The Settings → Indexes section gives admins a single place to create indexes, inspect every configured index, configure how each is presented in the search UI, manage the data sources that feed it, and delete indexes that are no longer needed.
Structural changes such as deleting an index or creating, editing, toggling, or deleting a
source persist to the index storage backend (the embedded Quickwit engine), not just
Rootprint’s local presentation metadata. The index list, fields, and sources are read live on
each load.
Indexes list
Navigate to Settings → Indexes to see every configured index. The list is read live on each page load, so an index already present in your attached Quickwit appears here on the next refresh with no restart required. Each row shows the index ID and its visibility (Public, Admins, or Hidden). Use the search box to filter by ID, and click any row to open its detail page.
Create an index
Click Create index on the Settings → Indexes page to define a new index from a form — index ID, schema mode, field mappings, timestamp field, retention, and more — with no YAML required. Rootprint creates the index and opens its detail page when you save. The same form is available over the API as POST /api/indexes.
See Create a custom index for a walkthrough of every field, the field types and tokenizers the form offers, and the schemas that need direct Quickwit configuration.
Index detail page
The detail page header shows the index ID and a Delete action. Below it are three tabs: Configuration, Fields, and Sources.
Configuration tab
The Configuration tab holds the Rootprint-specific presentation settings for the index: a display name, search visibility, and the field-role mappings that tell Rootprint which fields carry the log level, message, stacktrace, and search context. These settings control presentation only and never touch the underlying index data.
Display name
An optional human-readable label shown in the index selector and throughout the search UI. When left blank, Rootprint uses the index ID. Use a display name to present friendlier names to your users (e.g. “Application Logs” instead of otel-logs-v0_9).
Visibility
Controls which users can see and query the index.
| Visibility | Who can access |
|---|
Public (all) | Every signed-in user. |
Admins (admin) | Admin users only. Regular users cannot see or query the index. |
Hidden (hidden) | Hidden from the index selector and the search APIs. Admins can still manage the index here, and ingest API keys scoped to a hidden index continue to accept writes. |
Field-role mappings
These settings tell Rootprint which fields in your index carry specific log data. The defaults match the OpenTelemetry log schema.
| Setting | Default | What it controls |
|---|
| Level field | severity_text | The field carrying the log severity (e.g. INFO, ERROR, WARN). Drives row color-coding and the severity filter. Required. |
| Message field | body.message | The primary human-readable message shown per row in the log list. Required. |
| Traceback field | attributes.exception.stacktrace | Dot-notation path to stacktrace data. When set and a log entry contains it, a Traceback tab appears in the log detail drawer. Optional; clear it if your schema has none. |
| Context fields | (none) | Fields used for log-context search. Leave empty to search across all fields. Supports dot-notation; entered as tags (press Enter to add). |
otel-logs-v0_9 index (and any other index using the same field names) works without configuration. For custom-schema indexes, override the values here so the level, message, and traceback render correctly. If your OTel instrumentation captures exception stacktraces, the default traceback path (attributes.exception.stacktrace) enables the Traceback tab with syntax-highlighted stacktrace rendering.
Fields tab
Lists every field in the index schema with its type and a Fast indicator (whether the field is stored in column-oriented storage for efficient ranges, aggregations, and sorting). Filter by name to find a specific field. This is a read-only view of the index schema. To change field definitions, recreate the index from the Create-index form.
Sources tab
Data sources are the pipelines Quickwit uses to receive or pull documents for the index, for example the built-in _ingest-api-source that backs the HTTP and OTLP ingest endpoints, or an external source that pulls from Amazon Kinesis, Apache Kafka, or files announced over SQS. Each row shows the source ID, its type, and whether it is enabled. Click a row to open the source detail page, or use Create source to add a new one.
Built-in sources
Quickwit’s own sources (_ingest-api-source, _ingest-cli-source, and any source whose type is ingest-api/ingest-cli or whose ID starts with an underscore) are managed by Quickwit. They back the HTTP and OTLP ingest endpoints and can be viewed but not edited, disabled, or deleted from Rootprint. Opening one shows a read-only summary of its configuration.
Creating a source
Click Create source on the Sources tab. Rootprint can create three source types; pick one and Quickwit starts pulling documents into this index as soon as the source is saved.
| Source type | Pulls from |
|---|
| Amazon Kinesis | A Kinesis data stream. |
| File (S3 / SQS notifications) | Files referenced by messages on an SQS queue, typically S3 event notifications, or raw object URIs. |
| Apache Kafka | A Kafka topic. |
-, or _. The source ID and type are fixed once the source is created.
The form is split into two tabs: Connection (where the data comes from) and Transform (VRL) (an optional per-document script). The connection fields depend on the source type:
| Field | Required | Notes |
|---|
| Stream name | Yes | The Kinesis stream to consume. |
| AWS endpoint | Yes | Provide either a Region (e.g. us-east-1) or a Custom endpoint (e.g. http://localhost:4566); not both. |
AWS_* environment variables, an instance role, or other ambient credentials).| Field | Required | Notes |
|---|
| SQS queue URL | Yes | The SQS queue that receives the file notifications (e.g. https://sqs.us-east-1.amazonaws.com/123456789/my-queue). |
| Message type | Yes | How each SQS message references the file: S3 notification (an S3 event payload, the default) or Raw URI (the message body is the object URI). |
| Field | Required | Notes |
|---|
| Topic | Yes | The Kafka topic to consume. |
| Client params | No | A JSON object of librdkafka client properties, including bootstrap.servers, for example { "bootstrap.servers": "localhost:9092" }. |
| Client log level | No | Verbosity of the Kafka client log: debug, info (the default), warn, or error. |
| Backfill mode | No | When enabled, Quickwit reads the topic from the beginning once and then stops, instead of following it continuously. Use it for a one-time import. |
| Field | Notes |
|---|
| Input format | The document format on the wire. Defaults to JSON. Other choices: json, plain_text, otlp_logs_json, otlp_logs_protobuf, otlp_traces_json, otlp_traces_protobuf. |
| Number of pipelines | Ingestion concurrency for this source. Leave blank to use the default of one. |
| VRL script | An optional Vector Remap Language program run on each document before indexing; see below. Leave blank to disable. |
Editing a source
Open any Rootprint-created source (Kinesis, file, or Kafka) from the list to edit it in place. The same Connection and Transform tabs appear, pre-filled with the current configuration; the source ID and type are read-only. Saving applies the change immediately. Sources created directly in the attached Quickwit and system sources are shown read-only.
The Transform (VRL) tab holds an optional Vector Remap Language script that runs on every document before it is indexed, useful for normalizing fields, dropping sensitive keys, or reshaping payloads. For example:
Leave the script blank to ingest documents unchanged.
Enable, reset, and delete
The source detail page header offers three actions for editable sources:
- Disable / Enable pauses or resumes ingestion from the source without removing it.
- Reset checkpoint clears the source’s ingestion position so it re-processes from the beginning.
- Delete removes the source from Quickwit (confirmation required). Ingestion stops; you can recreate it later.
Resetting a checkpoint makes Quickwit re-read the source from the start, which can produce
duplicate documents. Use it only when you intend to re-ingest.
Deleting an index
The Delete button in the index header permanently removes the index along with every document and source configured on it.
To prevent accidents, the modal requires you to type the exact index ID before the Delete.
Related pages
- Indexes: schema details for the built-in OpenTelemetry index and custom index concepts.
- Create a custom index: the Create-index form for non-OpenTelemetry schemas.
- HTTP endpoint: how ingest API keys and the endpoint interact with these sources.
