search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.78k stars 8.19k forks source link

Remove sample data index from default centralized logs setting #195867

Open flash1293 opened 19 hours ago

flash1293 commented 19 hours ago

Currently the default value for observability:logSources is logs-*-*, logs-*, filebeat-*, kibana_sample_data_logs*.

As it's used as the default data source in Logs explorer and it's possible to carry this value over to ESQL, it's very easy to run into the following case: Image

While there is a good reason for keeping filebeat as a default value in there (lots of users have data in this set of index patterns), it should be very rare that users actually want to query kibana_sample_data_logs - the inclusion has mostly historical reasons because the synthetic sample data used to be a much more prominent feature in Kibana.

As it's adding to the noise and the risk of breaking actual use cases is extremely small, it should be removed from the default value.

elasticmachine commented 18 hours ago

Pinging @elastic/obs-ux-logs-team (Team:obs-ux-logs)