Skip to main content
Admins manage indexes from Settings → Indexes: the index list, how each index appears in the search UI, the sources that feed it, and deletion.

​
Indexes list

Settings → Indexes lists every index in Quickwit, read live on each page load. An index created directly in Quickwit appears on the next refresh. Filter by ID with the search box, and click a row to open its detail page.

​
Create an index

Click Create index to define a new index from a form. See Create a custom index for every field, type, and tokenizer the form offers.

​
Edit an index

Click Edit on the index detail page to change its mode, dynamic mapping, default search fields, tag fields, partition key, retention, commit timeout, Store source, and Index field presence. You can also add new fields. Default search fields take effect on the next query, across all documents. Retention applies to existing splits. Every other change applies only to documents indexed after you save.
Enabling retention or shortening its period deletes every existing split older than the new period on the next cleanup run.
The index ID, index URI, timestamp field, and existing fields can’t change. To change them, delete and recreate the index.

​
Index detail page

The detail page header shows the index ID and the Open in Logs (or Open in Traces for the span store), Edit, and Delete actions. Below it are four tabs: Overview, Configuration, Fields, and Sources.

​
Overview tab

The page opens on the Overview tab:
  • Stats: document count, index size, uncompressed size, compression ratio, split count, and the time of the last event. A green dot next to the last event means the index received data in the last five minutes.
  • Events, last 24 hours: indexed events over time. Drag across the chart to open that range in Logs. The span store doesn’t show this chart.
  • Index size: how the index has grown over the selected range.
  • Ingest keys: the ingest API keys that write to this index. On the span store, it lists every ingest API key, because every key’s spans go there.
  • Search activity: searches against this index, their latency, and who runs the most.

​
Configuration tab

The Configuration tab holds Rootprint’s presentation settings for the index: a display name and the field-role mappings. These settings control presentation only and never touch the underlying index data.

​
Display name

An optional label shown in the index selector and throughout the search UI, such as “Application Logs” instead of otel-logs-v0_9. When left blank, Rootprint uses the index ID.

​
Field-role mappings

These settings tell Rootprint which fields carry the log level, message, stacktrace, trace ID, and search context. The defaults match the OpenTelemetry log schema, so the bundled otel-logs-v0_9 index works without configuration. For a custom-schema index, override them so the log level, message, and traceback render correctly. Every setting accepts dot-notation paths to nested or JSON-object fields.

​
Fields tab

Lists every field in the index schema with its type and whether it is fast. Filter by name to find a specific field. The view is read-only. To add fields, edit the index.

​
Sources tab

Sources feed documents into the index. Each row shows the source ID, its type, and whether it is enabled. Click a row to open the source detail page, or use Create source to add a new one.

​
Built-in sources

Quickwit’s built-in sources, such as _ingest-api-source and _ingest-cli-source, back the HTTP and OTLP ingest endpoints. You can view them but not edit, disable, or delete them from Rootprint.

​
Creating a source

Click Create source on the Sources tab and pick a type: Amazon Kinesis (a Kinesis data stream), File (S3 / SQS notifications) (files referenced by SQS messages), or Apache Kafka (a Kafka topic). Quickwit starts pulling documents into this index as soon as the source is saved. Every source needs a Source ID that starts with a letter and is 3–255 characters of letters, digits, -, or _. The source ID and type are fixed once the source is created. The form is split into two tabs: Connection (where the data comes from) and Transform (VRL) (an optional per-document script). Kinesis and file sources take AWS credentials from the environment of the Quickwit container (standard AWS_* environment variables, an instance role, or other ambient credentials), not from the form. The connection fields depend on the source type:
All three source types also accept two optional fields:

​
Editing a source

Open a source created in Rootprint to edit it in place. The same tabs appear, pre-filled with the current configuration, and saving applies the change immediately. Sources created directly in Quickwit are read-only.

​
Transforms (VRL)

The Transform (VRL) tab holds an optional Vector Remap Language script that runs on every document before it is indexed. Use it to normalize fields, drop sensitive keys, or reshape payloads. For example:
Leave the script blank to ingest documents unchanged.

​
Enable, reset, and delete

The source detail page header offers three actions for editable sources:
  • Disable / Enable pauses or resumes ingestion from the source without removing it.
  • Reset checkpoint clears the source’s ingestion position so it re-processes from the beginning.
  • Delete removes the source from Quickwit (confirmation required). Ingestion stops; you can recreate it later.
Resetting a checkpoint makes Quickwit re-read the source from the start, which can produce duplicate documents. Use it only when you intend to re-ingest.

​
Deleting an index

The Delete button in the index header permanently removes the index along with every document and source configured on it. To confirm, type the exact index ID and click Delete.
  • Indexes: schema details for the built-in OpenTelemetry index and custom index concepts.
  • Create a custom index: the Create index form for non-OpenTelemetry schemas.
  • HTTP endpoint: how ingest API keys and the endpoint interact with these sources.