From 20c6740bfc8245a304e8d2a7f630269c31e3918f Mon Sep 17 00:00:00 2001 From: Piotr Milewski Date: Mon, 27 Apr 2026 11:15:19 +0200 Subject: opensearch: automate index pattern creation in dashboards Previously, operators had to manually create the default index pattern after the first login to OpenSearch Dashboards. This commit automates the creation of the default index pattern using the OpenSearch Dashboards Saved Objects API during the post-config phase. The pattern is dynamically named based on the opensearch_log_index_prefix variable (defaulting to "flog-*") and automatically sets "@timestamp" as the time field. Documentation has been updated to reflect that the first-login manual setup is no longer required for the default log indices. Change-Id: I8d49a270ace187b3b13103452e93d305505f6cbb Signed-off-by: Piotr Milewski --- .../central-logging-guide.rst | 46 +++++++++++++++------- 1 file changed, 32 insertions(+), 14 deletions(-) (limited to 'doc') diff --git a/doc/source/reference/logging-and-monitoring/central-logging-guide.rst b/doc/source/reference/logging-and-monitoring/central-logging-guide.rst index 870be297f..aa732f802 100644 --- a/doc/source/reference/logging-and-monitoring/central-logging-guide.rst +++ b/doc/source/reference/logging-and-monitoring/central-logging-guide.rst @@ -95,20 +95,38 @@ If you want to prevent OpenSearch Dashboards being exposed on the external VIP, you can set ``enable_opensearch_dashboards_external`` to ``false`` in ``/etc/kolla/globals.yml``. -First Login ------------ - -When OpenSearch Dashboards is opened for the first time, it requires creating -a default index pattern. To view, analyse and search logs, at least one -index pattern has to be created. To match indices stored in OpenSearch, -we suggest using the following configuration: - -#. Index pattern - flog-* -#. Time Filter field name - @timestamp -#. Expand index pattern when searching [DEPRECATED] - not checked -#. Use event times to create index names [DEPRECATED] - not checked - -After setting parameters, one can create an index with the *Create* button. +Index Pattern Configuration +--------------------------- + +Kolla Ansible fully automates the creation of the default index pattern. +During the deployment or reconfiguration process, an index pattern is +automatically provisioned. By default, it is dynamically configured to +match the indices defined by the ``opensearch_log_index_prefix`` +variable (which defaults to ``flog``). This results in an automatic +index pattern of ``flog-*``. + +The time filter field name is automatically set to ``@timestamp``, +ensuring that all time-based aggregations and histograms work perfectly +out of the box. + +As a result, the **Discover** tab is immediately ready to display +incoming log data upon your first login, requiring no manual setup +from the operator. + +**Adding Custom Index Patterns Manually** + +If you configure custom Fluentd outputs to route specific logs to +different indices, or if you ingest external metrics into OpenSearch, +you may still need to create additional index patterns manually. +To do this: + +1. Navigate to **Dashboards Management** -> **Index Patterns** in the + OpenSearch Dashboards UI. +2. Click **Create index pattern**. +3. Define your custom index pattern (e.g., ``my-custom-logs-*``). +4. Select the appropriate Time Filter field name (typically + ``@timestamp``). +5. Click the **Create index pattern** button. Search logs - Discover tab -------------------------- -- cgit v1.2.3