Lab 7.1: Data management concepts

Objective:

In this lab, you will work with index aliases and templates to create a time-series index that can leverage rollover.

1. Within Kibana, go to Stack Management -> Index Management.

2. Define a new component template that satisfies the following requirements:

   • the name of the component template is time-series-mappings
   • there are three mapped fields defined:
     • a @timestamp field of type Date
     • a status field of type Keyword
     • a message field of type Text
   Solution

   • Open the component template tab.
   • Click Create component template
   • Name your component template , and click Next
   • On the Index Settings page, click Next
   • On the Mappings page, add the following mappings:
     • a @timestamp field of type Date
     • a status field of type Keyword
     • a message field of type Text
   • Click Next when the three fields are defined
   • On the Aliases page, click Next
   • On the Review page, click Create component template

   Alternatively, you can run the following command in Console:

   PUT _component_template/time-series-mappings
   {
     "template": {
       "mappings": {
         "properties": {
           "@timestamp": {
             "type": "date"
           },
           "status": {
             "type": "keyword"
           },
           "message": {
             "type": "text"
           }
         }
       }
     }
   }
   

3. EXAM PREP: Create a new index template that satisfies the following requirements:

   • the name of the index template is my-metrics-template
   • the index pattern matches any index that starts with the name my-metrics-
   • set the priority to 500
   • the index template uses your time-series-mapping component template
   Solution

   • Click the Index Templates tab, and then click Create template
   • Name your template my-metrics-template
   • Set the index pattern to my-metrics-*
   • Set priority to 500, and leave everything else as default
   • Click Next
   • On the next screen, add the time-series-settings component template you created by cliking the + symbol next to the component
   • Click Next until you get to the Review screen, then click Create template

   Alternatively, you can run the following command in Console:

   PUT _index_template/my-metrics-template
   {
     "priority": 500,
     "index_patterns": [
       "my-metrics-*"
     ],
     "composed_of": [
       "time-series-mappings"
     ]
   }
   

4. In Console, run the following to confirm your template is appropriately defined:

   POST _index_template/_simulate_index/my-metrics-test
   

   The output should look like this:

   {
     "template" : {
       "settings" : {
         "index" : {
           "routing" : {
             "allocation" : {
               "include" : {
                 "_tier_preference" : "data_content"
               }
             }
           }
         }
       },
       "mappings" : {
         "properties" : {
           "@timestamp" : {
             "type" : "date"
           },
           "message" : {
             "type" : "text"
           },
           "status" : {
             "type" : "keyword"
           }
         }
       },
       "aliases" : { }
     },
     "overlapping" : [ ]
   }
   

5. Create a second component template named time-series-settings that sets the number_of_replicas to 2.

   Solution

   Add the number_of_replicas value to the index settings page of the component template wizard:

   {
     "number_of_replicas": 2
   }
   

   Here is the command if you want to use Console:

   PUT _component_template/time-series-settings
   {
     "template": {
       "settings": {
         "index": {
           "number_of_replicas": "2"
         }
       }
     }
   } 
   

6. Update the my-metrics-template to use your new time-series-settings component.

   Solution

   If you are using Console:

   PUT _index_template/my-metrics-template
   {
     "priority": 500,
     "index_patterns": [
       "my-metrics-*"
     ],
     "composed_of": [
       "time-series-mappings",
       "time-series-settings"
     ]
   }
   

7. Test that your new template settings have been applied by rerunning the following command:

   POST _index_template/_simulate_index/my-metrics-test
   

   The output should now look like this:

   {
     "template" : {
       "settings" : {
         "index" : {
           "number_of_replicas" : "2",
           "routing" : {
             "allocation" : {
               "include" : {
                 "_tier_preference" : "data_content"
               }
             }
           }
         }
       },
       "mappings" : {
         "properties" : {
           "@timestamp" : {
             "type" : "date"
           },
           "message" : {
             "type" : "text"
           },
           "status" : {
             "type" : "keyword"
           }
         }
       },
       "aliases" : { }
     },
     "overlapping" : [ ]
   }
   

8. Create a new index named my-metrics-000001 configured to be the write index for the my-metrics alias. Please view the details of your new index and verify it has all the correct settings from the index template.

   Solution

   PUT my-metrics-000001
   {
     "aliases": {
       "my-metrics": {
         "is_write_index": true
       }
     }
   }
   
   GET my-metrics-000001
   

9. Let's try a rollover! Call the rollover API with the my-metrics alias and set maximum age of 2 seconds.

   Solution

   POST my-metrics/_rollover
   {
     "conditions": {
       "max_age": "2s"
     }
   }
   

10. Use a GET my-metrics to confirm that there are now two indices in the alias and the new my-metrics-000002 index is now the write index.

Summary:

In this lab, you saw how to define an index template that uses component templates. You also saw how to perform a simple rollover operation.