Hm, I suppose that could be tricky to keep the rollup job from backfilling. You can specify a pattern (
logstash-* for example), but that will also include all the existing indices that match.
Right now, the best way is probably with an alias that matches only the indices you care about. The difficulty is that you'll need to continually update the alias as new indices are added and old indices are removed.
We would like to add a bit more filtering capability to rollup jobs, but it's not possible right now.
Agreed, this is a relatively important feature that's missing at the moment (issue here if you want to follow: https://github.com/elastic/elasticsearch/issues/33065). We plan to integrate Rollup with ILM soon, which will allow configuring custom rollover when the index hits a certain size, etc. Right now the only option is to let it grow, or start deleting data... neither of which are good solutions.