search

elastic / beats-dashboards

DEPRECATED. Moved to https://github.com/elastic/beats. Please use the new repository to add new issues.
Other
196 stars 73 forks source link

Revert Default-Search to generic logstash-* index #51

Closed lmangani closed 8 years ago

damm commented 8 years ago

That is much easier than what I did in my fork :) :+1:

ruflin commented 8 years ago

@lmangani Isn't that just going to move the problem? Means, everyone not using the logstash-* index will have the same problem as before?

lmangani commented 8 years ago

Not sure @ruflin as logstash-* is anyway the default index in a Kibana setup it should most likely cause nothing unexpected for the end users - the alternative would be to completely remove the specific index being loaded?

ruflin commented 8 years ago

@lmangani The problem is that in the end the index is given by the beats and not Kibana. And the beats have each the default index with their name. My favorite option would be to have a default but make it configurable as mentioned here: https://github.com/elastic/beats-dashboards/issues/49#issuecomment-163143531

lmangani commented 8 years ago

@ruflin I might be wrong, but I fail to see the issue - beats-specific dashboards-index pairing are untouched and everything should continue working there using the hardcoded indexes, just the default-search item is free'd up to avoid blocking those running in cases such as #49

ruflin commented 8 years ago

@lmangani You are right here. The thing I'm unclear about is what the affect of changing packetbeat-* to logstash-* is at the beginning of the JSON document. In case there is no logstash-* index, what will happen? I must test this with Kibana itself. Perhaps @monicasarbu can give some deeper insights here.

lmangani commented 8 years ago

The only effect would be to de-couple the Default-Search index from the packetbeat one and for it to behave as in a stock Kibana setup - this should keep both Beat and Logstash users going, or at least that would be the humble intention - Having no index (or a widlcard) there would break bork ES in my view. Let's pend the opinions of @monicasarbu or @tsg first

monicasarbu commented 8 years ago

@lmangani Indeed it's a bug in our dashboards. There is one widget that is using the Default Search, but I can fix it in a different PR. Thanks again for the fix!

The idea is to be able to use the same Kibana instance for querying not only packetbeat data, but also other data. The load.sh should only "add" functionality to the existing dashboards without affecting the existing functionality.