From cb6e8aca5aaf632f56cc600bfbfde2aacfde4828 Mon Sep 17 00:00:00 2001 From: ruflin Date: Tue, 21 Jan 2020 08:47:38 +0100 Subject: [PATCH] apply review feedback --- docs/epm/index.asciidoc | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/epm/index.asciidoc b/docs/epm/index.asciidoc index 320fe7dc31a7d..a98def72a583f 100644 --- a/docs/epm/index.asciidoc +++ b/docs/epm/index.asciidoc @@ -55,7 +55,7 @@ Ingest Management enforces an indexing strategy to allow the system to automical {type}-{namespace}-{dataset} ``` -The `{type}` can be `logs` or `metrics`. The `{namespace}` is the part where the user can use free form. The only requirement is that it is valid in an Elasticsearch index and does NOT contain a `-`. The `dataset` is defined by the data that is indexed. A `dataset` must also be valid in an Elasticsearch index and not contain `-`. It is expected that the fields for type, namespace and dataset are part of each event and are constant keywords. +The `{type}` can be `logs` or `metrics`. The `{namespace}` is the part where the user can use free form. The only two requirement are that it has only characters allowed in an Elasticsearch index name and does NOT contain a `-`. The `dataset` is defined by the data that is indexed. The same requirements as for the namespace apply. It is expected that the fields for type, namespace and dataset are part of each event and are constant keywords. Note: More `{type}`s might be added in the future like `apm` and `endpoint`. @@ -73,7 +73,7 @@ This indexing strategy has a few advantages: To make the above strategy possible, alias templates are required. For each type there is a basic alias template with a default ILM policy. These default templates apply to all indices which follow the indexing strategy and do not have a more specific dataset alias template. -The `metrics` and `logs` alias template contain all the basic fields. Dynamic fields are disabled to keep the number of fields low. The fields which are not part of the mapping will be available in `_source` but can't be queried. +The `metrics` and `logs` alias template contain all the basic fields from ECS. Each type template contains an ILM policy. Modifying this default ILM policy will affect all data covered by the default templates.