Configure log data sources
Stack Serverless
The observability:logSources Kibana advanced setting defines which index patterns your deployment or project uses to store and query log data.
Configure this setting at Stack Management → Advanced Settings or by searching for Advanced Settings in the global search field.
Note
Adding indices to the observability:logSources setting that don't contain log data may cause degraded functionality. Changes to this setting can also impact the sources queried by log threshold rules.
Important
Using the saved_objects API to import log data sources has the following limitations:
- To import the log data source, you need to import the entire Advanced Settings saved object. This overwrites any other changes that you've made to your Advanced Settings in the target cluster, not just
observability:logSources. - This approach is backward compatible, but not forward compatible. You cannot import the settings from an older version to a newer version.
To configure log data sources using the saved_objects API and the Advanced Settings saved object:
- Go to Stack Management → Advanced Settings from the navigation menu or use the global search field.
- Configure your custom log sources in
observability:logSources. - Go to Stack Management → Saved Objects from the navigation or use the global search field.
- Export the Advanced Settings saved object.
- Import the saved object to your target cluster using the import saved objects API.