Skip to content

Commit

Permalink
apply review feedback
Browse files Browse the repository at this point in the history
  • Loading branch information
ruflin committed Jan 23, 2020
1 parent b19f18f commit cb6e8ac
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions docs/epm/index.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ Ingest Management enforces an indexing strategy to allow the system to automical
{type}-{namespace}-{dataset}
```

The `{type}` can be `logs` or `metrics`. The `{namespace}` is the part where the user can use free form. The only requirement is that it is valid in an Elasticsearch index and does NOT contain a `-`. The `dataset` is defined by the data that is indexed. A `dataset` must also be valid in an Elasticsearch index and not contain `-`. It is expected that the fields for type, namespace and dataset are part of each event and are constant keywords.
The `{type}` can be `logs` or `metrics`. The `{namespace}` is the part where the user can use free form. The only two requirement are that it has only characters allowed in an Elasticsearch index name and does NOT contain a `-`. The `dataset` is defined by the data that is indexed. The same requirements as for the namespace apply. It is expected that the fields for type, namespace and dataset are part of each event and are constant keywords.

Note: More `{type}`s might be added in the future like `apm` and `endpoint`.

Expand All @@ -73,7 +73,7 @@ This indexing strategy has a few advantages:

To make the above strategy possible, alias templates are required. For each type there is a basic alias template with a default ILM policy. These default templates apply to all indices which follow the indexing strategy and do not have a more specific dataset alias template.

The `metrics` and `logs` alias template contain all the basic fields. Dynamic fields are disabled to keep the number of fields low. The fields which are not part of the mapping will be available in `_source` but can't be queried.
The `metrics` and `logs` alias template contain all the basic fields from ECS.

Each type template contains an ILM policy. Modifying this default ILM policy will affect all data covered by the default templates.

Expand Down

0 comments on commit cb6e8ac

Please sign in to comment.