Hourly indices with ingest pipeline - getting 12 hours always

Elastic Stack Elasticsearch
1

I'd like to create hourly indices (for test purpose), creating the timestamp suffix in an ingest pipeline, but encountered an issue: it does not matter, which hour I put, I'm getting 12 hours as the result.
ES version is 7.4.2
Pipeline (note I use a non-valid character : in the index name intentionally, it's useful for debugging):

PUT _ingest/pipeline/news-index-name
{
  "description": "news index naming",
  "processors" : [
    {
      "date_index_name" : {
        "field" : "@timestamp",
        "index_name_prefix" : "news-",
        "date_rounding" : "s",
        "date_formats": ["ISO8601", "yyyyMMdd"],
        "index_name_format": "yyyy-MM-dd:hh",
         "on_failure" : [
          {
            "set" : {
              "field" : "_index",
              "value" : "news-failed"
            }
          }
        ]
      }
    }
  ]
}

Indexing:

PUT news/_bulk?pipeline=news-index-name
{"index":{}}
{"@timestamp":"2019-11-15T07:39:12+01:00"}

Response:

{
  "took" : 0,
  "ingest_took" : 0,
  "errors" : true,
  "items" : [
    {
      "index" : {
        "_index" : "<news-{2019-11-15:06||/s{yyyy-MM-dd:hh|UTC}}>",
        "_type" : "_doc",
        "_id" : null,
        "status" : 400,
        "error" : {
          "type" : "invalid_index_name_exception",
          "reason" : "Invalid index name [news-2019-11-15:12], must not contain ':'",
          "index_uuid" : "_na_",
          "index" : "news-2019-11-15:12"
        }
      }
    }
  ]
}

As one can see from the response, it uses the correct value in the index template (06 hours UTC), but a wrong value in the error section, which is always 12.

Can some one please help with that?
Thanks a lot!

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.