My indexes are generated monthly, for example, the index names are:
192_168_20_3_winlog_202407
192_168_20_3_winlog_202408
192_168_20_4_linuxlog_202407
192_168_20_4_linuxlog_202408
After each month’s index is generated, I need to manually create data views, the name of data views are as follows, corresponding to the above index names:
192.168.20.3–202407
192.168.20.3–202408
192.168.20.4–202407
192.168.20.4–202408
Is there any way to automatically create an index name through the index name? Does ELK have a corresponding method, or do I need to write a script to achieve it?
The solution is creating an alias for all indices like:
index1 -> myAlias
index2 -> myAlias
Then when you create a data view, you can display all indices with the same alias, namely from myAlias.
Here is the documentation about aliases: https://www.elastic.co/guide/en/elasticsearch/reference/current/aliases.html
If you can not set aliases for all indices, because you are creating automatically. I would suggest using index template for all indices. There you can specify the alias as well.
So each time an index is generated automatically, Elasticsearch ingests the data according to the index template and set an alias.