How to connect Elasticsearch datasource?

Grafana Configuration
1

I installed Elasticsearch via

helm repo add bitnami  
helm repo update
kubectl create ns elk
helm upgrade --install elasticsearch --namespace=elk --set master.replicaCount=3,ingest.enabled=false,data.replicaCount=4,master.masterOnly=false,coordinating.replicaCount=0 bitnami/elasticsearch
kubectl port-forward --namespace elk svc/elasticsearch 9200:9200

I added elasticsearch datasource

es00
es001202×512 37 KB

In the setting page

es0
es01056×857 47.6 KB

When I click Save & test button, got this error:

No date field named @timestamp found

es
es813×804 44.1 KB

  • Elasticsearch version is 8.13.4
  • Grafana version is 10.4.1

I have created an index:

curl -X PUT "localhost:9200/my-index-000001?pretty"
{
  "acknowledged" : true,
  "shards_acknowledged" : true,
  "index" : "my-index-000001"
}

curl -X GET "localhost:9200/my-index-000001?pretty"
{
  "my-index-000001" : {
    "aliases" : { },
    "mappings" : { },
    "settings" : {
      "index" : {
        "routing" : {
          "allocation" : {
            "include" : {
              "_tier_preference" : "data_content"
            }
          }
        },
        "number_of_shards" : "1",
        "provided_name" : "my-index-000001",
        "creation_date" : "1716873504498",
        "number_of_replicas" : "1",
        "uuid" : "RRhNy9ZzSwCWk1_2NOCfbw",
        "version" : {
          "created" : "8503000"
        }
      }
    }
  }
}

How to use correctly?

2

Check mapping

curl -X GET "localhost:9200/_mapping?pretty"

Add @timestamp to index

curl -X POST "localhost:9200/my-index-000001/_doc" -H 'Content-Type: application/json' -d'
{
  "@timestamp": "2024-06-03T12:00:00Z",
  "message": "Sample log message"
}
'

Create a template

curl -X PUT "localhost:9200/_template/my_template" -H 'Content-Type: application/json' -d'
{
  "index_patterns": ["my-index*"],
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      }
    }
  }
}
'

Reindexing existing data

curl -X POST "localhost:9200/_reindex" -H 'Content-Type: application/json' -d'
{
  "source": {
    "index": "old_index"
  },
  "dest": {
    "index": "new_index"
  },
  "script": {
    "source": "ctx._source[\"@timestamp\"] = ctx._source.remove(\"timestamp_field\")"
  }
}
'