Help explain Logstash with rollover

Elastic Stack Logstash
1

Hi,

We're using the OSS version of the stack and are ingesting logs in the following way:

Syslog -> Logstash -> Elasticsearch

We want to utilize the Rollover API but we're having difficulty grasping how to implement it without ILM.

It's my understand that we can change the Elasticsearch output to point to a alias, instead of an index name.

What steps do i need to take to implement logstash to elasticsearch with rollover api capabilities?

In my mind it would look something like this:

  1. Create alias used for rollover
  2. Create a template that would set the correct amount of shards etc for the alias
  3. Change the logstash Elasticsearch output to the alias instead of the index
  4. Schedule a cron job which runs the rollover API with some conditions
  5. If the condition is met then a new index should be created and i want logstash to start writing to that index.

Is this correct?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.