As I understand from this GitHub post and this Elastic Discuss post about having a new daily index (at midnight for my case), the solution to it is not Index Lifecycle Management. Instead, it should be using date math index.
I am trying this out, and using Winlogbeat as a Beats example.
I would like to ask if it is just the simple step of adding these 3 lines in my winlogbeat.yml configuration file?
Line #1: setup.template.name: "winlogbeat-test"
Line #2: setup.template.pattern: "winlogbeat-test-*"
Line #3: output.elasticsearch.index: "winlogbeat-%{[agent.version]}-%{+yyyy.MM.dd}"
The documentation reference page which I looked at for this is found here.
(I have no need for a custom name, and I would like to have the agent's version as part of the index name.)
Right. Thank you for the clarification - this might sound silly, but I would like to find out how many documents are held in an index each day and the size that a daily batch worth of document's holds.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.