ID: 14829
Title: Monitoring of Elasticsearch indices: Rework grouping of individual indices
Component: Checks & agents
Level: 1
Class: Bug fix
Version: 2.2.0i1
Elasticsearch can be configured to automatically add a timestamp to index names, see
<a
href="https://www.elastic.co/guide/en/elasticsearch/reference/current/date-index-name-processor.html"
target="_blank">the documentation</a>.
This results in index names such as my-index-2018.09.12, my-index-2018.09.13,
my-index-2018.09.14
etc. In Checkmk, users will most likely not want to monitor such indices as individual
services.
Instead, users want to monitor a service called "my-index", which accumulates
data accross the
individual sub-indices.
Before this werk, Checkmk identified matching indices by cutting off index names after the
first
"-". This is far too restrictive. For example, the indices
"customer-a" and "customer-b" were
accumulated into one combined index called "customer", which is most likely
unwanted. Also, this
grouping was not configurable.
As of this werk, Checkmk no longer does any grouping by default. Instead, the grouping can
now be
configured via the discovery ruleset <i>Discovery of Elasticsearch
indices</i>. See the help texts
in the user interface for details regarding the configuration options.
This werk is marked as incompatible because it will result in changed service
configurations (new
and vanished services) if the index names contain "-". Using the new discovery
ruleset, users can
however reproduce the old behaviour before this werk. This can be achieved by grouping
indices
according to the regular expression <tt>[^-]+</tt>.