# Overwriting supplied index micro-%{appName}%{+YYYY.MM.dd} with rollover alias vehicle-service **URL:** \ **Category:** Logstash\ **Created:** [November 30, 2023, 6:06pm UTC](https://discuss.elastic.co/t/overwriting-supplied-index-micro-appname-yyyy-mm-dd-with-rollover-alias-vehicle-service/348354 "2023-11-30T18:06:44Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Gaurav\_Sharma3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaurav_sharma3/32/128319_2.png) [@Gaurav\_Sharma3](https://discuss.elastic.co/u/Gaurav_Sharma3)\ **Post date:** [November 30, 2023, 6:06pm UTC](https://discuss.elastic.co/t/overwriting-supplied-index-micro-appname-yyyy-mm-dd-with-rollover-alias-vehicle-service/348354/1 "2023-11-30T18:06:44Z")
input { tcp { port =\> 5000 codec =\> json } } output { if [appName] =="user-service"{ elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> "micro-%{appName}%{+YYYY.MM.dd}" # Use date-based index names ilm\_enabled =\> true # Enable ILM ilm\_rollover\_alias =\> "user-service" # Define an alias for the rollover } } else if [appName] == "vehicle-service" { elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> "micro-%{appName}%{+YYYY.MM.dd}" ilm\_enabled =\> true # Enable ILM ilm\_rollover\_alias =\> "vehicle-service" # Define an alias for the rollover } } else if [appName] == "search-service" { elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> "micro-%{appName}%{+YYYY.MM.dd}" ilm\_enabled =\> true # Enable ILM ilm\_rollover\_alias =\> "search-service" # Define an alias for the rollover } } else if [appName] == "common-service" { elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> "micro-%{appName}%{+YYYY.MM.dd}" ilm\_enabled =\> true # Enable ILM ilm\_rollover\_alias =\> "common-service" # Define an alias for the rollover } } else if [appName] == "api-gateway" { elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> "micro-%{appName}%{+YYYY.MM.dd}" ilm\_enabled =\> true # Enable ILM ilm\_rollover\_alias =\> "api-gateway" # Define an alias for the rollover } } else if [appName] == "asset-service" { elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> "micro-%{appName}%{+YYYY.MM.dd}" ilm\_enabled =\> true # Enable ILM ilm\_rollover\_alias =\> "asset-service" # Define an alias for the rollover } } else if [appName] == "booking-service" { elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> "micro-%{appName}%{+YYYY.MM.dd}" ilm\_enabled =\> true # Enable ILM ilm\_rollover\_alias =\> "booking-service" # Define an alias for the rollover } } else if [appName] == "discovery-server" { elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> "micro-%{appName}%{+YYYY.MM.dd}" ilm\_enabled =\> true # Enable ILM ilm\_rollover\_alias =\> "discovery-server" # Define an alias for the rollover } } else if [appName] == "fare-service" { elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> "micro-%{appName}%{+YYYY.MM.dd}" ilm\_enabled =\> true # Enable ILM ilm\_rollover\_alias =\> "fare-service" # Define an alias for the rollover } } else if [appName] == "qr-service" { elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"] index =\> "micro-%{appName}%{+YYYY.MM.dd}" ilm\_enabled =\> true # Enable ILM ilm\_rollover\_alias =\> "qr-service" # Define an alias for the rollover } } } ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [November 30, 2023, 11:02pm UTC](https://discuss.elastic.co/t/overwriting-supplied-index-micro-appname-yyyy-mm-dd-with-rollover-alias-vehicle-service/348354/2 "2023-11-30T23:02:43Z")
You cannot use the index option if you set ilm\_enabled to true. It gets overwritten. Sounds like this is working as designed. ---
**Author:** ![Gaurav\_Sharma3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaurav_sharma3/32/128319_2.png) [@Gaurav\_Sharma3](https://discuss.elastic.co/u/Gaurav_Sharma3)\ **Post date:** [December 1, 2023, 3:51am UTC](https://discuss.elastic.co/t/overwriting-supplied-index-micro-appname-yyyy-mm-dd-with-rollover-alias-vehicle-service/348354/3 "2023-12-01T03:51:16Z")
if i am deleting the ilm\_enabled line then the index is not created i am doing this in logstash.conf ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [December 1, 2023, 3:58am UTC](https://discuss.elastic.co/t/overwriting-supplied-index-micro-appname-yyyy-mm-dd-with-rollover-alias-vehicle-service/348354/4 "2023-12-01T03:58:14Z")
Please provide at least one complete example of one of your elasticsearch outputs (with secrets redacted) and what index you expect to it create. With so little information it is hard to answer. ---
**Author:** ![Gaurav\_Sharma3](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/gaurav_sharma3/32/128319_2.png) [@Gaurav\_Sharma3](https://discuss.elastic.co/u/Gaurav_Sharma3)\ **Post date:** [December 1, 2023, 4:05am UTC](https://discuss.elastic.co/t/overwriting-supplied-index-micro-appname-yyyy-mm-dd-with-rollover-alias-vehicle-service/348354/5 "2023-12-01T04:05:04Z")
[2023-12-01T09:25:28,500][INFO][logstash.outputs.elasticsearch][main] Using a default mapping template {:es\_version=\>8, :ecs\_compatibility=\>:v8} [2023-12-01T09:25:28,507][WARN][logstash.outputs.elasticsearch][main] Restored connection to ES instance {:url=\>""} [2023-12-01T09:25:28,509][INFO][logstash.outputs.elasticsearch][main] Elasticsearch version determined (8.11.1) {:es\_version=\>8} [2023-12-01T09:25:28,509][WARN][logstash.outputs.elasticsearch][main] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>8} [2023-12-01T09:25:28,518][INFO][logstash.outputs.elasticsearch][main] Not eligible for data streams because config contains one or more settings that are not compatible with data streams: {"index"=\>"micro-%{appName}%{+YYYY.MM.dd}", "ilm\_rollover\_alias"=\>"asset-service", "ilm\_enabled"=\>"true"} [2023-12-01T09:25:28,519][INFO][logstash.outputs.elasticsearch][main] Data streams auto configuration (`data_stream => auto` or unset) resolved to `false` [2023-12-01T09:25:28,530][WARN][logstash.outputs.elasticsearch][main] Overwriting supplied index micro%{+YYYY.MM.dd} with rollover alias vehicle-service2 i want my indices to create appending date in name and i am using elk and giving name of indices in logstash.conf , as you can see above is my all logstash.conf file so if i use ilm\_enabled then my indices are overrided by ilm\_rollover\_alias and if i don't use then it is not created also i am new to Elasticsearch my requirement is to create elk stack to see logs and to make snapshots or backup of logs older than 1 month so when i restore the logs it conflicts with the name of indices as my indices name is yellow open vehicle-service-2023.11.30-000001 and it is not changing with date so i need to change its name ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 29, 2023, 4:05am UTC](https://discuss.elastic.co/t/overwriting-supplied-index-micro-appname-yyyy-mm-dd-with-rollover-alias-vehicle-service/348354/6 "2023-12-29T04:05:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.