# How to avoid logstash elasticsearch output ilm\_rollover\_alias overwriting the index prefix **URL:** \ **Category:** Logstash\ **Created:** [May 7, 2020, 3:40am UTC](https://discuss.elastic.co/t/how-to-avoid-logstash-elasticsearch-output-ilm-rollover-alias-overwriting-the-index-prefix/231444 "2020-05-07T03:40:42Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Louis\_Zhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/louis_zhang/32/66921_2.png) [@Louis\_Zhang](https://discuss.elastic.co/u/Louis_Zhang)\ **Post date:** [May 7, 2020, 3:40am UTC](https://discuss.elastic.co/t/how-to-avoid-logstash-elasticsearch-output-ilm-rollover-alias-overwriting-the-index-prefix/231444/1 "2020-05-07T03:40:42Z")
I expecting to get index mobile-2020.05.06-000001 with alias 'streamdata-alias', but the logstash creates index streamdata-alias-2020.05.06-000001, is the a bug? Alias and index name are 2 tings, why they have to be same in name, in the prefix? ```auto output { elasticsearch { ilm_rollover_alias => "streamdata-alias" ilm_policy => "streamdata-policy" index => "mobile-{now/d}-000001" } } ``` I think it should like this, if the index exists, it wirte the event into the alias with the is\_write\_index = true. if index not exists, create the index with the alias and set the is\_write\_index = true and write event to the alias. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [May 7, 2020, 4:12pm UTC](https://discuss.elastic.co/t/how-to-avoid-logstash-elasticsearch-output-ilm-rollover-alias-overwriting-the-index-prefix/231444/2 "2020-05-07T16:12:14Z")
I do not believe the index option is used if you are using ILM. ---
**Author:** ![Louis\_Zhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/louis_zhang/32/66921_2.png) [@Louis\_Zhang](https://discuss.elastic.co/u/Louis_Zhang)\ **Post date:** [May 8, 2020, 4:29pm UTC](https://discuss.elastic.co/t/how-to-avoid-logstash-elasticsearch-output-ilm-rollover-alias-overwriting-the-index-prefix/231444/3 "2020-05-08T16:29:41Z")
![image](https://us1.discourse-cdn.com/elastic/original/3X/9/5/9514fcfe64b719fadba7213ca1595922bfb6c8e1.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/1/31ead6400dea9fb81e01dc4fdd4de34d19c9c064.png) yeah, according to the code it use the alias direclty. [logstash-output-elasticsearch, line95](https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/612e52ecbb0e08ec3dbae871a0edec1b37581a86/lib/logstash/outputs/elasticsearch/ilm.rb#L95), not sure if it's possible to change to ```auto def rollover_alias_target "<#{@index}-#{ilm_pattern}>" end ``` ---
**Author:** ![Louis\_Zhang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/louis_zhang/32/66921_2.png) [@Louis\_Zhang](https://discuss.elastic.co/u/Louis_Zhang)\ **Post date:** [May 8, 2020, 5:23pm UTC](https://discuss.elastic.co/t/how-to-avoid-logstash-elasticsearch-output-ilm-rollover-alias-overwriting-the-index-prefix/231444/4 "2020-05-08T17:23:45Z")
hmm, found something interesting, haven't tried, if I am correct, when I set the alias with the date, it'll write the event into a new index without ilm alias the next day, if logstash not reboot, beacuse the 'setup\_ilm' called only one time when it's launched. ```auto elasticsearch { ... ilm_rollover_alias => "alias-{now/d}" ilm_pattern => "000001" ... } ``` ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/1/01db94b9e07e85024c388dbab1a08d9553dcc54f.png) ---
**Author:** ![Luca\_Belluccini](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/luca_belluccini/32/33239_2.png) [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)\ **Post date:** [May 9, 2020, 1:09am UTC](https://discuss.elastic.co/t/how-to-avoid-logstash-elasticsearch-output-ilm-rollover-alias-overwriting-the-index-prefix/231444/5 "2020-05-09T01:09:34Z")
Hello @Louis_Zhang Logstash bootstraps the write alias at startup. Given the current design of the ILM APIs, it is not possible to use variable substitution in `ilm_rollover_alias` or `ilm_pattern`. When ILM is enabled and ILM settings are used on Logstash, the `index` parameter is not used. It is not possible to have totally different index names and alias name when using the Logstash ILM settings: the actual index will be named `ilm_rollover_alias` + `ilm_pattern`. Do not add the date math pattern "{now/d}" in the `ilm_rollover_alias`. Set it to the `ilm_pattern`: the alias must stay the same as Logstash cannot and doesn't need to know when the index rollovers. It's Elasticsearch responsibility with the ILM policy to rollover the index depending on the size, age or doc count. See more at our [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ilm_pattern). Please let me know if it is clear or if you have issues to set it up. To be sure everything is correct, stop Logstash, change the parameters, verify there is no index template automatically installed already by Logstash and then restart Logstash. Doing do, at first start, an index template will be installed together with a default policy. The rollover alias will be setup and associated to an actual index (e.g. `myindex` and it will first point to `myindex-2020...-00001`). From now on Logstash will continue to write to `myindex` and Elasticsearch will check every 10 minutes (default) if the rollover must take place depending on the ILM policy of the index. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 6, 2020, 1:09am UTC](https://discuss.elastic.co/t/how-to-avoid-logstash-elasticsearch-output-ilm-rollover-alias-overwriting-the-index-prefix/231444/6 "2020-06-06T01:09:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.