Hi community,
I think I discovered a corner case bug in the elasticsearch output plugin. Currently the license of my elasticsearch cluster has expired and it feels like the ILM availability is no longer properly detected by the output plugin.
My config looks like this:
output {
elasticsearch {
hosts => [ "host1", "host2" ]
ilm_rollover_alias => "my-specific-alias"
ilm_pattern => "{now/d}-000001"
ilm_policy => "specific_alias_lifecycle"
user => "user"
password => "password"
}
}
I know that the lifecycle feature is not disabled due to the expired license, because my indices still get cycled through. After restarting one of my logstash nodes though, this one is not able to detect ILM feature and therefore ships my data to the default logstash-* index instead. In the logs I see this:
New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch", :hosts=>["host1", "host2"]}
Using a default mapping template {:es_version=>7, :ecs_compatibility=>:disabled}
Index Lifecycle Management is set to 'auto', but will be disabled - Index Lifecycle management is not available in your Elasticsearch cluster
Attempting to install template {:manage_template=>{"index_patterns"=>"logstash-*", "version"=>60001, "settings"=>{...}}}
Does anybody ever have seen this? Is it maybe a bug in logstash-output-elasticsearch/ilm.rb at master · logstash-plugins/logstash-output-elasticsearch · GitHub?
It's not a big issue for myself, since I will refresh my license in the next days, but with ILM being a feature, which is not degraded by an expired license, this is at least unexpected.
Best regards,
Sebastian