How to set Index name in conf.d .conf File to adjust to ILM

Elastic Stack Logstash
1

Hello Guys, i've got the following set in my /logstash/conf.d/10-syslog-XXXXX.conf file:

output {
if [type] == "syslog" {
  elasticsearch {
    hosts => ["000.000.000.000"]
    index => "logstash-vmw-000002"

I've also setup a Index Lifecycle Management for this index. It works somehow, in kibana i can see the new Index "logstash-vmw-000003" as a write Index and the aliases have been passed to it aswell. The Problem is, my Logstash Nodes still sent the Logs to the Index logstash-vmw-000002, so there are Logs in the new index. How do i have to setup the Index-Name in the conf.yml to let it adjust automatically?

Kind regards,
Moritz Kiesewetter

2

Hi!

output {
if [type] == "syslog" {
  elasticsearch {
    hosts => ["000.000.000.000"]
    index => "logstash-vmw"

You can reference the index with the alias you created. When you use the alias elasticsearch takes care of writing to the correct index.

3

Hi, thanks for your reply!
I've set the Alias in the Index-Template logstash-*

{
  "logstash": {}
}

I changed the config file following your recommendations, the logs still get the deliver, if i open them up they tell me :

@timestamp Nov 13, 2019 @ 08:40:23.141
t @version 1
t _id aIy0Y24Bk3krkYz-y0R0
t _index logstash-vmw

Should i be bothered because it say "index: logstash-vmw" or is this ok cause the docs will still get sorted in the "logstash-vmw-00003" Index?

Thanks anyway, you helped me a lot!

EDIT:
Ok so now i have the problem, that the Doc count of my newest Index doesn't rise.
I can see the Logs in the Discovery Section, but the index is not changing in size or Doc Count...
Can i somehow tell my Logstash to send in to an Alias? Instead of static Index Name? Also if i now check my Indicies under "Index Management" i can see a logstash-vmw Index, which i never created...

5

You have to send it to the index alias name.

Let's say you have logstash-vmw-00003 and your index alias is logstash-vmw then it works. If your alias is logstash- then you would have to use logstash-

6

Now it works!
Thanks a lot man :slight_smile:

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.