I see this confusion all the time when people get their hands on Elasticsearch or Kibana without proper observability context. It's a foundational concept you need to get right before you start shipping logs or metrics.
An **index** is the actual data storage unit in Elasticsearch. Think of it like a database table. It holds your documents (log lines, traces, metrics) and their inverted indices for fast searching. You create one for a specific data stream or source.
```json
// This creates an index named 'app-logs-2024.01.15'
PUT /app-logs-2024.01.15
{
"settings": { "number_of_shards": 3 }
}
```
An **index pattern** is purely a Kibana abstraction. It's a search pattern (with wildcards) that groups multiple indices together for visualization and analysis. You never query an index pattern directly in Elasticsearch—you use it in Kibana to say "show me data from all indices that match this pattern."
* Index: `app-logs-2024.01.15` (contains data)
* Index Pattern: `app-logs-*` (references all indices starting with 'app-logs-')
* Another Index Pattern: `app-logs-2024.01.*` (references only January 2024 indices)
The practical difference? If you're building dashboards in Kibana, you use an index pattern like `apm-*` to span all your APM indices across time. If you're writing a direct Elasticsearch query via API, you target a specific index or a comma-separated list of indices. Getting this wrong leads to empty visualizations or queries returning no data.
-ninja
Observability is not monitoring