How to enable ILM when I i have custom index name with hostname via logstash

Elastic Stack Logstash
1

I'm sending data from filebeat to elasticsearch via Logstash
I managed to send data to ES with my custom index name even with this.

index => "%{[@metadata][beat]}-%{[host][hostname]}-%{[@metadata][version]}-%

But I'm having trouble with the ILM config. Below is the output config that I have in my logstash

output {
    elasticsearch {
        hosts => localhost
        manage_template => false
        index => "filebeat-%{[host][hostname]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
        #index => "%{[@metadata][beat]}-%{[host][hostname]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
        ilm_enabled => true
        ilm_rollover_alias => "filebeat-"
        ilm_pattern => "000001"
        ilm_policy => "filebeat-policy"
    }
}

As you can see above, after adding all the ilm_* configs, logstash doesnot even start.
I know i might be lost here,

Basically what i want to do is, create daily indexes

filbeat-hostname-beatVersion-date

And associate them with a default ILM policy.

Please shed some light on this.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.