Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DOCS] Moves index pattern doc to Discover #53347

Merged
merged 5 commits into from
Jan 7, 2020
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
134 changes: 73 additions & 61 deletions docs/management/index-patterns.asciidoc
Original file line number Diff line number Diff line change
@@ -1,17 +1,22 @@
[[index-patterns]]
== Index patterns
== Creating an index pattern

To visualize and explore data in {kib}, you must create an index pattern.
An index pattern tells {kib} which {es} indices contain the data that you want to work with.
An index pattern can match a single index, multiple indices, and a rollup index.
To explore and visualize data in {kib}, you must create an index pattern.
An index pattern tells {kib} which {es} indices contain the data that
you want to work with.
Once you create an index pattern, you're ready to:

* Interactively explore your data in <<discover, Discover>>.
* Present your data in charts, tables, gauges, tag clouds, and more in <<visualize, Visualize>>.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How about:

Interpret your data in charts, tables, and more in Visualize.

* Show off your data in a <<canvas, Canvas>> presentation.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

presentation > workpad

* If your data includes geo data, visualize it with <<maps, Maps>>.

[float]
[[index-patterns-read-only-access]]
=== [xpack]#Read-only access#
If you have insufficient privileges to create or save index patterns, a read-only
If you have insufficient privileges to create or save index patterns, a read-only
indicator appears in Kibana. The buttons to create new index patterns or save
existing index patterns are not visible. For more information on granting access to
Kibana see <<xpack-security-authorization>>.
existing index patterns are not visible. For more information, see <<xpack-security-authorization>>.

[role="screenshot"]
image::images/management-index-read-only-badge.png[Example of Index Pattern Management's read only access indicator in Kibana's header]
Expand All @@ -20,96 +25,103 @@ image::images/management-index-read-only-badge.png[Example of Index Pattern Mana
[[settings-create-pattern]]
=== Create an index pattern

To get started, go to *Management > Kibana > Index Patterns*. You begin with
an overview of your index patterns, including any that were added when you
downloaded sample data sets.

You can create a standard index pattern, and if a rollup index is detected in the
cluster, a rollup index pattern.
If you are in an app that requires an index pattern, and you don't have one yet,
{kib} prompts you to create one. Or, you can go directly to
*Management > Kibana > Index Patterns*.

[role="screenshot"]
image:management/index-patterns/images/rollup-index-pattern.png["Menu with rollup index pattern"]

[float]
==== Standard index pattern

{kib} makes it easy for you to create an index pattern by walking you through
the process. Just start typing in the *Index pattern* field, and {kib} looks for
the names of {es} indices that match your input. Make sure that the name of the
Just start typing in the *Index pattern* field, and {kib} looks for
the names of {es} indices that match your input. Make sure that the name of the
index pattern is unique.

If you want to include system indices in your search, toggle the switch in the
upper right.
To include system indices in your search, toggle the switch in the upper right.

[role="screenshot"]
image:management/index-patterns/images/create-index-pattern.png["Create index pattern"]

Your index pattern can match multiple {es} indices.
Use a comma to separate the names, with no space after the comma. The notation for
wildcards (`*`) and the ability to "exclude" (`-`) also apply
Your index pattern can match multiple {es} indices.
Use a comma to separate the names, with no space after the comma. The notation for
wildcards (`*`) and the ability to "exclude" (`-`) also apply
(for example, `test*,-test3`).

When {kib} detects an index with a timestamp, you’re asked to choose a field to
filter your data by time. If you don’t specify a field, you won’t be able
If {kib} detects an index with a timestamp, you’re asked to choose a field to
filter your data by time. If you don’t specify a field, you won’t be able
to use the time filter.

Once you’ve created your index pattern, you can start working with
your {es} data in {kib}. Here are some things to try:

* Interactively explore your data in <<discover, Discover>>.
* Present your data in charts, tables, gauges, tag clouds, and more in <<visualize, Visualize>>.
* Show off your data in a <<canvas, Canvas>> presentation.
* If your data includes geo data, visualize it using <<maps, Maps>>.

For a walkthrough of creating an index pattern and visualizing the data,
see <<getting-started, Getting Started>>.
[float]
==== Rollup index patterns

If a rollup index is detected in the cluster, clicking *Create index pattern*
includes an item for creating a rollup index pattern.
You can match an index pattern to only rolled up data, or mix both rolled
up and raw data to explore and visualize all data together.
An index pattern can match
only one rollup index.

[float]
==== Rollup index pattern
[[management-cross-cluster-search]]
==== {ccs-cap} index pattern

If a rollup index is detected in the cluster, clicking *Create index pattern*
includes an item for creating a rollup index pattern. You create an
index pattern for rolled up data the same way you do for any data.
If your {es} clusters are configured for {ref}/modules-cross-cluster-search.html[{ccs}], you can create
index patterns to search across the clusters of your choosing. Using the
same syntax that you'd use in a raw {ccs} request in {es}, create your
index pattern with the convention `<cluster-names>:<pattern>`.

You can match an index pattern to only rolled up data, or mix both rolled
up and raw data to visualize all data together. An index pattern can match
only one rollup index, not multiple. There is no restriction on the
number of standard indices that an index pattern can match.
For example, to query {ls} indices across two {es} clusters
that you set up for {ccs}, which are named `cluster_one` and `cluster_two`,
you would use `cluster_one:logstash-*,cluster_two:logstash-*` as your index pattern.

