I have a logstash .conf file whos outputs originally look like this:
if "PAN-OS_config" in [tags] {
elasticsearch {
index => "config"
hosts => ["localhost:9200"]
}
This created indexes in Elasticsearch such as "config", "traffic", "threat", etc. Since I want to setup log rotation and I need (and I read it's best practice) to use have indexes with %{+YYYY.MM} appended to them. I've changed the .conf and updated the index to:
index => "log-panos-config-%{+YYYY.MM}"
However, when I try to reindex the old index to the new, I get the following error:
{
"index" : "logs-panos-config-%{+YYYY.MM}",
"type" : "_doc",
"id" : "CTqktnYBBWs-cule_Kv7",
"cause" : {
"type" : "illegal_argument_exception",
"reason" : "data_stream [logs-panos-config-%{+YYYY.MM}] must be lowercase"
},
"status" : 400
}
Here is what I'm running to reindex:
curl -u user:pass -X POST "localhost:9200/_reindex?pretty" -H 'Content-Type: application/json' -d'
{
"source": {
"index": "panos-config"
},
"dest": {
"index": "logs-panos-config-%{+YYYY.MM}"
}
}
'
I'm assuming the "must be lowercase" is in reference to the "YYYY.MM" but I'm not sure what to do to get the date appended.