Boostrap Elasticsearch Index Template

Elastic Stack Elasticsearch
1

Hello,

I am trying to configure Filebeat to write data to a custom index like my-index-{now/d}-000001 (using filebeat-8.8.1 and Elastcicsearch 8.8.1).

I have followed this guide; But when i try to bootstrap the index using;

PUT my-index-%7Bnow%2Fd%7D-000001
{ 
  "aliases": {
    "my-index": {}
  }
}

I get the error below;

{
  "error": {
    "root_cause": [
      {
        "type": "invalid_index_name_exception",
        "reason": """Invalid index name [my-index-{now/d}-000001], must not contain the following characters ['\',' ','"','<','*','?','>','|',',','/']""",
        "index_uuid": "_na_",
        "index": "my-index-{now/d}-000001"
      }
    ],
    "type": "invalid_index_name_exception",
    "reason": """Invalid index name [my-index-{now/d}-000001], must not contain the following characters ['\',' ','"','<','*','?','>','|',',','/']""",
    "index_uuid": "_na_",
    "index": "my-index-{now/d}-000001"
  },
  "status": 400
}

Is there something i am missing?

2

Hi @mibeyki

I think this will work for you, I can't remember right off hand the specifics but the <> tell it to interpret, that used to be in the docs somewhere but can't find it right now

PUT <my-index-%7Bnow%2Fd%7D-000001>
{ 
  "aliases": {
    "my-index": {}
  }
}

# Result 
{
  "acknowledged": true,
  "shards_acknowledged": true,
  "index": "my-index-2023.07.01-000001"
}

POST my-index/_rollover

{
  "acknowledged": true,
  "shards_acknowledged": true,
  "old_index": "my-index-2023.07.01-000001",
  "new_index": "my-index-2023.07.01-000002",
  "rolled_over": true,
  "dry_run": false,
  "conditions": {}
}

EDIT Funny I just found it here

The more correct way...

PUT %3Cmy-index-%7Bnow%2Fd%7D-000001%3E
{
  "aliases": {
    "my-alias": {
      "is_write_index": true
    }
  }
}
3

Fantastic! :smile: thank you @stephenb. Much appreciated your quick response and solution on this!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.