elasticsearch - Kibana Create Index Pattern : strange behaviour of wildcard

Question

I have just one index in elasticsearch, with name aa-bb-YYYY-MM. Documents in this index contain a field i want to use as date field. Those documents have been inserted from a custom script (not using logstash).

When creating the index pattern in kibana:

1. If i enter aa-bb-*, the date field is not found.
2. If i enter aa-*, the date field is not found.
3. If i enter aa*, the date field is found, and i can create the index pattern.

But i really need to group indexes by the first two "dimensions".I tried using "_" instead "-", with the same result.

Any idea of what is going on?

Answer 1

Its working for me. I'm on the latest build on the 5.0 release branch (just past the beta1 release). I don't know what version you're on.

I created this index and added 2 docs;

curl --basic -XPUT 'http://elastic:changeme@localhost:9200/aa-bb-2016-09' -d '{
        "settings" : {
            "number_of_shards" : 1
        },
        "mappings" : {
            "test" : {
                "properties" : {
                    "date" : { "type" : "date"},
                    "action" : { 
                      "type" : "text", 
                      "analyzer" : "standard",
                      "fields": {
                        "raw" : { "type" : "text", "index" : "not_analyzed" }
                      }
                    },
                    "myid" : { "type" : "integer"}
                }
            }
        }
    }'


curl -XPUT 'http://elastic:changeme@localhost:9200/aa-bb-2016-09/test/1' -d '{
        "date" : "2015-08-23T00:01:00",
        "action" : "start",
        "myid" : 1
    }'

curl -XPUT 'http://elastic:changeme@localhost:9200/aa-bb-2016-09/test/2' -d '{
        "date" : "2015-08-23T14:02:30",
        "action" : "stop",
        "myid" : 1
    }'

and I was able to create the index pattern with aa-bb-*