Hi,
I have upgrade my stack from elk6.7.1 to elk7.9.1.
In my stack index name are : logs-kelogs-pltf-YYYY.MM.dd.hh
These indices are not managed by rollover and ilm policies.
Logtash creates each hour a new index logs-kelogs-pltf-YYYY.MM.dd.hh
History is managed by curator.
My problem is that with elk7.9.1:
1 an ilm policy with rollover(logs) is set by default upon any index : logs-*-* with datastream.
2 my indexs logs-kelogs-pltf-YYYY.MM.dd.hh are not compliant with this policy, logstash fails trying to insert data in datastream like in .ds- logs-kelogs-pltf-YYYY.MM..dd.hh.
I would avoid to use this ilm policy (or any ilm policy) for my indexs: logs-kelogs-pltf-YYYY.MM.dd.h
I have try to modify the template `logs` to discard my indexs:
![image|690x189](upload://74e52IvquKgCm9Q2mvfBJ7qPlR7.png)
![image|690x121](upload://3iKtDKwwaXNxNs5audY0Ahq2tC0.png)
But when I try to save the modification : save button turn round (saving label)
Is there a simple way to avoid that logs ilm policy applies on my indexs
Thanks
Finally , I create new index template (not legacy) overriding logs templtaes and it works (solved)
1 Like
Thanks for sharing your solution.
FYI your first post is really hard to read with that formatting
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.