Logstash logs to "logstash" index instead of "logstash-<date>" after update

Elastic Stack Elasticsearch
1

Hello,
I've upgraded without too much hassle from ELK 5.5 across 6.8 to 7.3.

Arriving at 7.3 I notice that the index in ES that LS seems to use is "logstash". Why? Why won't it continue writing to the existing logstash- (in this case logstash-2019.09.02)
AFAICS the default "index" directive of LS output module "elasticsearch" has not changed and apart for which ES host it should log to, nothing is configured.

Why is it doing this?

UPDATE Oh well I guess it's not a problem with ES since I've captured the HTTP stream and the POST request to "/_bulk" says:
{"index":{"_id":null,"_index":"logstash","_type":"_doc","routing":null}}
But why?

2

Yeah ok, Logstash 7.0 breaking changes:

Elasticsearch Index lifecycle management (ILM) is auto-detected and enabled by default if your Elasticsearch cluster supports it.

RTFM, I guess.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.