Hi,
I'm trying to get the indices rolled over once it reaches a given number of documents. I have the curator action as shown below:
2:
action: rollover
description: >-
Rollover the index associated with index 'name', which should be in the
form of prefix-000001 (or similar), or prefix-YYYY.MM.DD-1.
options:
disable_action: False
name: filebeat_logs
conditions:
max_docs: 500
I have added an alias named filebeat_logs using the curator action.
1:
action: alias
description: >-
Alias indices from last week, with a prefix of logstash- to 'last_week',
remove indices from the previous week.
options:
name: filebeat_logs
warn_if_no_indices: False
disable_action: False
add:
filters:
- filtertype: pattern
kind: prefix
value: filebeat-
The index is created by the logstash as shown below :
input {
beats {
host => "10.10.132.40"
port => 5044
}
}
output {
elasticsearch {
hosts => "10.10.132.44:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}-1"
document_type => "%{[@metadata][type]}"
}
}
When I run the curator, it just creates a new empty index and the logs still gets written to the older index.
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
yellow open filebeat-2017.08.25-000002 UyCwyENbT1ah96nT79MyqQ 5 1 0 0 955b 955b
yellow open filebeat-2017.08.25-1 XNB0rSxJRIizISIGqbMOSA 5 1 906 0 775.8kb 775.8kb
I read that I need to right to an alias and then it will start writing to the new file.
But can someone tell me how I can define and write to an alias from the elasticsearch output plugin so that the logs get written to new files every time I run the curator rollover action.