Allowing duplicate index patterns

[w33ble]

This came up at Elasticon - the ability to use the exact same index pattern but with a different date field.

Right now, our "ID" for a pattern is the pattern itself, so this isn't possible. Maybe we should move to an index or UUID for the patterns.

[jimmyjones2]

I got round this with aliases, but would be nice for a "proper" solution

[webmstr]

+2.

While you're there, how about a free-text name for the patterm or meta data on the pattern, like time created, or host IP, or shield user name for creation and last edit, etc?

I keep hitting this. I'd really like patterns that use @timestamp and duplicates that use _timestamp. Right now, the best I can do is [logstash-]YYYY.MM.DD and logstash-*, but there would be a lot of confusion without the ability to name them.

[karan87]

+1

[timroes]

Another use case, I have heared more often is, that indexes are renamed. And people like to keep their visualizations with the new index names, and currently that involves scripting something, that modifies the .kibana index in ES.

[djschny]

I also like this as using is it as a workaround for visualizations to contain their own time picker that persists regardless of the dashboard included in - #4957

if I have a second index pattern for the same index where I uncheck the box that it contains time series data, I can then make my visualizations have per visualization date math on them using query string, therefore hence overriding whatever dashboard they are included in

[ynux]

+1. I like to add the same visualization with another timestamp. Now I use a subtle change in the pattern to indicate that - which will confuse everyone else. Also, it would be great if something like "mta-logstash* or traffic-logstash_" was possible as a pattern. Now, in these cases I have to use the most general one, like "_logstash*", which has elasticsearch search through all and is bad for performance and stability.

[alexfrancoeur]

We have UUID's for index patterns today, and the functionality originally described here is now possible. I think we can close this out.

[ikr0m]

How can I create "duplicated index patterns" in kibana? I need it to use different 'time fields' for each index pattern. I'm using kibana 5.7. Thanks.