Define multiply index names for one elasticsearch source

Hello everybody,

I use searchguard to limit access to specific indexes. A user I created can for example see filebeat-* and metrics-.
Currently I try to create a new source for Elasticsearch in Grafana, but when I use -YYYY.MM.DD I get an error message, because there are insufficient permissions for this user.
It’s working when I use the specific index names (like [filebeat
]-YYYY.MM.DD).
Is there a way to create an array with names to set a bunch of names?
I tried something like {filebeat-
, metrics-*} or other combinations, but it’s not working and I don’t want to create a data source for every index name (for example to count all docs of all the authorized indexes).

Best regards,
Patrick

Hi,

No, don’t think that’s supported. Please open an issue at Grafana github repo if you find this useful.

Marcus

I think you can best solve that issue by using an alias in Elasticsearch, and refer to the alias in your Grafana Data Source, rather than the index name:

https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-aliases.html

Feature request: