From 05bf9ff1e5ff00131ea3a9a28fd6cc7a8ef04fd9 Mon Sep 17 00:00:00 2001 From: Nathan Reese Date: Thu, 31 Aug 2023 08:27:03 -0600 Subject: [PATCH] update data view docs for excluding cluster (#164904) https://github.com/elastic/elasticsearch/pull/97865 expands index-pattern expressions to include a cluster alias for purposes of excluding an entire cluster from a cross-cluster search. This allows users to put the minus sign in front of the cluster name (`-cluster_one:*`). The advantage to this change is that it avoids sending any network calls to that cluster. Compare this to the existing syntax for excluding clusters, where the minus sign is in front of the index name (`cluster_one:-*`). The older syntax has to send the request to the remote cluster, which if it is down (and skip_unavailable=false), will cause the search to fail. This PR updates the docs to reflect the new syntax. --------- Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> (cherry picked from commit 4b02740b32542b6e84ee7a8abec9cb355f70db35) --- docs/concepts/data-views.asciidoc | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/concepts/data-views.asciidoc b/docs/concepts/data-views.asciidoc index f75012e8d69f4..79aec68151d9a 100644 --- a/docs/concepts/data-views.asciidoc +++ b/docs/concepts/data-views.asciidoc @@ -143,10 +143,11 @@ all clusters having a name starting with `cluster_`: `cluster_*:logstash-*,cluster_*:-logstash-old*` ``` -To exclude a cluster having a name starting with `cluster_`: +Excluding a cluster avoids sending any network calls to that cluster. +To exclude a cluster with the name `cluster_one`: ```ts -`cluster_*:logstash-*,cluster_one:-*` +`cluster_*:logstash-*,-cluster_one:*` ``` Once you configure a {data-source} to use the {ccs} syntax, all searches and