Hi, I have set-up my stack to use custom index names like filebeat-department-01/01/2000
To do this I had to disable ILM, but this means Elasticsearch creates daily indexes. Is it possible to have these custom index names and setup an ILM to rollover only if the file size is greater than 50Gb for example?
One way to solve this is to create indices for your departments, e.g. filebeat-marketing, filebeat-accounting, etc., applying ILM/rollover policies on these then creating filtered aliases for the indices, e.g.
I needed to disable the policy to create custom index names. The previous policy just used filebeat-7.6.1-01/01/2000 and I wanted to create filebeat-department-01/01/2000, but only create a new index after the index size is greater than 50GB.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.