Time series index settings

Stack

Backing indices in a time series data stream (TSDS) support the following index settings.

index.mode Serverless

(Static, string) Mode for the index. Valid values are time_series and null (no mode). Defaults to null.

index.time_series.start_time Serverless

(Static, string) Earliest @timestamp value (inclusive) accepted by the index. Only indices with an index.mode of time_series support this setting. For more information, refer to Time-bound indices.

index.time_series.end_time Serverless

(Dynamic, string) Latest @timestamp value (exclusive) accepted by the index. Only indices with an index.mode of time_series support this setting. For more information, refer to Time-bound indices.

index.look_ahead_time Serverless

(Static, time units) Interval used to calculate the index.time_series.end_time for a TSDS’s write index. Defaults to 30m (30 minutes). Accepts 1m (one minute) to 2h (two hours). Only indices with an index.mode of time_series support this setting. For more information, refer to Look-ahead time. Additionally this setting can not be less than time_series.poll_interval cluster setting.

index.look_back_time Serverless

(Static, time units) Interval used to calculate the index.time_series.start_time for a TSDS’s first backing index when a tsdb data stream is created. Defaults to 2h (2 hours). Accepts 1m (one minute) to 7d (seven days). Only indices with an index.mode of time_series support this setting. For more information, refer to Look-back time.

index.routing_path Serverless

(Static, string or array of strings) Time series dimension fields used to route documents in a TSDS to index shards. Supports wildcards (*). Only indices with an index.mode of time_series support this setting.

Defaults value:

Indices that are not part of a time series data stream have no default value and require the routing path to be defined explicitly. If a time series data stream is used that is eligible for the index.dimensions-based routing (see index.dimensions_tsid_strategy_enabled), the index.routing_path will be empty. For time series data streams where the index.dimensions-based routing does not apply, this defaults to the list of dimension fields with a time_series_dimension value of true as defined in your component and index templates.

Manually setting a value disables the index.dimensions-based routing strategy (see index.dimensions_tsid_strategy_enabled). For more information, refer to Dimension-based routing.

index.dimensions_tsid_strategy_enabled Stack 9.2.0 Serverless

(Static, boolean) Controls if the _tsid can be created using the index.dimensions index setting. This is an internal setting that will be automatically populated and updated for eligible time series data streams and is not user-configurable. This strategy offers an improved ingestion performance that avoids processing dimensions multiple times for the purposes of shard routing and creating the _tsid. When used, index.routing_path will not be set and shard routing uses the full _tsid, which can help to avoid shard hot-spotting.

If set to false, or index.routing_path is configured manually, or in case the index isn't eligible (see below), shard routing will be based on the index.routing_path instead.

Defaults to true.

This optimized _tsid creation strategy is only available for data streams and if there are no dynamic templates that set time_series_dimension: true. Trying to add such a dynamic template to existing backing indices after the fact will fail the update mapping request and you will need to roll over the data stream instead.

index.mapping.dimension_fields.limit

(Dynamic, integer) Maximum number of time series dimensions for the index. Defaults to 32768.