Type to search.

Configure log data sources

Serverless

Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Serverless interfaces and procedures might differ from classic Elastic Stack deployments.

Stack

The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.

Availability

  • Generally available

    This functionality is generally available and ready for production usage.

Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.

This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

The observability:logSources Kibana advanced setting defines which index patterns your deployment or project uses to store and query log data.

Configure this setting from the Advanced Settings page, which you can open from the navigation menu or by using the global search field.

Note

Adding indices to the observability:logSources setting that don't contain log data may cause degraded functionality. Changes to this setting can also impact the sources queried by log threshold rules.

Important

Using the saved_objects API to import log data sources has the following limitations:

  • To import the log data source, you need to import the entire Advanced Settings saved object. This overwrites any other changes that you've made to your Advanced Settings in the target cluster, not just observability:logSources.
  • This approach is backward compatible, but not forward compatible. You cannot import the settings from an older version to a newer version.

To configure log data sources using the saved_objects API and the Advanced Settings saved object:

  1. Go to Advanced Settings from the navigation menu or use the global search field.
  2. Configure your custom log sources in observability:logSources.
  3. Go to the Saved Objects management page from the navigation or use the global search field.
  4. Export the Advanced Settings saved object.
  5. Import the saved object to your target cluster using the import saved objects API.