Index Rollover for time based indexes

Hi Team .

I am not sure whether someone have done this or not but I am little stuck at situation .

Scenarion :

We are ingesting data to elasticsearch using logstash using time based strategy where we are creating index on daily basis .

At certain point in a day our shards reach to size of 30-40 GB ( Size in day is around 120 GB of each shard )

We want to rollover those indices .

Problem :

I am able to bring the strategy . If we rollover using aliases logstash will still be writing on the daily index ( lets say logstash-2019.04.04 ) .

If we write on alias name , daily based index creation strategy will be lost .

Can we . have some way where we rollover the current index and it moves with name logstash-1-2019.04.04
and logstash can still create the index logstash-2019.04.04 and continue to write on same index .


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.