update data view docs for excluding cluster (elastic#164904)

elastic/elasticsearch#97865 expands index-pattern expressions to include a cluster alias for purposes of excluding an entire cluster from a cross-cluster search. This allows users to put the minus sign in front of the cluster name (`-cluster_one:*`). The advantage to this change is that it avoids sending any network calls to that cluster. Compare this to the existing syntax for excluding clusters, where the minus sign is in front of the index name (`cluster_one:-*`). The older syntax has to send the request to the remote cluster, which if it is down (and skip_unavailable=false), will cause the search to fail. This PR updates the docs to reflect the new syntax. --------- Co-authored-by: Kibana Machine <[email protected]> (cherry picked from commit 4b02740)
kibanamachine · Aug 31, 2023 · 05bf9ff · 05bf9ff
1 parent fe93fa7
commit 05bf9ff
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/docs/concepts/data-views.asciidoc b/docs/concepts/data-views.asciidoc
@@ -143,10 +143,11 @@ all clusters having a name starting with `cluster_`:
 `cluster_*:logstash-*,cluster_*:-logstash-old*`
 ```
 
-To exclude a cluster having a name starting with `cluster_`:
+Excluding a cluster avoids sending any network calls to that cluster.
+To exclude a cluster with the name `cluster_one`:
 
 ```ts
-`cluster_*:logstash-*,cluster_one:-*`
+`cluster_*:logstash-*,-cluster_one:*`
 ```
 
 Once you configure a {data-source} to use the {ccs} syntax, all searches and