Type to search.

Create an auto-follow pattern to replicate time series indices

ECH

Elastic Cloud Hosted lets you manage and configure one or more deployments of the versioned Elastic Stack, hosted on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

ECK

Elastic Cloud on Kubernetes extends Kubernetes orchestration capabilities to allow you to deploy and manage components of the Elastic Stack.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

ECE

Elastic Cloud Enterprise is a self-managed orchestration platform for deploying and managing the Elastic Stack at scale.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Self-managed

Self-managed deployments are Elastic Stack deployments managed without the assistance of an orchestrator.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

You use auto-follow patterns to automatically create new followers for rolling time series indices. Whenever the name of a new index on the remote cluster matches the auto-follow pattern, a corresponding follower index is added to the local cluster. Note that only indices created on the remote cluster after the auto-follow pattern is created will be auto-followed: existing indices on the remote cluster are ignored even if they match the pattern.

An auto-follow pattern specifies the remote cluster you want to replicate from, and one or more index patterns that specify the rolling time series indices you want to replicate.

To create an auto-follow pattern from in Kibana:

  1. Go to the Cross Cluster Replication management page in the navigation menu or use the global search field.
  2. Choose the Auto-follow patterns tab.
  3. Enter a name for the auto-follow pattern, such as beats.
  4. Choose the remote cluster that contains the index you want to replicate, which in the example scenario is Cluster A.
  5. Enter one or more index patterns that identify the indices you want to replicate from the remote cluster. For example, enter metricbeat-* packetbeat-* to automatically create followers for Metricbeat and Packetbeat indices.
  6. Enter follower- as the prefix to apply to the names of the follower indices so you can more easily identify replicated indices.

As new indices matching these patterns are created on the remote, Elasticsearch automatically replicates them to local follower indices.

The Auto-follow patterns page in Kibana
The Auto-follow patterns page in Kibana
API example

Use the create auto-follow pattern API to configure auto-follow patterns.

JSON
PUT /_ccr/auto_follow/beats
{
  "remote_cluster" : "leader",
  "leader_index_patterns" :
  [
    "metricbeat-*",
    "packetbeat-*"
  ],
  "follow_index_pattern" : "{{leader_index}}-copy"
}
  1. Automatically follow new Metricbeat indices.
  2. Automatically follow new Packetbeat indices.
  3. The name of the follower index is derived from the name of the leader index by adding the suffix -copy to the name of the leader index.