# Ilm\_pattern not getting appended to rollover\_alias when index is created

**URL:** <https://discuss.elastic.co/t/ilm-pattern-not-getting-appended-to-rollover-alias-when-index-is-created/257835>\
**Category:** Logstash\
**Tags:** ilm-index-lifecycle-management\
**Created:** [December 7, 2020, 10:55am UTC](https://discuss.elastic.co/t/ilm-pattern-not-getting-appended-to-rollover-alias-when-index-is-created/257835 "2020-12-07T10:55:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhavrendra](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavrendra/32/80096_2.png) [@Bhavrendra](https://discuss.elastic.co/u/Bhavrendra)\
**Post date:** [December 7, 2020, 10:55am UTC](https://discuss.elastic.co/t/ilm-pattern-not-getting-appended-to-rollover-alias-when-index-is-created/257835/1 "2020-12-07T10:55:47Z")

</div>

I'm facing problem with ILM\_Pattern when i'm taking input to #Logstash from #Filebeat.  
The ilm\_pattern is not getting appended with ilm\_rollover\_alias in this case.

Note: Same thing works fine if logstash is taking input from file instead of beats.

```auto
input {
    beats {
        port => "5044"
    }
}
output {
  # Sending properly parsed log events to elasticsearch
  elasticsearch {
    hosts => ["localhost:9200"]
	#index => "logstash-%{+yyyy.MM.dd}"
	#index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}-000001"
	ilm_enabled => true
	ilm_rollover_alias => "logstash"
	ilm_pattern => "{now/d}-000001"
	ilm_policy => "logstash"
    #document_type => "%{[@metadata][type]}"
  }
} 

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 4, 2021, 10:56am UTC](https://discuss.elastic.co/t/ilm-pattern-not-getting-appended-to-rollover-alias-when-index-is-created/257835/2 "2021-01-04T10:56:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.