Hello,
By default, logstash create indices in the format logstash-YYYY.MM.DD, which essentially creates one index per day. Is it possible to disable this feature and force logstash to push data to a specific index name?
Thanks for your help
Hello,
By default, logstash create indices in the format logstash-YYYY.MM.DD, which essentially creates one index per day. Is it possible to disable this feature and force logstash to push data to a specific index name?
Thanks for your help
Yes, just change the index
name in the output.
But my question would be; Why do you want to do this?
Thanks for your help Mark. I had like to push all log data in one index per customer. We will normally have a maximum of 5 million records per index. Do you think it is a good idea? (I'm a total noob in ElasticSearch).
No, because how are you going to age data out easily?
You're better off using time based indices!
Thats an interesting point. Actually, we have to retain logs for 2 years. I'm not sure if rotating indexes every day is a good idea as we are going to have hundreds of indices per customer. Do you think it is a good idea? Also, is there a performance gain if we store indexes by day?
Move to weekly/monthly instead of daily.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.