Hi,
I have made an update from ES 1.4.x and Logstash 1.4.x to the current release versions (2.3.x) on a 3 node cluster. My old data is still available and with a few changes to the logstash.conf (deprecated functions/options) I got that running as well, but logstash is not creating indexes anymore. If I manually create the index the data is stored as expected -> the forwarder seems to be ok as well as the filter section of the conf.
My output
output {
elasticsearch {
hosts => ["172.16.16.01", "172.16.16.02", "172.16.16.03"]
cluster => "mylog"
index => "logstash-${app-name}-%{+YYYY.MM.dd}"
document_type => "%{type}"
}
}
The cluster
option is not documented elsewhere, but I found this thread and gave it a try..
Thanks for any advice!