opensearch: automate index pattern creation in dashboards

Previously, operators had to manually create the default index
pattern after the first login to OpenSearch Dashboards.

This commit automates the creation of the default index pattern
using the OpenSearch Dashboards Saved Objects API during the
post-config phase. The pattern is dynamically named based on the
opensearch_log_index_prefix variable (defaulting to "flog-*")
and automatically sets "@timestamp" as the time field.

Documentation has been updated to reflect that the first-login
manual setup is no longer required for the default log indices.

Change-Id: I8d49a270ace187b3b13103452e93d305505f6cbb
Signed-off-by: Piotr Milewski <vurmil@gmail.com>

1 files changed, 32 insertions, 14 deletions

diff --git a/doc/source/reference/logging-and-monitoring/central-logging-guide.rst b/doc/source/reference/logging-and-monitoring/central-logging-guide.rst
index 870be297f..aa732f802 100644
--- a/doc/source/reference/logging-and-monitoring/central-logging-guide.rst
+++ b/doc/source/reference/logging-and-monitoring/central-logging-guide.rst
@@ -95,20 +95,38 @@ If you want to prevent OpenSearch Dashboards being exposed on the external
 VIP, you can set ``enable_opensearch_dashboards_external`` to ``false`` in
 ``/etc/kolla/globals.yml``.
 
-First Login
------------
-
-When OpenSearch Dashboards is opened for the first time, it requires creating
-a default index pattern. To view, analyse and search logs, at least one
-index pattern has to be created. To match indices stored in OpenSearch,
-we suggest using the following configuration:
-
-#. Index pattern - flog-*
-#. Time Filter field name - @timestamp
-#. Expand index pattern when searching [DEPRECATED] - not checked
-#. Use event times to create index names [DEPRECATED] - not checked
-
-After setting parameters, one can create an index with the *Create* button.
+Index Pattern Configuration
+---------------------------
+
+Kolla Ansible fully automates the creation of the default index pattern.
+During the deployment or reconfiguration process, an index pattern is
+automatically provisioned. By default, it is dynamically configured to
+match the indices defined by the ``opensearch_log_index_prefix``
+variable (which defaults to ``flog``). This results in an automatic
+index pattern of ``flog-*``.
+
+The time filter field name is automatically set to ``@timestamp``,
+ensuring that all time-based aggregations and histograms work perfectly
+out of the box.
+
+As a result, the **Discover** tab is immediately ready to display
+incoming log data upon your first login, requiring no manual setup
+from the operator.
+
+**Adding Custom Index Patterns Manually**
+
+If you configure custom Fluentd outputs to route specific logs to
+different indices, or if you ingest external metrics into OpenSearch,
+you may still need to create additional index patterns manually.
+To do this:
+
+1. Navigate to **Dashboards Management** -> **Index Patterns** in the
+   OpenSearch Dashboards UI.
+2. Click **Create index pattern**.
+3. Define your custom index pattern (e.g., ``my-custom-logs-*``).
+4. Select the appropriate Time Filter field name (typically
+   ``@timestamp``).
+5. Click the **Create index pattern** button.
 
 Search logs - Discover tab
 --------------------------