Add an example index pattern for time linked index names

[JulienPalard]

o/

Tell me if you want more or less feedback about kibana 4, here is a feeback:

Configure an index pattern may lack some documntation or at least just one example: I can't find a way to configure mine (a simple daily rotate ala logstash :p)

Bests

[kkirsche]

@JulienPalard I believe logstash would just be a glob like logstash-* (assuming an index name format of logstash-10072014 or something similar). Let me know if that helps!

[JulienPalard]

Yes it works with logstash-* BUT kibana optinally asks for some more details like "date pattern" "rotation frequency", and that's cool because I imagine that giving it those precisions, kibana will query on only needed indexes instead of , and for my servers, it may be cool (I store loads of documents, querying on logstash- is OK for me but I have another serie of indexes with a lot more data and I'll just never try selecting with a * on it ;p).

So as Kibana gently asks me some details about my index rotation, I want to give it, but I can't find the right syntax, it keep saying that my syntax maches no index (but actually sees and lists my indexes, they exists).

So it's clearly a very little missing in the kibna interface like an example, or a little line of documentation, not much.

[JulienPalard]

@kkirsche BTW, thanks a lot for trying to help, help always appreciated :)

[kkirsche]

My pleasure @JulienPalard . So with daily you would have:
[logstash-]YYYY.MM.DD as index name or pattern with Daily as the Index Pattern Interval. That would look for:

logstash-2014.10.04
logstash-2014.10.05
logstash-2014.10.06
etc.

What are you trying to enter and what is your actual format if you don't mind me asking? Hope that helps some

[JulienPalard]

Yes ! I was missing the [] ! Thanks !
And this time kibana showed them to me, so It was easy, I probably tried to edit the textbox of index name BEFORE clicking the "use event times...", so the right syntax was not proposed to me, the "bug" may be this:

When trying to edit the name of the index before clicking the "Use event times...", no hint about the syntax appear in the box, and new users like be are a bit lost.