Adding documentation for remote index use in AD #8191
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -29,9 +29,14 @@ A detector is an individual anomaly detection task. You can define multiple dete | |
| 1. Add in the detector details. | ||
| - Enter a name and brief description. Make sure the name is unique and descriptive enough to help you to identify the purpose of the detector. | ||
| 1. Specify the data source. | ||
| - For **Data source**, choose the index or indexes you want to use as the data source. Alternatively, you can use an alias or index patterns to choose multiple indexes. | ||
vagimeli marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| - Detectors can use remote indexes. You can access them using the `cluster-name:index-name` pattern, as used in [cross-cluster search](https://opensearch.org/docs/latest/search-plugins/cross-cluster-search/). Alternatively, you can select the clusters and indexes you want to use through OpenSearch Dashboards 2.17 or later. | ||
| - (Optional) For **Data filter**, filter the index you chose as the data source. From the **Data filter** menu, choose **Add data filter**, and then design your filter query by selecting **Field**, **Operator**, and **Value**, or choose **Use query DSL** and add your own JSON filter query. Only [Boolean queries]({{site.url}}{{site.baseurl}}/query-dsl/compound/bool/) are supported for query domain-specific language (DSL). | ||
|
There was a problem hiding this comment. Line above: Instead of "here", please use the name of the page for the link text. There was a problem hiding this comment. @natebower This is my bad. The team added new content yesterday after the approved doc review. I needed to reread it and pull it from the editorial queue. I'll work on this and tag you one it's ready. I'm sorry. |
||
|
|
||
|
|
||
| To create a cross-cluster detector through OpenSearch Dashboards, the following [permissions]({{site.url}}{{site.baseurl}}/security/access-control/permissions/) are required: `indices:data/read/field_caps`, `indices:admin/resolve/index`, and `cluster:monitor/remote/info`. | ||
vagimeli marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| {: .note} | ||
|
|
||
| #### Example filter using query DSL | ||
| The query is designed to retrieve documents in which the `urlPath.keyword` field matches one of the following specified values: | ||
|
|
||
|
|
||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Line below: Should "index pattern" be singular?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This singular usage sounds good to me on latest revision:
"- For Data source, choose one or more indexes to use as the data source. Alternatively, you can use an alias or index pattern to choose multiple indexes."