How can I create a new index called "index_global" and point all these 5 indexes to this global index?

[im_bharath]

Hello All,

We are currently getting data from an application into these 5 indexes(index1, index2, index3, index4, index5.. )  from different locations around the world.  And I want to try and create a new index called "index_global" and point all these 5 indexes to this global index so that all the data can be available under a single index. 

Hope this makes sense. 

I would really like to understand, how i can achieve this. Any help on this would be really appreciated. 

Thanks and cheers. 

[im_bharath]

Thank you very much @richgalloway 

[im_bharath]

Hey @richgalloway thank you for the response. 

So when i say "point these indexes 5 indexes to global index", I want the application to send the data in to this newly created "index_global" instead of these 5 indexes. 

[richgalloway]

Change your inputs.conf files to replace "index_n" with "index_global".

[richgalloway · Accepted solution]

It's not clear what your end goal is.  What do you mean by "point these 5 indexes to this global index"?

It's easy to create the "index_global" index.  it's also fairly easy to have the inputs send their data to index_global instead of index_n.  That will not move the data that is already in index_n, however.  Nor can index_global be an alias for another (5) index(es).  The closest you can get is a macro, perhaps called "index_global" this is defined as 

index IN (index_1 index_2 index_3 index_4 index_5)

and is invoked as

`index_global` sourcetype=foo ...