[DOCS] Correct watcher event data example #56469
Conversation
* Updates Logstash index patterns. Logstash indices now default to an ILM-friendly index pattern. * Swaps `*.raw` fields for `*.keyword` fields. The Logstash template uses `keyword` fields by default since 6.x. * Swaps instances of`ctx.payload.hits.total.value` with `ctx.payload.hits.total`
jrodewig
added
>docs
|
Pinging @elastic/es-docs (>docs) |
|
Pinging @elastic/es-core-features (:Core/Features/Monitoring) |
|
@jrodewig its best if someone from @elastic/es-core-features reviews this since im no longer on the team working on watcher. |
|
@hub-cap Will do. Thanks for the heads up! |
| @@ -83,8 +83,8 @@ To set up the watch: | |||
| "search": { | |||
| "request": { | |||
| "indices": [ | |||
| "<logstash-{now-1h}>", <1> | |||
| "<logstash-{now}>" | |||
There was a problem hiding this comment.
With ILM there will be an alias by default named logstash. Rather then trying to query the concrete indices, I think the example should just use a single index logstash and the note below call out that logstash is an alias.
In general we should avoid examples that include both time based (e.g. {now}) and rollover based (e.g. -00001) in favor of the fronting alias. The time stamp on the index when combined with rollover changes meaning such that it is the time when the index was created, not necessarily reflective of the content of that index (the content is dependent on the rollover rules). It is a distinction difficult to describe and the alias should be the preferred access across multiple rolled over indices.
There was a problem hiding this comment.
Thanks @jakelandis. I've updated this and the following snippet to use the logstash index alias with 2c1d2db.
Also added some more context around Logstash ILM defaults in the callout text.
|
@elasticmachine run elasticsearch-ci/bwc |
|
@elasticmachine update branch |
* Swaps outdated index patterns for the default `logstash` index alias. Adds some related information about Logstash ILM defaults to the callout. * Swaps `*.raw` fields for `*.keyword` fields. The Logstash template uses `keyword` fields by default since 6.x. * Swaps instances of `ctx.payload.hits.total.value` with `ctx.payload.hits.total`
* Swaps outdated index patterns for the default `logstash` index alias. Adds some related information about Logstash ILM defaults to the callout. * Swaps `*.raw` fields for `*.keyword` fields. The Logstash template uses `keyword` fields by default since 6.x. * Swaps instances of `ctx.payload.hits.total.value` with `ctx.payload.hits.total`
* Swaps outdated index patterns for the default `logstash` index alias. Adds some related information about Logstash ILM defaults to the callout. * Swaps `*.raw` fields for `*.keyword` fields. The Logstash template uses `keyword` fields by default since 6.x. * Swaps instances of `ctx.payload.hits.total.value` with `ctx.payload.hits.total`
* Swaps outdated index patterns for the default `logstash` index alias. Adds some related information about Logstash ILM defaults to the callout. * Swaps `*.raw` fields for `*.keyword` fields. The Logstash template uses `keyword` fields by default since 6.x. * Swaps instances of `ctx.payload.hits.total.value` with `ctx.payload.hits.total`
ILM-friendly index pattern.
*.rawfields for*.keywordfields. The Logstash templateuses
keywordfields by default since 6.x.ctx.payload.hits.total.valuewithctx.payload.hits.totalCloses #56248