I would like to set "index lifecycle management " on LOGSTASH output.
It would means that everything that goes via this output will get "ndex lifecycle management" which was created in Kibana.
You didn't say what version, but it looks like 6x. In 7x the ilm_ options are moved out of the plugin to a setup section, to make it clear that the mostly do things at setup, not at ingest time.
Before ILM, you could allow new %{application} values to automatically create new indices. WIth ILM, you can't. You will need to create a template and bootstrap (empty) index for each %{appliction} before you ingest. You can even use different ilm policies on indices, from the templates, I don't put that value in the plugin config.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.