Как добавить "is_write_index": true в index template?

[11191 (Алексей Лалетин)]

Если добавляю эту опцию к template который указываю в template_name в output { elasticsearch { template_name => "haproxy" } }, то она просто пропадает.
И в GET /_template/haproxy вижу:
"aliases" : {
"haproxy" : { }
}
Хотя в PUT /_template/haproxy четко указал:
"aliases" : {
"haproxy" : {
"is_write_index": true
}
}

Как добавить эту опцию чтобы ILM не ругался на
illegal_argument_exception: source alias [haproxy] does not point to a write index

[rugenl (Len Rugen)]

Do any aliases exist?

GET _cat/indices/haproxy*

I think you assigned the alias to the template, the alias needs to be assigned to the index with one having "is_write_index": true.

[Igor_Motov]

Через template не получится (я открыл https://github.com/elastic/elasticsearch/issues/52152), надо либо индекс либо алиас вручную создавать.

[11191 (Алексей Лалетин)]

Но индексы каждый час создает logstash, назначать alias там возможности нет, есть только такой функционал:
output {
elasticsearch {
ilm_rollover_alias => "custom"
ilm_pattern => "000001"
ilm_policy => "custom_policy"
}
}
У меня конфигурация такая:
output {
elasticsearch {
id => "HAP Out"
hosts =>
user => ""
password => ""
index => "haproxy-%{+YYYY.MM.dd-HH}"
template_name => "haproxy"
}
Что тогда в ilm_pattern прописать?

[11191 (Алексей Лалетин)]

No aliases. How can I assign alias to index created hourly by logstash?

[rugenl (Len Rugen)]

ILM rollover phase will move the is_write_alias to the new index at rollover. To get started, the first index needs to exist and have is_write_alias: true. Use a POST like this to update the latest haproxy index with the is_write_alias.

POST /_aliases
{
    "actions" : [
        {
            "add" : {
                 "index" : "haproxy-000001",
                 "alias" : "haproxy",
                 "is_write_index" : true
            }
        }
}

If you don't have the initial ILM style index, you can create it as in the doc example

PUT datastream-000001
{
  "aliases": {
    "datastream": {
      "is_write_index": true
    }
  }
}

It's a frequent confusion getting ILM working for the first time in more complex configurations, but once it works, you will see that there are many different ways to configure ILM.

[11191 (Алексей Лалетин)]

Logstash creates index every hour, I posted my output section above, what exactly should I do?

To output all data in one manually created index? I don't get it, sorry.

[rugenl (Len Rugen)]

After creating the "haproxy-000001" index that has the is_write_alias: true, the output below should work. You will point to the alias, the index where is_write_alias is true will get the output. Only one is allowed and it will move to haproxy-000002 at rollover.

output {
  elasticsearch {
    id => "HAP Out"
    hosts =>
    user => ""
    password => ""
    index => "haproxy"
    ilm_enabled => true