Manual creation of an index with the date pattern name-YYYY.MM.DD

Elastic Stack Elasticsearch
1

I have an application that will be feeding data to my cluster via the API. I would like to have the index rolled like a logstash feed, index-YYYY.MM.DD. I cannot figure out how to create the index for that pattern? I don't think this is a rollover. It appears rollover just uses a numeric counter for the pattern. We would like the date pattern as we will be using Curator to maintain our retention policy. Thanks for the help.

UT /logs-000001
{
"aliases": {
"logs_write": {}
}
}

Add > 1000 documents to logs-000001

POST /logs_write/_rollover
{
"conditions": {
"max_age": "7d",
"max_docs": 1000,
"max_size": "5gb"
}
}

2

Curator doesn't need to have a date stamp in the index name. You can use field_stats based ages in Curator to identify the oldest and/or youngest @timestamp field in the index, removing the need to put a timestamp in the index name.

You're much better off using a default numeric rollover naming sequence to achieve this, with the aforementioned field_stats approach in Curator. But if you must put a timestamp in your index name with a rollover approach, see this forum post.

3

Thanks for that suggestion Aaron, I see the wisdom.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.