Hi Team .
I am not sure whether someone have done this or not but I am little stuck at situation .
Scenarion :
We are ingesting data to elasticsearch using logstash using time based strategy where we are creating index on daily basis .
At certain point in a day our shards reach to size of 30-40 GB ( Size in day is around 120 GB of each shard )
We want to rollover those indices .
Problem :
I am able to bring the strategy . If we rollover using aliases logstash will still be writing on the daily index ( lets say logstash-2019.04.04 ) .
If we write on alias name , daily based index creation strategy will be lost .
Can we . have some way where we rollover the current index and it moves with name logstash-1-2019.04.04
and logstash can still create the index logstash-2019.04.04 and continue to write on same index .
Regards