config.json

{
  "default_endpoint": "local",
  "endpoints": {
    "local": ["http://localhost:9200", "http://localhost:9201"],
    "dc3": ["https://elasticsearch-dc3.example.com:443"],
    "dc1": ["https://elasticsearch-dc1.example.com:443"],
    "dc2": ["https://elasticsearch-dc2.example.com:443"]
  },
  "indices": [
    "application-*",
    "cdn-*",
    "dc-routing-*",
    "kubernetes-*",
    "syslog-*",
    "*"
  ],
  "field_format": {
    "tracing.trace_id": "<a href=\"https://tracing.example.com/?traceId={tracing.trace_id}&dc={dc}\">{tracing.trace_id}</a> <a class=\"trace-logs\" title=\"Logs for trace_id {tracing.trace_id}\"href=\"/logs?dc={dc}&index={index}&from=now-14d&tracing.trace_id={tracing.trace_id}\">…</a>",
    "request.url": "<a href=\"{request.url}\">{request.url}</a>"
  },
  "default_fields": [
    {
      "match_params": {
        "logger_name": "TracingServletFilter"
      },
      "fields": ["@timestamp", "hostname", "request.method", "request.path", "status.code", "request.headers.user-agent", "timings.duration", "tracing.trace_id"]
    },
    {
      "match_params": {
        "request.path": "",
        "index": "application-*"
      },
      "fields": ["@timestamp", "hostname", "request.method", "request.path", "status.code", "request.headers.user-agent", "timings.duration", "tracing.trace_id"]
    },
    {
      "match_params": {
        "index": "application-*"
      },
      "fields": ["@timestamp", "hostname", "level", "message", "thread_name", "stack_trace", "tracing.trace_id"]
    },
    {
      "match_params": {
        "index": "cdn-*"
      },
      "fields": ["@timestamp", "request.host.subdomain", "request.method", "request.path", "status.code", "user_agent.value", "timings.duration", "tracing.trace_id"]
    },
    {
      "match_params": {
        "index": "dc-routing-*"
      },
      "fields": ["@timestamp", "router.name", "routing.backend_name", "request.method", "request.path", "status.code", "user_agent.value", "timings.duration", "tracing.trace_id"]
    },
    {
      "match_params": {
        "index": "syslog-*"
      },
      "fields": ["@timestamp", "logsource", "facility_label", "severity_label", "program", "message"]
    },

    {
      "match_params": {
        "index": ""
      },
      "fields": ["@timestamp", "type", "message", "tracing.trace_id"]
    }
  ],
  "queries": [
    "/logs?aggregation_terms=level",
    "/logs?application_name=api&level=ERROR,WARN&aggregation_terms=level",
    "/logs?aggregation_terms=status.code&logger_name=TracingServletFilter&application_name=api",
    "/logs?aggregation_terms=status.code&percentiles_terms=timings.duration&logger_name=TracingServletFilter&application_name=api",
    "/logs?index=cdn-*&aggregation_terms=status.code",
    "/logs?index=cdn-*&status.category=5xx&from=now-1d&aggregation_terms=status.code",
    "/logs?timings.duration=>5000&from=now-1h&fields=,timings.duration",
    "/aggregation.svg?index=cdn-*&status.category=5xx&from=now-1d&aggregation_terms=status.code",
    "/raw?index=cdn-*&status.category=5xx&from=now-1d&aggregation_terms=status.code"
  ]
}