Logstash ILM

No, there doesn't seem to be a way (in elasticsearch anyway) to create the initial index. This is similar to a case/discussion I had with Elastic :slight_smile:

Depending on your environment and depth of devops structure, things might be possible. Say you were automating deployment of beats, you could possibly automate the template and bootstrap index creation.

Yes, it is confusing. I had a lot of problems with date math in index names. Yes, if you don't bootstrap the index, the initial index is a single index, neither old or new style rollover. And it probably duplicates the is_write_alias you want, so it's in the way of creating the bootstrap index.

ILM came out after we had planned our stack, it was too much of a crunch to learn it to implement. 60-90 days into our stack, we were creating over 60 indices a day, which isn't good. It took about a month to mostly convert to ILM, with a few bumps along the way.