Ilm rollover

Hello :slight_smile:

Could you please help me to understand better rollover function ?

  1. I set up police in Kibana
    like hot 7 days, warm .. that should be 27 days and after delete

  2. Logstash output

     output {
       elasticsearch {
       hosts =>["elkstack:9000"]
       index => "apptest"
       ilm_enabled => true
       ilm_rollover_alias => "approllover"
       ilm_pattern => "000002"
       ilm_policy => "mypolicy"
       }
     }
    

In KIbana apear just "approllover" but I would like that I have my index -> "apptest" and after hot (7 days ) should rollover to "approllover"

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.