diff options
3 files changed, 70 insertions, 14 deletions
diff --git a/ansible/roles/opensearch/tasks/post-config.yml b/ansible/roles/opensearch/tasks/post-config.yml index f35b36f78..290e88365 100644 --- a/ansible/roles/opensearch/tasks/post-config.yml +++ b/ansible/roles/opensearch/tasks/post-config.yml @@ -87,3 +87,30 @@ when: - not ansible_check_mode - opensearch_retention_policy_check.status == 404 + +- name: Create OpenSearch Dashboards Index Pattern + become: true + kolla_toolbox: + container_engine: "{{ kolla_container_engine }}" + module_name: uri + module_args: + url: "{{ opensearch_dashboards_internal_endpoint }}/api/saved_objects/index-pattern/{{ opensearch_log_index_prefix }}-pattern" + method: POST + status_code: 200, 409 + url_username: "{{ opensearch_dashboards_user }}" + url_password: "{{ opensearch_dashboards_password }}" + force_basic_auth: true + headers: + osd-xsrf: "true" + body: + attributes: + title: "{{ opensearch_log_index_prefix }}-*" + timeFieldName: "@timestamp" + body_format: json + ca_path: "{{ openstack_cacert }}" + register: opensearch_index_pattern_create + changed_when: opensearch_index_pattern_create.status == 200 + delegate_to: "{{ groups['opensearch'][0] }}" + run_once: true + when: + - not ansible_check_mode diff --git a/doc/source/reference/logging-and-monitoring/central-logging-guide.rst b/doc/source/reference/logging-and-monitoring/central-logging-guide.rst index 870be297f..aa732f802 100644 --- a/doc/source/reference/logging-and-monitoring/central-logging-guide.rst +++ b/doc/source/reference/logging-and-monitoring/central-logging-guide.rst @@ -95,20 +95,38 @@ If you want to prevent OpenSearch Dashboards being exposed on the external VIP, you can set ``enable_opensearch_dashboards_external`` to ``false`` in ``/etc/kolla/globals.yml``. -First Login ------------ - -When OpenSearch Dashboards is opened for the first time, it requires creating -a default index pattern. To view, analyse and search logs, at least one -index pattern has to be created. To match indices stored in OpenSearch, -we suggest using the following configuration: - -#. Index pattern - flog-* -#. Time Filter field name - @timestamp -#. Expand index pattern when searching [DEPRECATED] - not checked -#. Use event times to create index names [DEPRECATED] - not checked - -After setting parameters, one can create an index with the *Create* button. +Index Pattern Configuration +--------------------------- + +Kolla Ansible fully automates the creation of the default index pattern. +During the deployment or reconfiguration process, an index pattern is +automatically provisioned. By default, it is dynamically configured to +match the indices defined by the ``opensearch_log_index_prefix`` +variable (which defaults to ``flog``). This results in an automatic +index pattern of ``flog-*``. + +The time filter field name is automatically set to ``@timestamp``, +ensuring that all time-based aggregations and histograms work perfectly +out of the box. + +As a result, the **Discover** tab is immediately ready to display +incoming log data upon your first login, requiring no manual setup +from the operator. + +**Adding Custom Index Patterns Manually** + +If you configure custom Fluentd outputs to route specific logs to +different indices, or if you ingest external metrics into OpenSearch, +you may still need to create additional index patterns manually. +To do this: + +1. Navigate to **Dashboards Management** -> **Index Patterns** in the + OpenSearch Dashboards UI. +2. Click **Create index pattern**. +3. Define your custom index pattern (e.g., ``my-custom-logs-*``). +4. Select the appropriate Time Filter field name (typically + ``@timestamp``). +5. Click the **Create index pattern** button. Search logs - Discover tab -------------------------- diff --git a/releasenotes/notes/automate-opensearch-index-pattern-0b5396fc1cd4de67.yaml b/releasenotes/notes/automate-opensearch-index-pattern-0b5396fc1cd4de67.yaml new file mode 100644 index 000000000..514b5458d --- /dev/null +++ b/releasenotes/notes/automate-opensearch-index-pattern-0b5396fc1cd4de67.yaml @@ -0,0 +1,11 @@ +--- +features: + - | + Automated the creation of the default OpenSearch Dashboards + index pattern. During deployment or reconfiguration, Kolla + Ansible now automatically provisions an index pattern based + on the ``opensearch_log_index_prefix`` (defaulting to + ``flog-*``) with ``@timestamp`` configured as the time field. + This removes the need for operators to manually configure the + initial index pattern upon their first login to the Dashboards + UI. |