Logstash index lifecycle management

[Jiri_Safar (Jiří šafář)]

Hi guys,

I would like to set "index lifecycle management " on LOGSTASH output.
It would means that everything that goes via this output will get "ndex lifecycle management" which was created in Kibana.

This is how my OUTPUT looks like:

elasticsearch {
hosts => "http://elasticsearchserverxxx:9200/"
index => "%{application}-dev-%{+YYYY.MM.dd}"
user => "user"
password => "pasword"
ilm_enabled => true
ilm_policy => "DEV/TEST/PROD_Delete_old_data"
}
}

But any of new index doesn't apply this "DEV/TEST/PROD_Delete_old_data" policy. Do I have to set something differently? Thanks

[rugenl (Len Rugen)]

You didn't say what version, but it looks like 6x. In 7x the ilm_ options are moved out of the plugin to a setup section, to make it clear that the mostly do things at setup, not at ingest time.

Before ILM, you could allow new %{application} values to automatically create new indices. WIth ILM, you can't. You will need to create a template and bootstrap (empty) index for each %{appliction} before you ingest. You can even use different ilm policies on indices, from the templates, I don't put that value in the plugin config.