skip to Main Content

I have ELK stack deployed along my application in docker. On first run I need to setup index pattern, and select ordering field. I know that my index pattern will always be logstash-* and my field will be @timestamp.

How can I preconfigure this in docker so I do not have to do it each time?

2

Answers


  1. You can use the index template to define a template, and next time whenever you create an index matching the pattern name defined in your template, it will have a settings and mappings defined in the template.

    Login or Signup to reply.
  2. Use Kibana create saved objects API to write a script and run it in a container or something like that:

    kibana_endpoint=localhost
    kibana_system_user_password="12345678"
    
    curl -X POST 
        "${kibana_endpoint}:5600/api/saved_objects/index-pattern/logstash" 
        --header "kbn-xsrf: true" 
        --header "Content-Type: application/json" 
        --user "kibana_system:${kibana_system_user_password}" 
        --data 
        "
        {
            "attributes": {
                "title" : "logstash-*",
                "timeFieldName": "@timestamp"
            }
        }
        "
    
    Login or Signup to reply.
Please signup or login to give your own answer.
Back To Top
Search