|
@@ -52,10 +52,18 @@ triggers for such actions.
|
|
|
TIP: While optional, we recommend using {ilm-init} to manage the backing indices
|
|
|
associated with a data stream.
|
|
|
|
|
|
-The following <<ilm-put-lifecycle,create lifecycle policy API>> request
|
|
|
-configures the `logs_policy` lifecycle policy.
|
|
|
+You can create the policy through the Kibana UI. In Kibana, open the menu and go
|
|
|
+to *Stack Management > Index Lifecycle Policies*. Click *Index Lifecycle
|
|
|
+Policies*.
|
|
|
|
|
|
-The `logs_policy` policy uses the <<ilm-rollover,`rollover` action>> to create a
|
|
|
+[role="screenshot"]
|
|
|
+image::images/ilm/create-policy.png[Index Lifecycle Policies page]
|
|
|
+
|
|
|
+You can also create a policy using the <<ilm-put-lifecycle,create lifecycle
|
|
|
+policy API>>.
|
|
|
+
|
|
|
+The following request configures the `logs_policy` lifecycle policy. The
|
|
|
+`logs_policy` policy uses the <<ilm-rollover,`rollover` action>> to create a
|
|
|
new <<data-stream-write-index,write index>> for the data stream when the current
|
|
|
one reaches 25GB in size. The policy also deletes backing indices 30 days after
|
|
|
their rollover.
|
|
@@ -92,19 +100,18 @@ PUT /_ilm/policy/logs_policy
|
|
|
A data stream uses an index template to configure its backing indices. A
|
|
|
template for a data stream must specify:
|
|
|
|
|
|
-* An index pattern that matches the name of the stream.
|
|
|
-
|
|
|
-* An empty `data_stream` object that indicates the template is used for data
|
|
|
- streams.
|
|
|
+* One or more wildcard (`*`) patterns that match the name of the stream.
|
|
|
|
|
|
* The mappings and settings for the stream's backing indices.
|
|
|
|
|
|
+* That the template is used exclusively for data streams.
|
|
|
+
|
|
|
Every document indexed to a data stream must have a `@timestamp` field. This
|
|
|
field can be mapped as a <<date,`date`>> or <<date_nanos,`date_nanos`>> field
|
|
|
data type by the stream's index template. This mapping can include other
|
|
|
<<mapping-params,mapping parameters>>, such as <<mapping-date-format,`format`>>.
|
|
|
-If the template does not specify a mapping is specified in the template, the
|
|
|
-`@timestamp` field is mapped as a `date` field with default options.
|
|
|
+If the template does not specify a mapping, the `@timestamp` field is mapped as
|
|
|
+a `date` field with default options.
|
|
|
|
|
|
We recommend using {ilm-init} to manage a data stream's backing indices. Specify
|
|
|
the name of the lifecycle policy with the `index.lifecycle.name` setting.
|
|
@@ -114,11 +121,24 @@ in this template before creating a data stream. Later changes to the mappings or
|
|
|
settings of a stream's backing indices may require reindexing. See
|
|
|
<<data-streams-change-mappings-and-settings>>.
|
|
|
|
|
|
-The following <<indices-templates,put index template API>> request
|
|
|
-configures the `logs_data_stream` template.
|
|
|
+You can create an index template through the Kibana UI:
|
|
|
+
|
|
|
+. From Kibana, open the menu and go to *Stack Management > Index Management*.
|
|
|
+. In the *Index Templates* tab, click *Create template*.
|
|
|
+. In the Create template wizard, use the *Data stream* toggle to indicate the
|
|
|
+template is used exclusively for data streams.
|
|
|
+
|
|
|
+[role="screenshot"]
|
|
|
+image::images/data-streams/create-index-template.png[Create template page]
|
|
|
|
|
|
-Because no field mapping is specified, the `@timestamp` field uses the `date`
|
|
|
-field data type by default.
|
|
|
+You can also create a template using the <<indices-put-template,put index
|
|
|
+template API>>. The template must include a `data_stream` object with an empty
|
|
|
+body (`{ }`). This object indicates the template is used exclusively for data
|
|
|
+streams.
|
|
|
+
|
|
|
+The following request configures the `logs_data_stream` index template. Because
|
|
|
+no field mapping is specified, the `@timestamp` field uses the `date` field data
|
|
|
+type by default.
|
|
|
|
|
|
[source,console]
|
|
|
----
|
|
@@ -176,7 +196,7 @@ You can create a data stream using one of two methods:
|
|
|
[[index-documents-to-create-a-data-stream]]
|
|
|
==== Index documents to create a data stream
|
|
|
|
|
|
-You can automatically generate a data stream using an indexing request. Submit
|
|
|
+You can automatically create a data stream using an indexing request. Submit
|
|
|
an <<add-documents-to-a-data-stream,indexing request>> to a target
|
|
|
matching the name or wildcard pattern defined in the template's `index_patterns`
|
|
|
property.
|
|
@@ -250,10 +270,16 @@ PUT /_data_stream/logs_alt
|
|
|
[[get-info-about-a-data-stream]]
|
|
|
=== Get information about a data stream
|
|
|
|
|
|
-You can use the <<indices-get-data-stream,get data stream API>> to get
|
|
|
-information about one or more data streams, including:
|
|
|
+To view information about a data stream in Kibana, open the menu and go to
|
|
|
+*Stack Management > Index Management*. In the *Data Streams* tab, click a data
|
|
|
+stream's name to view information about the stream.
|
|
|
+
|
|
|
+[role="screenshot"]
|
|
|
+image::images/data-streams/data-streams-list.png[Data Streams tab]
|
|
|
+
|
|
|
+You can also use the <<indices-get-data-stream,get data stream API>> to retrieve
|
|
|
+the following information about one or more data streams:
|
|
|
|
|
|
-* The timestamp field
|
|
|
* The current backing indices, which is returned as an array. The last item in
|
|
|
the array contains information about the stream's current write index.
|
|
|
* The current generation
|
|
@@ -262,8 +288,6 @@ information about one or more data streams, including:
|
|
|
* The current {ilm-init} lifecycle policy in the stream's matching index
|
|
|
template
|
|
|
|
|
|
-This is also handy way to verify that a recently created data stream exists.
|
|
|
-
|
|
|
The following get data stream API request retrieves information about the
|
|
|
`logs` data stream.
|
|
|
|
|
@@ -330,11 +354,18 @@ data. See <<data-stream-privileges>>.
|
|
|
[[delete-a-data-stream]]
|
|
|
=== Delete a data stream
|
|
|
|
|
|
-You can use the <<indices-delete-data-stream,delete data stream API>> to delete
|
|
|
-a data stream and its backing indices.
|
|
|
+You can use the Kibana UI to delete a data stream and its backing indices. In
|
|
|
+Kibana, open the menu and go to *Stack Management > Index Management*. In the
|
|
|
+*Data Streams* tab, click the trash can icon to delete a stream and its backing
|
|
|
+indices.
|
|
|
+
|
|
|
+[role="screenshot"]
|
|
|
+image::images/data-streams/data-streams-list.png[Data Streams tab]
|
|
|
|
|
|
-The following delete data stream API request deletes the `logs` data stream. This
|
|
|
-request also deletes the stream's backing indices and any data they contain.
|
|
|
+You can also use the the <<indices-delete-data-stream,delete data stream API>>
|
|
|
+to delete a data stream. The following delete data stream API request deletes
|
|
|
+the `logs` data stream. This request also deletes the stream's backing indices
|
|
|
+and any data they contain.
|
|
|
|
|
|
[source,console]
|
|
|
----
|