Logstash with ILM like old behavior

Elastic Stack Logstash
1

Hi,

i want to imitate the old logstash behavior with creating daily indices and naming it per day, but only with ILM and deleting it after xx days.

I cant get it to work and i am not really fit with the new ilm settings.

can i do something like this?

output   {
    elasticsearch {
      ilm_rollover_alias => "logstash-%{+YYYY.MM.dd}"
      ilm_enabled => true
      ilm_policy => "Delete_after_120_days"
      ilm_write_alias => "logstash-"
      ilm_pattern => "%{+YYYY.MM.dd}"
    }
}

thanks for your help

2

OK i think i've got it but with this settings it always creates an index logstash--2019.03.27-000001

output   {
    elasticsearch {
      ilm_rollover_alias => "logstash-"
      ilm_enabled => true
      ilm_policy => "Delete_after_120_days"
      ilm_pattern => "{now/d}-000001"
    }
}

I cant get it to create logstash-2019.03.27-000001 . Without the - in the ilm_rollover_alias i only get a index with the name logstash .

3

It worked only after i've deleted every logstash index and deleted all logstash templates