Logstash Dynamic Template and ILM Creation

Elastic Stack Logstash
1

Hi

I am able to create the multiple index patterns dynamically using below configuration.

    output {
      stdout { codec => rubydebug }
      elasticsearch {
       hosts => [ es_host:9200" ]
        index => "lstash-%{[event][class]}"
      }
    }

After that I have added below template and ilm settings in output block for creating templates and ilms for those indexes.

template => "/opt/elk/logstash/config/templates/lstash-%{[event][class]}-template.json"
template_name => "lstash-%{[event][class]}-template"
template_overwrite => true
ilm_enabled => true
ilm_rollover_alias => "lstash-%{[event][class]}-"
ilm_pattern => "000001"
ilm_policy => "custom-policy"

Then run the logstash service,showing below error

    output {
        elasticsearch {
          # This setting must be a path
          # File does not exist or cannot be opened /opt/elk/logstash/config/templates/lstash-%{[event][class]}-template.json
          template => "/opt/elk/logstash/config/templates/lstash-%{[event][class]}-template.json"
          ...
        }
      }
2

My reading of the code is that the template manager never sprintf's the template option, so you cannot use a field reference in it.

3

ok, we can't create dynamic templates for multiple indexes?

4

That is my reading of it.

5

Any possible way to create the dynamic templates.
Please help me on this.

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.