Merge "opensearch: automate index pattern creation in dashboards"

Author: Zuul

ansible/roles/opensearch/tasks/post-config.yml

@@ -87,3 +87,30 @@
   when:
     - not ansible_check_mode
     - opensearch_retention_policy_check.status == 404
+
+- name: Create OpenSearch Dashboards Index Pattern
+  become: true
+  kolla_toolbox:
+    container_engine: "{{ kolla_container_engine }}"
+    module_name: uri
+    module_args:
+      url: "{{ opensearch_dashboards_internal_endpoint }}/api/saved_objects/index-pattern/{{ opensearch_log_index_prefix }}-pattern"
+      method: POST
+      status_code: 200, 409
+      url_username: "{{ opensearch_dashboards_user }}"
+      url_password: "{{ opensearch_dashboards_password }}"
+      force_basic_auth: true
+      headers:
+        osd-xsrf: "true"
+      body:
+        attributes:
+          title: "{{ opensearch_log_index_prefix }}-*"
+          timeFieldName: "@timestamp"
+      body_format: json
+      ca_path: "{{ openstack_cacert }}"
+  register: opensearch_index_pattern_create
+  changed_when: opensearch_index_pattern_create.status == 200
+  delegate_to: "{{ groups['opensearch'][0] }}"
+  run_once: true
+  when:
+    - not ansible_check_mode

doc/source/reference/logging-and-monitoring/central-logging-guide.rst

@@ -95,20 +95,38 @@ If you want to prevent OpenSearch Dashboards being exposed on the external
 VIP, you can set ``enable_opensearch_dashboards_external`` to ``false`` in
 ``/etc/kolla/globals.yml``.
 
-First Login
------------
-
-When OpenSearch Dashboards is opened for the first time, it requires creating
-a default index pattern. To view, analyse and search logs, at least one
-index pattern has to be created. To match indices stored in OpenSearch,
-we suggest using the following configuration:
-
-#. Index pattern - flog-*
-#. Time Filter field name - @timestamp
-#. Expand index pattern when searching [DEPRECATED] - not checked
-#. Use event times to create index names [DEPRECATED] - not checked
-
-After setting parameters, one can create an index with the *Create* button.
+Index Pattern Configuration
+---------------------------
+
+Kolla Ansible fully automates the creation of the default index pattern.
+During the deployment or reconfiguration process, an index pattern is
+automatically provisioned. By default, it is dynamically configured to
+match the indices defined by the ``opensearch_log_index_prefix``
+variable (which defaults to ``flog``). This results in an automatic
+index pattern of ``flog-*``.
+
+The time filter field name is automatically set to ``@timestamp``,
+ensuring that all time-based aggregations and histograms work perfectly
+out of the box.
+
+As a result, the **Discover** tab is immediately ready to display
+incoming log data upon your first login, requiring no manual setup
+from the operator.
+
+**Adding Custom Index Patterns Manually**
+
+If you configure custom Fluentd outputs to route specific logs to
+different indices, or if you ingest external metrics into OpenSearch,
+you may still need to create additional index patterns manually.
+To do this:
+
+1. Navigate to **Dashboards Management** -> **Index Patterns** in the
+   OpenSearch Dashboards UI.
+2. Click **Create index pattern**.
+3. Define your custom index pattern (e.g., ``my-custom-logs-*``).
+4. Select the appropriate Time Filter field name (typically
+   ``@timestamp``).
+5. Click the **Create index pattern** button.
 
 Search logs - Discover tab
 --------------------------

releasenotes/notes/automate-opensearch-index-pattern-0b5396fc1cd4de67.yaml

@@ -0,0 +1,11 @@
+---
+features:
+  - |
+    Automated the creation of the default OpenSearch Dashboards
+    index pattern. During deployment or reconfiguration, Kolla
+    Ansible now automatically provisions an index pattern based
+    on the ``opensearch_log_index_prefix`` (defaulting to
+    ``flog-*``) with ``@timestamp`` configured as the time field.
+    This removes the need for operators to manually configure the
+    initial index pattern upon their first login to the Dashboards
+    UI.