# Monthly indices with size-based rollover, alias questions

**URL:** https://discuss.elastic.co/t/monthly-indices-with-size-based-rollover-alias-questions/205117
**Category:** Elasticsearch
**Created:** [October 24, 2019, 4:00pm UTC](https://discuss.elastic.co/t/monthly-indices-with-size-based-rollover-alias-questions/205117 "2019-10-24T16:00:42Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![sharvey](https://avatars.discourse-cdn.com/v4/letter/s/cab0a1/32.png) [@sharvey](https://discuss.elastic.co/u/sharvey)
#### Post date: [October 24, 2019, 4:00pm UTC](https://discuss.elastic.co/t/monthly-indices-with-size-based-rollover-alias-questions/205117/1 "2019-10-24T16:00:43Z")

</div>

Hello,

I am attempting to setup index lifecycle policies for monthly log indexes. Currently, I have Logstash indexing to multiple monthly indices based on log type.

The pattern is as follows:

> index =\> "logtype1-%{+YYYY.MM}"

I understand I need to change that to:

> index =\> "logtype1-index"

in order to get the rollover working properly with logstash writing to the alias.

I have read through the elastic documentation on rollovers, as well as this blog about this subject.

> **[And the big one said "Rollover" — Managing Elasticsearch time-based indices...](https://www.elastic.co/blog/managing-time-based-indices-efficiently)**
>
> Introducing the new Rollover Pattern, and the APIs which support it, which is a simpler, more efficient way of managing time-based indices in Elasticsearch.

Here is an excerpt from my template:

> PUT \_template/logtype1  
> {  
> "index\_patterns" : ["logtype1-\*"],  
> "settings" : {  
> "number\_of\_shards" : "4",  
> "number\_of\_replicas" : "2",  
> "lifecycle.name" : "logs\_lifecycle",  
> "lifecycle.rollover\_alias" : "logtype1-index"  
> },  
> "aliases" : {  
> "logtype1-index" : {},  
> "logtype1-search": {}

If I create an index 'logtype1-2019-10-001' to start October

> PUT /%3Clogtype1-%7Bnow%2Fd%7BYYYYMM%7D%7D-001%3E  
> {  
> "aliases": {  
> "logtype1-index": {  
> "is\_write\_index": true  
> }  
> }  
> }

I know it will be written to when logstash writes to 'logtype1-index'

I have the lifecycle policy to rollover when the index reaches a certain size.

What I want to have happen is when the first log event for the November comes in, a new monthly index is created, 'logtype1-2019-11-001', with the same lifecycle policy applied. I know this will happen when the rollover policy is triggered by size at some point in November, but I would like to perhaps add an OR to make this happen when the month changes.

Is there a way to accomplish this without manually creating a new index at 12:01 on 11/01 and setting it as a the write index for the 'logtype1-index' alias?

Any help is much appreciated, thank you.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 21, 2019, 4:00pm UTC](https://discuss.elastic.co/t/monthly-indices-with-size-based-rollover-alias-questions/205117/2 "2019-11-21T16:00:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.