Create an Index Pattern Search

Siren Investigate requires at least one configured Index Pattern Search. Index Pattern Searches identify the indexes to run.

Index pattern

The Index Pattern selects the indexes to query.
You can set the name of the index or select multiple indexes with the * wildcard, for example: logstash-*.
Note: virtual indexes can be used only by direct naming, not as part of wildcard patterns.

Index pattern ID

Creates the index pattern with the specified ID.

Time Filter field name

refresh fields

Exclude the indices listed in siren:excludedIndices property in Advanced Settings

Name of this search

The search name, typically describing returned entity types, for example:“users”, “logs firewall 1”, “ articles.

Short Description

Icon

Color

Generate the primary key and single value field properties automatically

Attempted to match the following indices and aliases:

Pattern matches {{controller.existing.matchPercent}} of existing indices and aliases

Indices and aliases that were found, but did not match the pattern: