How can i create logstash index every 4 hours except 1 hour

@Dragon9 with respect, that's what @warkolm was trying to tell you. ILM is our "standard solution" for this use case—and Logstash works in conjunction with ILM.

ILM = Index Lifecycle Management.

To be completely transparent, Logstash does not create indices. It only tells Elasticsearch that document d belongs in index i. Elasticsearch creates index i if it does not exist.

So with ILM set up, then you can set up a rollover period of any time interval you like. When the index meets one of three possible conditions (max age, document count, or size), it will be rolled over. If you create the initial index with a datestamp in it (using date math), you will also have record of when the index was created in the index name itself—and all subsequent rolled-over indices will automatically have the date stamp in the same format.

I suggest reading up on ILM here before trying to shoehorn Logstash and Curator to fit this use case when ILM is both a better fit, and built-in to the Elastic Stack (and I say that as the creator and maintainer of Curator).

1 Like