ILM error on index name

[jof300]

Hi,

I am trying to implement ILM for my indexes.

Some context :
Architecture of the solution is:

logstash (shipper) or beats ==> kafka ==> logstash (indexer) ==> elasticsearch <== kibana

Index seggregation is done by team, as we are using beats , index would be journalbeat-xxxx

We are pushing config via Terraform and Puppet.

Here is the error I got :

logstash_config :
....
manage_template => false
index => "journalbeat_%{team}"
ilm_enabled => true
ilm_pattern => "00001"
...

Something I am missing ?

Regards

[jof300]

Now I get another error :

Steps I did :

edit template with this :
"index_patterns": [
"journalbeat_cicd-*"
],

create index with write alias :
PUT journalbeat_cicd-000001
{
"aliases": {
"journalbeat_cicd": {
"is_write_index": true
}

logstash config :
....
manage_template => false
index => "journalbeat_%{team}"
ilm_enabled => true
ilm_pattern => "000001"
....

It created index journalbeat_cicd but doesn't match journalbeat_cicd-000001.

Any idea why ?

Regards