Logstash + datastreams

Elastic Stack Elasticsearch
1

Hi, I have issue with configuration of Logstash and Datastreams with already defined ILM,index template
here are details:

Logstash pipeline config:

elasticsearch {
      hosts => ["host1"]
      data_stream => "true"
      data_stream_type => "metrics"
      data_stream_dataset => "factory_data"
      data_stream_namespace => "init_cycle_readings"
      user => logstash_internal
      password => pass001
      ssl => true
      cacert => '/etc/logstash/elasticsearch-ca.pem'
    }

than index template:

index pattern: metrics-factory_data-*

{
  "index": {
    "lifecycle": {
      "name": "metrics-factory_data-init_cycle_readings_policy"
    },
    "number_of_shards": "3",
    "number_of_replicas": "1"
  }
}

anyway, I can see that metrics template is applied with index shards =1

Can you give me advice how to make logstash working with custom ILM, index template and datastream? Or should I return back to index definition in logstash output and forget about datastrrams?

1 Like
2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.