# Elastic 7 mantaining a single Index **URL:** \ **Category:** Elasticsearch\ **Tags:** ilm-index-lifecycle-management\ **Created:** [June 5, 2019, 11:47am UTC](https://discuss.elastic.co/t/elastic-7-mantaining-a-single-index/184346 "2019-06-05T11:47:47Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Merlin\_Nunez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/merlin_nunez/32/58551_2.png) [@Merlin\_Nunez](https://discuss.elastic.co/u/Merlin_Nunez)\ **Post date:** [June 5, 2019, 11:47am UTC](https://discuss.elastic.co/t/elastic-7-mantaining-a-single-index/184346/1 "2019-06-05T11:47:48Z")
Hi All, I updated our lower environment stack from version 6.3 to version 7, last week, I´m using docker images to deploy elasticsearch+kibana+logstash to a single debian box using docker-compose. I did a complete wipe of all the data and finally got it all working. I kept my original filter for logstash intact. Now I notice that Elasticsearch is keeping a single index with all the documents inside: ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/7/87dca9c71b91a50e499eb849a60789783021518a.png) On the previous version, a new index was created every day and I used elasticsearch curator to clean old index. As I discovered the new index policies I wanted to leverage that to manage my indexes lifecycle, so I configured the following: > ``` > { > "policy": { > "phases": { > "hot": { > "min_age": "0ms", > "actions": { > "rollover": { > "max_age": "1d", > "max_size": "200mb" > }, > "set_priority": { > "priority": 1 > } > } > }, > "warm": { > "min_age": "3d", > "actions": { > "set_priority": { > "priority": 2 > } > } > }, > "cold": { > "min_age": "6d", > "actions": { > "set_priority": { > "priority": 3 > } > } > }, > "delete": { > "min_age": "15d", > "actions": { > "delete": {} > } > } > } > } > } > > ``` Several days have passed now, and I still have a single index. My filter, has no configuration over index generation, as I was using the default pattern logstash-2019.05.29 Thanks in advance, PS: IDK how to format code Regards, ---
**Author:** ![thekm1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thekm1/32/35926_2.png) [@thekm1](https://discuss.elastic.co/u/thekm1)\ **Post date:** [June 5, 2019, 12:16pm UTC](https://discuss.elastic.co/t/elastic-7-mantaining-a-single-index/184346/2 "2019-06-05T12:16:58Z")
Hi @Merlin_Nunez You can edit code with the quote inside your wysiwyg editor ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/3/e3faa0949dac61d1dac96ed305f63740c074e0d3.png) > Then the code should be shown in So to the problem. Can you discribe which steps you used to setup the ilm? Is logstash writing to the write\_alias of the index? Is the [policy added to the index\_template](https://www.elastic.co/guide/en/elasticsearch/reference/6.7/applying-policy-to-template.html) of the logstash template? Thank you ---
**Author:** ![Merlin\_Nunez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/merlin_nunez/32/58551_2.png) [@Merlin\_Nunez](https://discuss.elastic.co/u/Merlin_Nunez)\ **Post date:** [June 6, 2019, 12:35pm UTC](https://discuss.elastic.co/t/elastic-7-mantaining-a-single-index/184346/3 "2019-06-06T12:35:34Z")
I don´t know what ilm means. Logstash is writing to the default alias, since I used this configuration: > output { > elasticsearch { > hosts =\> ["${ELASTICSEARCH\_HOST:192.168.10.125}"] > } > } > Regarding the policy, I have only one and is showing in the index stats: > > ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/4/94b5bd90624a835cbb0ad4f6be9b14f79c8d1a7c.png) Thank you so much for your help and time! ---
**Author:** ![thekm1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thekm1/32/35926_2.png) [@thekm1](https://discuss.elastic.co/u/thekm1)\ **Post date:** [June 6, 2019, 3:07pm UTC](https://discuss.elastic.co/t/elastic-7-mantaining-a-single-index/184346/4 "2019-06-06T15:07:23Z")
Hi @Merlin_Nunez ILM is [Index Lifecycle Management](https://www.elastic.co/guide/en/elasticsearch/reference/current/index-lifecycle-management.html). That is the feature generating the 6 digit number at the end of your index. This feature is handling of new index creation based on parameter(index size, number of docs in index) that you define in the index lifecycle policy. For getting data from logstash to elasticsearch with the ILM you can follow this [doc part](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ilm) Basically you need to set the output plugin in logstash to push data into the index which is the alias for your logstash index "logstash-2019.05.29-000001" I am not sure but, maybe try this: add to the logstash output plugin inside elasticsearch `index: "logstash"` > output { > elasticsearch { > hosts =\> ["${ELASTICSEARCH\_HOST:192.168.10.125}"] > index: "logstash" > } > } ps. I am not familiar with "hosts" =\> ["${ELASTICSEARCH\_HOST:192.168.10.125}"], but i assume that is working because you have data in you logstash index mentioned. Otherwise try `hosts: ":` for example `hosts: "127.0.0.1:9200"` [here is the doc](https://www.elastic.co/guide/en/logstash/6.4/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-hosts). Hope you get a step forward ---
**Author:** ![Merlin\_Nunez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/merlin_nunez/32/58551_2.png) [@Merlin\_Nunez](https://discuss.elastic.co/u/Merlin_Nunez)\ **Post date:** [June 11, 2019, 11:39am UTC](https://discuss.elastic.co/t/elastic-7-mantaining-a-single-index/184346/5 "2019-06-11T11:39:00Z")
As you can see from my first post, I have ILM configured, but it doesnt seem to be activating because the index keeps growing and growing. Yeah sorry, that is because the actual host is passed as a parameter, the correct configuration would be: > output { > elasticsearch { > hosts =\> ["${ELASTICSEARCH\_HOST}"] > } > } > And then I pass the host as IP:port > IN theory for logstash the default value for the index parameter is logstash-{date}-{rollup} ---
**Author:** ![thekm1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thekm1/32/35926_2.png) [@thekm1](https://discuss.elastic.co/u/thekm1)\ **Post date:** [June 11, 2019, 12:50pm UTC](https://discuss.elastic.co/t/elastic-7-mantaining-a-single-index/184346/6 "2019-06-11T12:50:29Z")
@Merlin_Nunez Yes I can see from your first post that the ILM is configured and also that you have a index alias called `logstash` but as you said the default in output plugin elasticsearch for index value is `"logstash-%{+YYYY.MM.dd}"` So I think that you should write from logstash to the alias, which is called `logstash` Did you tried to set the index in elasticsearch output to `index: "logstash"`? Did it worked? What make a bit curious as well is that your index is in action rollover. And this this means that a new index going to get created. Please try this. - Set the index in elasticsearch output to `index: "logstash"`? Did it worked? - Run the [ilm explain](https://www.elastic.co/guide/en/elasticsearch/reference/7.1/ilm-explain-lifecycle.html) on that index. and post the response here ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 9, 2019, 12:50pm UTC](https://discuss.elastic.co/t/elastic-7-mantaining-a-single-index/184346/7 "2019-07-09T12:50:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.