Is “logstash-” a mandatory prefix of indices in kibana?

Question

If I put messages on index "[logstash-example-]YYYY.MM.DD" then kibana can show the log message in charts but if it's on "[example-]YYYY.MM.DD" then it won't find it. (curl query gives back the correct result in latter case)

According to documentation it should work: "For example [web-]YYYY.MM.DD,[mail-]YYYY.MM.DD Please also note that indices should rollover at midnight UTC."

(Elasticsearch 1.3.4, Kibana 3.1.0)

Answer 1

You have to modify your kibana dashboard setting

1. Click Configure dashboarad in Kibana on Right Top.
2. Select Index tab.
3. Modify Index pattern to your new index pattern. For example: [example-]YYYY.MM.DD

Hope this can help you.