Indeces with current date while using Index Life Management with file beat

Elastic Stack Elasticsearch
1

For bootstrapping an index for using ILM, with filebeat , the following command was used

PUT lp_index-otherfgtraffull-000001
{
  "aliases": {
    "lp_index-otherfgtraffull": {
      "is_write_index": true
    }
  }
}

Is it possibe to include an automatic current date also in lp_index-otherfgtraffull-000001
so that it will look like lp_index-otherfgtraffull-15-11-2021-000001.
The current alias index is lp_index-otherfgtraffull.
Thanks and regards
shini

2

Think you are looking for this.

PUT /%3Clp_index-otherfgtraffull-%7Bnow%2Fd%7D-000001%3E
{
  "aliases": {
    "lp_index-otherfgtraffull": {
      "is_write_index": true
    }
  }
}

The URL has to be encoded but this is what it looks like decoded to give you an idea of what it's doing.

/<lp_index-otherfgtraffull-{now/d}-000001>

3

Just FYI, that date will not change if things roll over. It will only ever be the day that the policy was first invoked.

4

ok.. that means we can increment only the number if we use automatic roll over for indices?
thanks and regrads
shini

5

If you using /<lp_index-otherfgtraffull-{now/d}-000001> it will look like this if you have a 7 day rollover.

lp_index-otherfgtraffull-2021.11.16-000001
lp_index-otherfgtraffull-2021.11.23-000002
lp_index-otherfgtraffull-2021.11.30-000003

The date will change to NOW when the new index is created for the rollover and the number will increment.

1 Like
6

Thanks sir. I tried this method..
understood the url encoding of

PUT /%3Clp_index-otherfgtraffull-%7Bnow%2Fd%7D-000001%3E

also
Thanks and regards
shini

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.