I'm facing problem with ILM_Pattern when i'm taking input to #Logstash from #Filebeat.
The ilm_pattern is not getting appended with ilm_rollover_alias in this case.
Note: Same thing works fine if logstash is taking input from file instead of beats.
input {
beats {
port => "5044"
}
}
output {
# Sending properly parsed log events to elasticsearch
elasticsearch {
hosts => ["localhost:9200"]
#index => "logstash-%{+yyyy.MM.dd}"
#index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}-000001"
ilm_enabled => true
ilm_rollover_alias => "logstash"
ilm_pattern => "{now/d}-000001"
ilm_policy => "logstash"
#document_type => "%{[@metadata][type]}"
}
}