See <<visualize-rollup-data, Creating a visualization using rolled up data>>
for more detailed information.
You can use wildcards in your cluster names
to match any number of clusters, so if you want to search {ls} indices across
clusters named `cluster_foo`, `cluster_bar`, and so on, you would use `cluster_*:logstash-*`
as your index pattern.

To query across all {es} clusters that have been configured for {ccs},
use a standalone wildcard for your cluster name in your index
pattern: `*:logstash-*`.

Once an index pattern is configured using the {ccs} syntax, all searches and
aggregations using that index pattern in {kib} take advantage of {ccs}.

[float]
=== Manage your index pattern

Once you’ve created an index pattern, you’re presented a table of all fields
and associated data types in the index.
Once you create an index pattern, manually or with a sample data set,
you might want to look at its fields and associated data types
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Period after types

You might also want to perform housekeeping tasks, such as making the
index pattern the default or deleting it when you longer need it.
You can drill down into the details of an index pattern by clicking its name in
the *Index patterns* overview.

[role="screenshot"]
image:management/index-patterns/images/new-index-pattern.png["Index files and data types"]

You can perform the following actions:
From this view, you can perform the following actions:

* *Manage the index fields.* Click a column header to sort the table by that column.
Use the field dropdown menu to limit to display to a specific field.
See <<managing-fields, Managing fields>> for more detailed information.
* *Manage the index fields.* Click a column header to sort the table by that column.
Copy link
Contributor

@nreese nreese Dec 18, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this section should drop text about sorting columns and filtering fields (seems irrelevant since most tables in Kibana allow these types of interactions). Instead, maybe add text about why a user would want to manage fields, such as adding formatters to format values and creating scripted fields.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

++ Agree. I think the "why" is more important than the "how" in this section.

Use the field dropdown menu to limit to display to a specific field.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

to display > the display?

See <<managing-fields, Managing fields>> for more detailed information.

* [[set-default-pattern]]*Set the default index pattern.* {kib} uses a badge to make users
aware of which index pattern is the default. The first pattern
you create is automatically designated as the default pattern. The default
index pattern is loaded when you view the Discover tab.
* [[set-default-pattern]]*Set the default index pattern.* {kib} uses a badge to make users
aware of which index pattern is the default. The first pattern
you create is automatically designated as the default pattern. The default
index pattern is loaded when you open *Discover*.

* [[reload-fields]]*Reload the index fields list.* You can reload the index fields list to
pick up any newly-added fields. Doing so also resets Kibana’s popularity counters
for the fields. The popularity counters keep track of the fields
* [[reload-fields]]*Reload the index fields list.* You can reload the index fields list to
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In the UI I believe we say "refresh" when you hover over the icon, instead of "reload."

Not sure if using the same terminology in the docs matters, but thought I'd point that out.

pick up any newly-added fields. Doing so also resets Kibana’s popularity counters
for the fields. The popularity counters keep track of the fields
you’ve used most often in {kib} and are used to sort fields in lists.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

"keep track of fields you've used most often" makes this sound like it has a broader scope than it has in reality. Technically today -- as far as I'm aware -- the popularity is only incremented when someone selects columns/fields in Discover, and is also only used for sorting fields in lists in Discover. (Unless of course they manually edit the popularity count in the index patterns field UI).

It's probably okay to keep it this way, but just wanted to clarify this for the sake of accuracy in case you feel it is worth changing.


* [[delete-pattern]]*Delete the index pattern.* This action removes the pattern from the list of
Saved Objects in {kib}. You will not be able to recover field formatters,
* [[delete-pattern]]*Delete the index pattern.* This action removes the pattern from the list of
Saved Objects in {kib}. You will not be able to recover field formatters,
scripted fields, source filters, and field popularity data associated with the index pattern.
+
Deleting an index pattern breaks all visualizations, saved searches, and
other saved objects that reference the pattern. Deleting an index pattern does
Deleting an index pattern breaks all visualizations, saved searches, and
other saved objects that reference the pattern. Deleting an index pattern does
not remove any indices or data documents from {es}.

include::index-patterns/management-cross-cluster-search.asciidoc[]

This file was deleted.

3 changes: 3 additions & 0 deletions docs/user/discover.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,7 @@

[partintro]
--

When you know what your data includes, you can create visualizations
that best display that data and build better dashboards.
*Discover* enables you to explore your data, find
Expand Down Expand Up @@ -99,6 +100,8 @@ or create a direct link to share. The *Save* and *Share* actions are in the men

--

include::{kib-repo-dir}/management/index-patterns.asciidoc[]

include::{kib-repo-dir}/discover/set-time-filter.asciidoc[]

include::{kib-repo-dir}/discover/search.asciidoc[]
Expand Down
4 changes: 0 additions & 4 deletions docs/user/management.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,6 @@ visualizations, and dashboards.

include::{kib-repo-dir}/management/managing-licenses.asciidoc[]

include::{kib-repo-dir}/management/index-patterns.asciidoc[]

include::{kib-repo-dir}/management/rollups/create_and_manage_rollups.asciidoc[]

include::{kib-repo-dir}/management/index-lifecycle-policies/intro-to-lifecycle-policies.asciidoc[]
Expand All @@ -40,5 +38,3 @@ include::{kib-repo-dir}/management/managing-beats.asciidoc[]
include::{kib-repo-dir}/management/managing-remote-clusters.asciidoc[]

include::{kib-repo-dir}/management/snapshot-restore/index.asciidoc[]