Date stamp in index name is being ignored

I'm upgrading to ELK 7.5 and finding a lot of things have changed since 5.5 (no kidding).

In particular I can't seem to make logstash write to an ES index named for the current date. When testing with a very simple logstash config file that I believe should write to an index named logstash-YYYY.MM.dd, instead it creates an index called "logstash" Besides this messing with my existing maintenance scripts, my index template is looking for "logstash-*" so the index created has the wrong settings.

the output stanza of logstash.conf:
output {

elasticsearch {
    hosts => ["http://localhost:9200"]
    index => "logstash-%{+YYYY.MM.dd}"


Grateful for any guidance...

You are seeing ILM in action.

Doh. I was even already trying to disable ILM but in the index template, which wasn't being applied because the "logstash" name doesn't fit the "logstash-*" wildcard the template was looking for.

Disabled ILM in elasticsearch.yml and all is well.


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.