All,
So we're slowly moving off of index=java to index=applicationlogs for a few reasons. Is there a way to alias index=java to index=applicationlogs for users?
No, there is no way to transparently alias without changing existing searches. @cusello's approach is valid. You can also create a macro, for example set_app_index
, that resolves to index=java OR index=applicationlogs
.
Either way, you will have to update saved searches, reports and dashboards with inline searches to take advantage of the abstraction.
Hi,
You can use eventtypes instead of indexes.
In other words:
You have to create an eventtype like the folliwing
Index=java OR index=applicationlogs
And then on your searches use
Eventtype=my_eventtype instead of index= applicationlogs
Bye.
Giuseppe