I am trying to get two differently named ES indices in the same datasource but I’m having trouble because they both use date patterns and have very similar, but slightly different names.
index pattern 1:
index pattern 2:
The infra_net index is getting too big and we are switching part of the agents from that datasource to a new one (esx) to alleviate the load on the first index. The datasource for the new index (esx) does not contain historical data and I would like to temporarily have it read both indices in order to avoid having to modify every panel on our dashboards to switch the datasources to mixed mode and copy /paste the queries.
Ideally, I’d like to be able to do something like this:
The grafana documentation is very limited on index pattern info for datasources. Maybe I missed something and you guys can help me achieve my dream DataSource?
Solutions I am aware of
Using * in the datasource:
This would work, but unfortunately I have other equally large indices that follow this exact pattern and I fear the request would be problematic for our ES cluster.
Using aliases in ElasticSearch:
Since new indices are created daily, I would have to put the alias in the templates, but I would lose the whole YYYY.MM.DD optimization in Grafana.
I hope my question was clear enough to understand, and I thank you for taking the time to read this!