Index can not assign to a default ilm policy

Hi, I am using logstash to collect my switch's syslog. Here is the logstash config like:

input{
    syslog{
        type => "syslog-sw-hw-128"
        host => "1.2.3.4"
        port => 580
    }
}

output{
    if [type] == "syslog-sw-hw-128" {
       elasticsearch {
        hosts => ["1.2.3.5:9200"]
            user => "elastic"
            password => "changeme"
            index => "syslog-sw-hw-128-%{+YYYYMMdd}"
            ilm_policy => "180-days-default"
        }
    }
}

Ant the question is:

1, the index created successfully, and have data.
2, but in kibana, ilm, the 180-days-default policy had no assigined index.

btw, kibana/logstash/es all 7.16, and when list plugin list in logstash, the logstash-output-elastisearch plugin is successfule list.

Thanks a lot.

If that index is created then ILM is not in use. The output checks if ILM is in use, if it were then it would override the value of the index option and log a warning that it was doing so.

The code that decides if ILM is in use is here.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.