Logstash 7.16.2
Elasticsearch 7.16.2
Summary
In a scenario that beat processors are sending to logstash, and logstash has ilm configured, if the working index is deleted, a new one is created (as expected), but the naming convention is wrong.
I realize there should not be a reason for an index to be deleted in this way, but in the event that it did happen, it would be expected that the system would create a new index with the appropriate name. Things like index patterns/etc can break when indexes are not formatted as expected.
Problem Scenario:
Given this logstash config:
input {
beats {
port => 5000
}
}
output {
elasticsearch {
hosts => ["http://localhost:9200"]
ilm_enabled => true
ilm_rollover_alias => "filebeat"
ilm_pattern => "{now/d}-000001"
ilm_policy => "30-days-default"
}
}
When the beats publisher starts to push into logstash, the index name format is automatically created as expected (ex: filebeat-2021.12.20-000001
)
With the above scenario prepared, steps to reproduce:
- Delete the current index that was created (ex:
filebeat-2021.12.20-000001
) - Wait for the beats publisher to push more messages to logstash
- A new index is automatically created
Expected behavior:
- The new index that was created should follow the same naming scheme (ex:
filebeat-2021.12.20-000001
,filebeat-2021.12.20-000002
, etc)
Actual behavior:
- The new index created is only the rollover alias: (ex:
filebeat
) with no pattern applied