CHAOSSEARCH Index Views are logical indexes based on the physical indexes created in the Storage section of the CHAOSSEARCH Platform. The refinery allows users the unique ability to clean, prepare, and transform the index data. Schema Transformation can be applied to one or many fields and the changing of Types between a String, Number, or TimeVal without the need to re-index data.
Index Views replace Index Patterns
All created indexes in the Storage section are available in the left-hand menu. To create a new view:
- Select the Index from the column on the left
- Click Create View
- Type the Indice or Indices to group together in the regex filter to create the Index Pattern
- Click Next
After selecting the View, you will have the opportunity to transform the schema of any of the fields within the index structure.
- Select or Search for the field to transform
- Click the Gear Icon
- Input the regex into the Field Transform Pattern to structure the new schema
- Users can add additional Materialized Fields and select the appropriate Type
- Click Save Transformation
In the Field Transform Pattern section, the regex defined for each capture groups’ backreference(s) is what will be stored in each Materialized Field
In the next section select the appropriate Timestamp Field, select the new Time type required for the Index View
The final step in the Index View creation is to assign it a name. The View name will be present in the Discover part in the Visual section of the platform.
View names must comply with DNS naming conventions.
|Index View Visualization|