Different ILM alias based on fields like indeces

Elastic Stack Beats
1

hey guys, I’m trying to send different logs to different ILM aliases
I’ve found it here for indexes: Configure the Elasticsearch output | Filebeat Reference [7.11] | Elastic
and here for ILM: Configure index lifecycle management | Filebeat Reference [7.11] | Elastic
I’ve set my config like this:
setup.ilm.rollover_alias: 'filebeat_%{[fields.indexalias]}_write'
and in the input.d/1.yml I set

    - add_fields:
           target: ""
           fields:
             indexalias: "uno"

while on 2.yml I set

   - add_fields:
           target: ""
           fields:
             indexalias: "due"

the only result I got even with different combination of
%{[fields.indexalias]}
is
Exiting: failed to read the ilm rollover alias: key not found
any idea?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.