ILM for new indices created via Logstash

Elastic Stack Elasticsearch
1

I am trying to apply ILM to new indices created via Logstash, but it doesn't seem to show the new indices being managed by ILM. I am using the default index template and do not have streams configured for these indices. The daily indices get created fine via Logstash, but they just aren't being managed by ILM.

I created the ILM policy first, then made the change to the Logstash .cfg files, and then restarted Logstash.

The "output" section of my logstash file is as follows:

output
{
        elasticsearch
        {
          index        => "casper-%{[@metadata][version]}-%{+YYYY.MM.dd}"
          ilm_policy   => "mylogs_policy"
          ...

Is it enough to set "ilm_policy" in the .cfg files for Logstash? Based on the Elastic documentation, "ilm_enabled" should be detected automatically.

My ILM policy:

PUT _ilm/policy/mylogs_policy
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {},
        "min_age": "0ms"          }
      },
      "delete": {
        "min_age": "30d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

Index ILM status:

GET casper-8.8.2-2023.11.07/_ilm/explain

{
  "indices": {
    "casper-8.8.2-2023.11.07": {
      "index": "casper-8.8.2-2023.11.07",
      "managed": false
    }
  }
}

When I apply the ILM policy to existing indices, it is successful and shows the existing indices as being managed by ILM.

Running Elastic 8.8.2.

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.