logtrail icon indicating copy to clipboard operation
logtrail copied to clipboard

Is it possible to use several mappings for the same index pattern?

Open y0zg opened this issue 4 years ago • 1 comments

Hello,

I'd like to have the option to see different mappings (based on grok pattern) for the same index pattern (without switching Settings index pattern button) . Please let me know if this is possible in the current version or you are planning to improve this going forward

....
....
   {
      "es": {
        "default_index": "logstash-*"
      },
      "tail_interval_in_seconds": 10,
      "es_index_time_offset_in_seconds": 0,
      "display_timezone": "local",
      "display_timestamp_format": "MMM DD HH:mm:ss",
      "max_buckets": 500,
      "default_time_range_in_days" : 0,
      "max_hosts": 100,
      "max_events_to_keep_in_viewer": 5000,
      "default_search": "",
      "fields" : {
        "mapping" : {
            "timestamp" : "@timestamp",
            "message": "traefik_message",
            "hostname": "kubernetes.container_name",
            "display_timestamp": "traefik_timestamp"
        },
        "message_format": "{{{traefik_log_level}}} | {{{traefik_message}}}",
        "mapping2" : {
          "timestamp" : "@timestamp",
          "message": "message",
          "hostname": "kubernetes.container_name"
      },
        "message_format2": "{{{message}}}"
      },
      "color_mapping" : {
        "field": "traefik_log_level",
        "mapping": {
          "error": "#FF0000",
          "warn": "#FFEF96",
          "debug": "#B5E7A0",
          "info": "#CFE0E8"
        }
      }

y0zg avatar Sep 10 '19 20:09 y0zg

Noticed that alias creation could help, but logtrail.json becomes a bit huge as I need to copy-paste all values ;)

curl -XPOST -u elastic:changeme 'localhost:9200/_aliases' -H 'Content-Type: application/json' -d'
{
    "actions" : [
        { "add" : { "index" : "logstash-*", "alias" : "traefik" } }
    ]
}
'

y0zg avatar Sep 11 '19 06:09 y0zg