How to set Index name in conf.d .conf File to adjust to ILM

Hello Guys, i've got the following set in my /logstash/conf.d/10-syslog-XXXXX.conf file:

output {
if [type] == "syslog" {
  elasticsearch {
    hosts => [""]
    index => "logstash-vmw-000002"

I've also setup a Index Lifecycle Management for this index. It works somehow, in kibana i can see the new Index "logstash-vmw-000003" as a write Index and the aliases have been passed to it aswell. The Problem is, my Logstash Nodes still sent the Logs to the Index logstash-vmw-000002, so there are Logs in the new index. How do i have to setup the Index-Name in the conf.yml to let it adjust automatically?

Kind regards,
Moritz Kiesewetter


output {
if [type] == "syslog" {
  elasticsearch {
    hosts => [""]
    index => "logstash-vmw"

You can reference the index with the alias you created. When you use the alias elasticsearch takes care of writing to the correct index.

Hi, thanks for your reply!
I've set the Alias in the Index-Template logstash-*

  "logstash": {}

I changed the config file following your recommendations, the logs still get the deliver, if i open them up they tell me :

@timestamp Nov 13, 2019 @ 08:40:23.141
t @version 1
t _id aIy0Y24Bk3krkYz-y0R0
t _index logstash-vmw

Should i be bothered because it say "index: logstash-vmw" or is this ok cause the docs will still get sorted in the "logstash-vmw-00003" Index?

Thanks anyway, you helped me a lot!

Ok so now i have the problem, that the Doc count of my newest Index doesn't rise.
I can see the Logs in the Discovery Section, but the index is not changing in size or Doc Count...
Can i somehow tell my Logstash to send in to an Alias? Instead of static Index Name? Also if i now check my Indicies under "Index Management" i can see a logstash-vmw Index, which i never created...

You have to send it to the index alias name.

Let's say you have logstash-vmw-00003 and your index alias is logstash-vmw then it works. If your alias is logstash- then you would have to use logstash-

Now it works!
Thanks a lot man :slight_smile:

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.