more information,
|
||||
to create or save data views. The buttons to create new data views or
|
||||
save existing data views are not visible. For more information,
|
||||
refer to <<xpack-security-authorization,Granting access to {kib}>>.
|
||||
|
||||
[float]
|
||||
[[settings-create-pattern]]
|
||||
=== Create an index pattern
|
||||
=== Create a data view
|
||||
|
||||
If you collected data using one of the {kib} <<connect-to-elasticsearch,ingest options>>,
|
||||
uploaded a file, or added sample data,
|
||||
you get an index pattern for free, and can start exploring your data.
|
||||
If you loaded your own data, follow these steps to create an index pattern.
|
||||
you get a data view for free, and can start exploring your data.
|
||||
If you loaded your own data, follow these steps to create a data view.
|
||||
|
||||
. Open the main menu, then click to *Stack Management > Index Patterns*.
|
||||
. Open the main menu, then click to *Stack Management > Data Views*.
|
||||
|
||||
. Click *Create data view*.
|
||||
|
||||
. Click *Create index pattern*.
|
||||
+
|
||||
[role="screenshot"]
|
||||
image:management/index-patterns/images/create-index-pattern.png["Create index pattern"]
|
||||
image:management/index-patterns/images/create-index-pattern.png["Create data view"]
|
||||
|
||||
. Start typing in the *Index pattern* field, and {kib} looks for the names of
|
||||
. Start typing in the *name* field, and {kib} looks for the names of
|
||||
indices, data streams, and aliases that match your input.
|
||||
+
|
||||
** To match multiple sources, use a wildcard (*). For example, `filebeat-*` matches
|
||||
|
@ -61,21 +61,21 @@ global time filters on your dashboards. This is useful if
|
|||
you have multiple time fields and want to create dashboards that combine visualizations
|
||||
based on different timestamps.
|
||||
|
||||
. Click *Create index pattern*.
|
||||
. Click *Create data view*.
|
||||
+
|
||||
[[reload-fields]] {kib} is now configured to use your {es} data. When a new field is added to an index,
|
||||
the index pattern field list is updated
|
||||
the next time the index pattern is loaded, for example, when you load the page or
|
||||
the data view field list is updated
|
||||
the next time the data view is loaded, for example, when you load the page or
|
||||
move between {kib} apps.
|
||||
|
||||
. Select this index pattern when you search and visualize your data.
|
||||
. Select this data view when you search and visualize your data.
|
||||
|
||||
[float]
|
||||
[[rollup-index-pattern]]
|
||||
==== Create an index pattern for rolled up data
|
||||
[[rollup-data-view]]
|
||||
==== Create a data view for rolled up data
|
||||
|
||||
An index pattern can match one rollup index. For a combination rollup
|
||||
index pattern with both raw and rolled up data, use the standard notation:
|
||||
A data view can match one rollup index. For a combination rollup
|
||||
data view with both raw and rolled up data, use the standard notation:
|
||||
|
||||
```ts
|
||||
rollup_logstash,kibana_sample_data_logs
|
||||
|
@ -84,7 +84,7 @@ For an example, refer to <<rollup-data-tutorial,Create and visualize rolled up d
|
|||
|
||||
[float]
|
||||
[[management-cross-cluster-search]]
|
||||
==== Create an index pattern that searches across clusters
|
||||
==== Create a data view that searches across clusters
|
||||
|
||||
If your {es} clusters are configured for {ref}/modules-cross-cluster-search.html[{ccs}],
|
||||
you can create an index pattern to search across the clusters of your choosing. Use the
|
||||
|
@ -129,20 +129,20 @@ To exclude a cluster having a name starting with `cluster_`:
|
|||
`cluster_*:logstash-*,cluster_one:-*`
|
||||
```
|
||||
|
||||
Once you configure an index pattern to use the {ccs} syntax, all searches and
|
||||
aggregations using that index pattern in {kib} take advantage of {ccs}.
|
||||
Once you configure a data view to use the {ccs} syntax, all searches and
|
||||
aggregations using that data view in {kib} take advantage of {ccs}.
|
||||
|
||||
[float]
|
||||
[[delete-index-pattern]]
|
||||
=== Delete index patterns
|
||||
[[delete-data-view]]
|
||||
=== Delete data views
|
||||
|
||||
When you delete an index pattern, you cannot recover the associated field formatters, runtime fields, source filters,
|
||||
and field popularity data. Deleting an index pattern does not remove any indices or data documents from {es}.
|
||||
When you delete a data view, you cannot recover the associated field formatters, runtime fields, source filters,
|
||||
and field popularity data. Deleting a data view does not remove any indices or data documents from {es}.
|
||||
|
||||
WARNING: Deleting an index pattern breaks all visualizations, saved searches, and other saved objects that reference the index pattern.
|
||||
WARNING: Deleting a data view breaks all visualizations, saved searches, and other saved objects that reference the data view.
