Configure advanced settings for streams

Serverless Stack GA 9.2.0

The Advanced tab shows the underlying Elasticsearch configuration details and advanced configuration options for your stream.

You can use the Advanced tab to add descriptions or features that provide useful information to Stream's AI components. You can also manually configure the index or component templates or modify other ingest pipelines used by the stream.

Describe the data in the stream. AI features like system identification and significant events use this description when generating suggestions.

Streams analyzes your data and identifies features. Features are a way to classify some of the data you have in your stream.

Each feature has a natural language description and an optional filter which points to a subset of your data.

For example, in a stream of Kubernetes logs, the feature identification process would be able to identify that you have data from "nginx" which can be found by filtering for WHERE service.name==nginx. It would also include a description defining nginx.

Features provide useful information for AI processes, such as significant events, and are used as the foundation for them.

Avoid editing components marked as managed or any per-data-stream mappings and settings. Processing and schema changes should typically be done through the Streams interface or API, and none of these configuration processes are required. This feature mainly exists to help advanced users maintain familiar workflows.

For classic streams, you can access the following components:

• Index templates
• Component templates
• Pipelines
• Data streams

For both wired ( Stack Preview 9.2.0 Serverless Preview ) and classic streams, you can manually configure:

• Shards: Control how the index is split across nodes. More shards can improve parallelism but may increase overhead.
• Replicas: Define how many copies of the data exist. More replicas improve resilience and read performance but increase storage usage.
• Refresh interval: Control how frequently new data becomes visible for search. A longer interval reduces resource usage; a short one makes data searchable sooner.