Loading

Data view search syntax

When you create a data view, the index pattern you enter can use the following syntax to reach rolled up data, or data in other clusters or projects.

Admonition

Rollups are deprecated. Use downsampling instead.

A data view can match one rollup index. For a combination rollup data view with both raw and rolled up data, use the standard notation:

rollup_logstash,kibana_sample_data_logs

For an example, refer to Create and visualize rolled up data.

If your Elasticsearch clusters are configured for cross-cluster search, you can create a data view to search across the clusters of your choosing. Specify data streams, indices, and aliases in a remote cluster using the following syntax:

<remote_cluster_name>:<target>

To query Logstash indices across two Elasticsearch clusters that you set up for cross-cluster search, named cluster_one and cluster_two:

cluster_one:logstash-*,cluster_two:logstash-*

Use wildcards in your cluster names to match any number of clusters. To search Logstash indices across clusters named cluster_foo, cluster_bar, and so on:

cluster_*:logstash-*

To query across all Elasticsearch clusters that have been configured for cross-cluster search, use a standalone wildcard for your cluster name:

*:logstash-*

To match indices starting with logstash-, but exclude those starting with logstash-old, from all clusters having a name starting with cluster_:

cluster_*:logstash-*,cluster_*:-logstash-old*

Excluding a cluster avoids sending any network calls to that cluster. To exclude a cluster with the name cluster_one:

cluster_*:logstash-*,-cluster_one:*

Once you configure a data view to use the cross-cluster search syntax, all searches and aggregations using that data view in Kibana take advantage of cross-cluster search.

For more information, refer to Excluding clusters or indices from cross-cluster search.

When cross-project search is enabled and you have linked projects, the data view creation form previews matching indices from linked projects based on the current cross-project search scope. The data view itself does not store the scope. When you query the data view, results come from whichever linked projects the active cross-project search scope includes at that time.

To restrict a data view to specific projects regardless of the active scope, you can:

  • Use qualified expressions in the index pattern to target specific projects, for example project_alpha:logs-*,project_beta:logs-*. To search only the origin project, use _origin:logs-*.
  • Use project routing in your queries to narrow scope at query time.