|
||||
|
||||
. Open the main menu, then click *Stack Management > Index Patterns*.
|
||||
. Open the main menu, then click *Stack Management > Data Views*.
|
||||
|
||||
. Click the index pattern to delete.
|
||||
. Click the data view to delete.
|
||||
|
||||
. Delete (image:management/index-patterns/images/delete.png[Delete icon]) the index pattern.
|
||||
. Delete (image:management/index-patterns/images/delete.png[Delete icon]) the data view.
|
|
@ -35,19 +35,19 @@ Open the search bar using the keyboard shortcut Ctrl+/ on Windows and Linux, Com
|
|||
image:concepts/images/global-search.png["Global search showing matches to apps and saved objects for the word visualize"]
|
||||
|
||||
[float]
|
||||
=== Accessing data with index patterns
|
||||
=== Accessing data with data views
|
||||
|
||||
{kib} requires an index pattern to tell it which {es} data you want to access,
|
||||
and whether the data is time-based. An index pattern can point to one or more {es}
|
||||
{kib} requires a data view to tell it which {es} data you want to access,
|
||||
and whether the data is time-based. A data view can point to one or more {es}
|
||||
data streams, indices, or index aliases by name.
|
||||
For example, `logs-elasticsearch-prod-*` is an index pattern,
|
||||
and it is time-based with a time field of `@timestamp`. The time field is not editable.
|
||||
|
||||
Index patterns are typically created by an administrator when sending data to {es}.
|
||||
You can <<index-patterns,create or update index patterns>> in *Stack Management*, or by using a script
|
||||
Data views are typically created by an administrator when sending data to {es}.
|
||||
You can <<data-views,create or update data views>> in *Stack Management*, or by using a script
|
||||
that accesses the {kib} API.
|
||||
|
||||
{kib} uses the index pattern to show you a list of fields, such as
|
||||
{kib} uses the data view to show you a list of fields, such as
|
||||
`event.duration`. You can customize the display name and format for each field.
|
||||
For example, you can tell {kib} to display `event.duration` in seconds.
|
||||
{kib} has <<managing-fields,field formatters>> for strings,
|
||||
|
@ -75,7 +75,7 @@ and can optionally contain the time filter and extra filters.
|
|||
==== Time filter
|
||||
|
||||
The <<set-time-filter, global time filter>> limits the time range of data displayed.
|
||||
In most cases, the time filter applies to the time field in the index pattern,
|
||||
In most cases, the time filter applies to the time field in the data view,
|
||||
but some apps allow you to use a different time field.
|
||||
|
||||
Using the time filter, you can configure a refresh rate to periodically
|
||||
|
@ -159,7 +159,7 @@ Use the global search to quickly open a saved object.
|
|||
* Go to <<discover, Discover>> for instructions on searching your data.
|
||||
|
||||
|
||||
include::index-patterns.asciidoc[]
|
||||
include::data-views.asciidoc[]
|
||||
|
||||
include::set-time-filter.asciidoc[]
|
||||
|
||||
|
|
|
@ -2,7 +2,7 @@
|
|||
=== Set the time range
|
||||
Display data within a
|
||||
specified time range when your index contains time-based events, and a time-field is configured for the
|
||||
selected <<index-patterns, index pattern>>.
|
||||
selected <<data-views, data view>>.
|
||||
The default time range is 15 minutes, but you can customize
|
||||
it in <<advanced-options,Advanced Settings>>.
|
||||
|
||||
|
|
|
@ -3,7 +3,7 @@
|
|||
|
||||
You can search your data in any app that has a query bar, or by clicking on
|
||||
elements in a visualization. A search matches indices in the current
|
||||
<<index-patterns, index pattern>> and in the current <<set-time-filter,time frame>>.
|
||||
<<data-views, data view>> and in the current <<set-time-filter,time frame>>.
|
||||
|
||||
|
||||
[float]
|
||||
|
|
|
@ -43,7 +43,7 @@ To prevent the global search from applying to a layer, configure the following:
|
|||
[[maps-narrow-layer-by-global-time]]
|
||||
==== Narrow layers by global time
|
||||
|
||||
Layers that request data from {es} using an <<index-patterns, index pattern>> with a configured time field are narrowed by the <<set-time-filter, global time>>.
|
||||
Layers that request data from {es} using a <<data-views, data view>> with a configured time field are narrowed by the <<set-time-filter, global time>>.
|
||||
These layers contain the clock icon image:maps/images/clock_icon.png[clock icon] next to the layer name in the legend.
|
||||
|
||||
Use the time slider to quickly select time slices within the global time range:
|
||||
|
|
|
@ -358,3 +358,8 @@ This content has moved. Refer to <<xpack-profiler>>.
|
|||
== Rendering pre-captured profiler JSON
|
||||
|
||||
This content has moved. Refer to <<xpack-profiler>>.
|
||||
|
||||
[role="exclude",id="index-patterns"]
|
||||
== Index patterns has been renamed to data views.
