Index can not assign to a default ilm policy

[baalchina]

Hi, I am using logstash to collect my switch's syslog. Here is the logstash config like:

input{
    syslog{
        type => "syslog-sw-hw-128"
        host => "1.2.3.4"
        port => 580
    }
}

output{
    if [type] == "syslog-sw-hw-128" {
       elasticsearch {
        hosts => ["1.2.3.5:9200"]
            user => "elastic"
            password => "changeme"
            index => "syslog-sw-hw-128-%{+YYYYMMdd}"
            ilm_policy => "180-days-default"
        }
    }
}

Ant the question is:

1, the index created successfully, and have data.
2, but in kibana, ilm, the 180-days-default policy had no assigined index.

btw, kibana/logstash/es all 7.16, and when list plugin list in logstash, the logstash-output-elastisearch plugin is successfule list.

Thanks a lot.

[Badger]

@baalchina

index => "syslog-sw-hw-128-%{+YYYYMMdd}"

If that index is created then ILM is not in use. The output checks if ILM is in use, if it were then it would override the value of the index option and log a warning that it was doing so.

The code that decides if ILM is in use is here.