Skip to main content
The bundled otel-logs-v0_9 index works for any application that emits OpenTelemetry logs. For everything else (audit trails, third-party log formats, application events with a specialized schema), create an index with the fields and types your data needs. Create indexes from Settings → Indexes → Create index: a form, with no YAML or direct Quickwit calls. Rootprint creates the index in Quickwit and opens its detail page when you save, where you map its fields into the search UI.
The same form is available over the API as POST /api/indexes. See the Index management API.

​
Index ID

An index ID starts with a letter and runs 3–255 characters of letters, digits, -, or _. Ingest requests never name it — the ingest API key you scope to this index is what routes writes here.

​
Mode

The schema mode decides what Quickwit does with fields you didn’t declare in the field mappings.

​
Timestamp field

Pick the datetime field the index uses as its time axis, chosen from the datetime fields you define below. It is used to:
  • Partition splits by time, so time-bounded searches only scan relevant splits.
  • Drive the retention policy.
  • Enforce search bounds: the Rootprint time picker passes start_timestamp and end_timestamp against this field.
Rootprint always stores the timestamp field as fast, so its fast toggle is hidden in the field editor. You must define at least one datetime field before you can pick one here.

​
Fields

Add a row per field with Add field, then set its name, type, and options. At least one field is required, and the toggles come preselected to the recommended defaults (indexed, stored, and fast on).

​
Field types

​
Indexed, stored, and fast

Every field exposes three toggles:
  • Indexed: the field is added to an inverted index and is searchable via text queries. When off, you cannot use the field in search predicates.
  • Stored: the field’s value is kept and returned in search results.
  • Fast: the field is stored in column-oriented storage (like Lucene DocValues), enabling efficient range queries, aggregations, and sorting. The form preselects fast on for every field; the timestamp field is always fast.

​
Per-type options

Depending on the field type, the editor exposes extra options: text and json fields also have a default search checkbox. Tick it to add the field to the index’s default search fields — the fields searched when a query doesn’t name one, so timeout matches message:timeout without the user typing the field. The record option controls how much term data the inverted index keeps: basic (which documents contain the term), freq (also term frequency), or position (also token positions, required for phrase queries). For datetime fields, input formats is how Rootprint parses incoming values. Tick any of the presets (rfc3339, iso8601, rfc2822, unix_timestamp) and add custom strptime patterns one per line. Output controls how values are returned (rfc3339 or unix_timestamp_secs/millis/micros/nanos), and precision sets the granularity of the fast column (seconds, milliseconds, microseconds, nanoseconds).

​
Tokenizers

text and json fields take a tokenizer, which decides how the value is split for search. Tokenization happens at index time and cannot be changed without recreating the index. The bundled OTel index uses raw for severity_text and service_name, and default for body. The same choices work well for most application logs.

​
Retention

Enable retention to drop splits older than a fixed window. Period accepts durations like 48 hours, 90 days, 12 months, 2 years; schedule controls how often the cleanup runs (hourly, daily, weekly, monthly, yearly, or a cron expression), and defaults to daily when left blank.
Retention drops entire splits, so the actual cutoff floats by the split duration. A document timestamped 30 days ago is not deleted at exactly day 30 — its split survives until every document in it is past the period. Plan for hours of lag, not seconds.

​
Other settings

The rest of the form is optional and most deployments leave it untouched:

​
Use it from Rootprint

Saving the form lands you on the new index’s detail page. To finish wiring it up:
  1. On the Configuration tab, set the field-role mappings so the message, level, and traceback render correctly.
  2. Create an ingest API key scoped to the index and route writes through the HTTP endpoint or, for OpenTelemetry-shaped data, the OTLP endpoint.