|
||||
|
||||
This content has moved. Refer to <<data-views>>.
|
||||
|
|
|
@ -84,7 +84,7 @@ You can manage your roles, privileges, and spaces in **{stack-manage-app}** in
|
|||
If the {kib} ingest options don't work for you, you can index your
|
||||
data into Elasticsearch with {ref}/getting-started-index.html[REST APIs]
|
||||
or https://www.elastic.co/guide/en/elasticsearch/client/index.html[client libraries].
|
||||
After you add your data, you're required to create an <<index-patterns,index pattern>> to tell
|
||||
After you add your data, you're required to create a <<data-views,data view>> to tell
|
||||
{kib} where to find the data.
|
||||
|
||||
* To add data for Elastic Observability, refer to {observability-guide}/add-observability-data.html[Send data to Elasticsearch].
|
||||
|
|
|
@ -43,7 +43,7 @@ To create workpads, you must meet the minimum requirements.
|
|||
|
||||
* If you need to set up {kib}, use https://www.elastic.co/cloud/elasticsearch-service/signup?baymax=docs-body&elektra=docs[our free trial].
|
||||
|
||||
* Make sure you have {ref}/getting-started-index.html[data indexed into {es}] and an <<index-patterns,index pattern>>.
|
||||
* Make sure you have {ref}/getting-started-index.html[data indexed into {es}] and a <<data-views, data view>>.
|
||||
|
||||
* Have an understanding of {ref}/documents-indices.html[{es} documents and indices].
|
||||
|
||||
|
|
|
@ -5,7 +5,7 @@
|
|||
--
|
||||
**_Visualize your data with dashboards._**
|
||||
|
||||
The best way to understand your data is to visualize it. With dashboards, you can turn your data from one or more <<index-patterns, index patterns>> into a collection of panels
|
||||
The best way to understand your data is to visualize it. With dashboards, you can turn your data from one or more <<data-views, data views>> into a collection of panels
|
||||
that bring clarity to your data, tell a story about your data, and allow you to focus on only the data that's important to you.
|
||||
|
||||
[role="screenshot"]
|
||||
|
@ -53,7 +53,7 @@ To create dashboards, you must meet the minimum requirements.
|
|||
|
||||
* If you need to set up {kib}, use https://www.elastic.co/cloud/elasticsearch-service/signup?baymax=docs-body&elektra=docs[our free trial].
|
||||
|
||||
* Make sure you have {ref}/getting-started-index.html[data indexed into {es}] and an <<index-patterns,index pattern>>.
|
||||
* Make sure you have {ref}/getting-started-index.html[data indexed into {es}] and a <<data-views, data view>>.
|
||||
|
||||
* When the read-only indicator appears, you have insufficient privileges
|
||||
to create or save dashboards, and the options to create and save dashboards are not visible. For more information,
|
||||
|
|
|
@ -33,7 +33,7 @@ Open *Lens*, then make sure the correct fields appear.
|
|||
|
||||
. Make sure the *kibana_sample_data_ecommerce* index appears.
|
||||
+
|
||||
If you are using your own data, select the <<index-patterns, index pattern>> that contains your data.
|
||||
If you are using your own data, select the <<data-views, data view>> that contains your data.
|
||||
|
||||
[discrete]
|
||||
[[custom-time-interval]]
|
||||
|
|
|
@ -8,7 +8,7 @@ With *TSVB*, you can:
|
|||
* Combine an infinite number of <<aggregation-reference,aggregations>> to display your data.
|
||||
* Annotate time series data with timestamped events from an {es} index.
|
||||
* View the data in several types of visualizations, including charts, data tables, and markdown panels.
|
||||
* Display multiple <<index-patterns, index patterns>> in each visualization.
|
||||
* Display multiple <<data-views, data views>> in each visualization.
|
||||
* Use custom functions and some math on aggregations.
|
||||
* Customize the data with labels and colors.
|
||||
|
||||
|
|
|
@ -64,7 +64,7 @@ Tell {kib} where to find the data you want to explore, and then specify the time
|
|||
|
||||
. Select the data you want to work with.
|
||||
+
|
||||
{kib} uses an <<index-patterns,index pattern>> to tell it where to find
|
||||
{kib} uses a <<data-views, data view>> to tell it where to find
|
||||
your {es} data.
|
||||
To view the ecommerce sample data, make sure the index pattern is set to **kibana_sample_data_ecommerce**.
|
||||
+
|
||||
|
|
|
@ -3,7 +3,7 @@
|
|||
== Create a graph
|
||||
|
||||
You must index data into {es} before you can create a graph.
|
||||
<<index-patterns, Learn how>> or get started with a <<add-sample-data, sample data set>>.
|
||||
<<data-views, Learn how>> or get started with a <<add-sample-data, sample data set>>.
|
||||
|
||||
[float]
|
||||
[[exploring-connections]]
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue