Bootstrap new index - ILM


Trying to get my head around ILM.

My beats are ingested via logstash. When updating beats i point them at elasticsearch to add the new index etc.

My logstash index pattern is along the files of filebeat-version-source-tenantid
Example filebeat-7.5.0-ngfw-id00001

I have created with the bootstrap for now with:

PUT filebeat-7.5.0-ngfw-id0001-000001
"aliases": {
"is_write_index": true

The multi-tenancy is the main issue, do I have to do this for every index I will be generating?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.