How to create auto rollover index names without "-\\d+$" pattern at the end?

Elastic Stack Elasticsearch
1

I'm using ILM to create daily auto rollover indices with dates in the index names. If bootstrap the initial index with following then it works. The next index auto created will be "test-2022.06.17-000002", then "test-2022.06.18-000003", etc.

// <test-{now/d}-000001>
PUT /%3Ctest-%7Bnow%2Fd%7D-000001%3E 
{
  "aliases": {
    "test": {
      "is_write_index": true
    }
  }
}

But if I leave out the "-000001" in the initial index, like just "test-{now/d}", then ILM fails to auto create the next index, and I got error

index name [<test-{now/d}>] does not match pattern '^.*-\\d+$'

Is there any way to have daily auto index rollover with just dates in them, like "test-2022.06.16", "test-2022.06.17", "test-2022.06.18", etc?

2

No, that is not possible. If you roll over based on a combination of size and age you can end up with multiple indices per day, and the naming convention you specified does not support that. This is why rollover always have a incrementing number at the end. If you strictly want an index per day, do not use rollover and instead set the index name in e.g. Logstash.

2 Likes
3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.