Logstash , multiple indexs using same ILM and index template and alias error

Elastic Stack Elasticsearch
1

Hi ,

below is my task to setup and struggling with ILM issue and looking forward if any help here.

  • i setup and configured filebeat and logstash on kubernetes cluster successfully.

  • since we had multiple application services on server and each application is from different developers so i set up logstash to create indexs based on the application name filed from logs and thats working too

  • now problem is for easy maintenance and based on server i setup single index template and single ILM for all these index .but i get alias problem. is there a way to set multiple alias for rolling index to work?

i don't want multiple ILM and index template based on application.

i keep getting below error for index

llegal_argument_exception: setting [index.lifecycle.rollover_alias] for index [service_index_00001] is empty or not defined

i am using latest version of ELK stack cloud

2

It is important to do the steps with the correct order: 1) First create ilm, 2) then the template and after that 3) you bootstrap the first index (you create an the first index e.g. aliasname_000001). Logstash should be sending to aliasname.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.