New to it all. Would like a rotating 7 indexes from logstash to Elastisearch

First off... Wow... These products are amazing!

I have a single logstash source and a single elasticsearch/kibana source set up. All on the same server.
(Yes Still learning it all :slight_smile: )

I would like to have my logstash and elasticsearch configuration set up so I create a new index every day and
keep only the 7 most recent indices in elasticsearch.

Do I accomplish this by modifying elasticsearch and logstash both?
What is a simple automated solution

Any help is greatly appreciated


my logstash conf file below

input {
file {
path => "/var/log/logfile.log"
start_position => "beginning"

output {
elasticsearch {
hosts => ["localhost:9200"]
stdout { codec => rubydebug }

Logstash by default creates a new index every day, so that should already happen. In order to delete indices that are older than 7 days, you can use Curator.

Many thanks!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.