Index not getting created in elasticsearch hot node

Elastic Stack Elasticsearch
1

Below is the elasticsearch output plugin in logstash

 output {
            elasticsearch {
                     hosts => ["https://10.5.36.5:9200"]
                      index => "test-axiom"
                   #  ilm_rollover_alias => "hub-axiom-new"
                   #  ilm_pattern => "{now/d}-000001"
                   #  ilm_policy => "axiom5-new"
                     document_id => "%{unqid}"
                     template => "/etc/logstash/templatehot/logstash-test.json"
                     user => "adfad"
                     password => "dnjvafaj"
                     ssl => true
                     ssl_certificate_verification => false
                     cacert => "/etc/logstash/ca.crt"
            }

    }

This is the template i am using so that the index gets created in hot node
{
"index_patterns": ["test-ax*"],
"settings": {
"number_of_shards": 1,
"number_of_replicas": 0,
"index.routing.allocation.require.data":"hot"
}
}

the index is getting created in warm node instead

test-axiom 0 p STARTED 32625 64.6mb 10.5.36.10 data-warm-3
test-axiom 0 r STARTED 32625   65mb 10.5.36.14 data-warm-1
2

Could you run:

GET /_template/
GET /test-axiom
3

I can see that you have also one replica which means that the template is not used or is not the one you think.

4

Yes @dadoonet the template does not exist when i run this GET /_template/ but i am applying the correct template i have checked it several times

elasticsearch - Attempting to install template {:manage_template=>{"index_patterns"=>["test-ax*"], "settings"=>{"number_of_shards"=>1, "number_of_replicas"=>0, "index.routing.allocation.require.data"=>"hot"}}}

Also i am getting the above log from logstash which implicates its attempting to install template

5

Could you try to install the template manually from Kibana dev console to see if there is any problem?

The template name by default is logstash. See https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template_name
You might have to set template_overwrite. https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-template_overwrite

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.