Posting document to alias instead of index

Elastic Stack Logstash
1

I'm not quite sure why this isn't working but I'm trying to post to an alias instead of an index and it's not working. I have indexes called
index-september & index-october and they are both under the alias index. When I put my logstash index => "index" it fails but when I put index => "index-september" it succeeds. Can I post to an alias?

I'm doing post processing on data in my indices and I'd like the documents to reroute via their _id to the correct index. I'm pulling them in via the elasticsearch input plugin. Any suggestion on how to do this?

Thanks!

2

I think you have to set is_write_alias: true on one index referenced by the alias for writing, even if there is only one.

3

Will it automatically send events that get pulled in from index-september to index-september when I input and output to elasticsearch via an alias?

4

If you had indices index-january thru index-september (the is_write_alias: true). Read via the alias "index" would read from all of them, just like using a wildcard "index-*". Writes to "index" would go to index-september. I think if you post directly to any, (index-june) you could write to them (unless set to read only).

The idea of rollover is at 01/01/2019 00:00:00 you create index-october and set is_write_alias: true, writes to "index" go to the new month. (I don't think the rollover api or ILM can do rollover at a specific time however, they do it by size, age or # events.)

5

Hmm okay thanks for your help! I think I'll pull the metadata _index and see if I can post to it's index like that! :smiley:

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.