I need to dynamically create several types (with different index names) indexes in Elasticsearch from logstash. I need to use lifecycle (ILM) feature. My questions and either problems are:
- How can I from logstash create bootstrap index automaticly? I would prefer to do not use Kibana because it will require to create initial (bootstrap) index every time someone from my application create new index.
It is more details but just to clarify indexes are somethink like app-something-12; app-something-13; app-something-23 etc. And numbers (12, 13 ect) are not running version of same index, but these are different indexes with different structures.
- It is possible to create index templates directly from logstash also?
Check out my current configurations:
elasticsearch {
hosts => [ "127.0.0.1:9200" ]
index => "%{[@metadata][indexname]}" ##e.g app-something12
user => "xxxxx"
password => "yyyyy"
ilm_enabled => true
ilm_rollover_alias => "%{[@metadata][indexname]}"
ilm_pattern => "000001"
ilm_policy => "application-policy"
}
}
Template:
{
"application-template" : {
"order" : 0,
"index_patterns" : [
"%{[@metadata][indexname]}-*"
],
"settings" : {
"index" : {
"lifecycle" : {
"name" : "application-policy",
"rollover_alias" : "%{[@metadata][indexname]}"
}
}
},
"mappings" : { },
"aliases" : { }
}
}