Bootstrap new index - ILM

Elastic Stack Elasticsearch
1

Hi,

Trying to get my head around ILM.

My beats are ingested via logstash. When updating beats i point them at elasticsearch to add the new index etc.

My logstash index pattern is along the files of filebeat-version-source-tenantid
Example filebeat-7.5.0-ngfw-id00001

I have created with the bootstrap for now with:

PUT filebeat-7.5.0-ngfw-id0001-000001
{
"aliases": {
"filebeat-rollover":{
"is_write_index": true
}
}
}

The multi-tenancy is the main issue, do I have to do this for every index I will be generating?

Thanks
Phil

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.