Reading previous week indice with elastic input plugin

[RickT]

Hello,
today, a mystery...

How to read only the previous week indice of Elastic using input plugin Elastic (in logstash conf).
For example, today just the 40th week.

The actives indices are :
data_test-2017.39
data_test-2017.40
data_test-2017.41

I'm trying this but without good result :

---

input {
elasticsearch {
hosts => ["SRV1001:9200"]
index => "data_test-%{+YYYY.ww}-1"
... }

and too :
index => "data_test-%{+YYYY.ww-1}"
index => "data_test-%{+xxxx.ww-1}"

---

i always obtain : "status":404
There is a solution?

my logstash version is 2.4.1
Thanks.

[warkolm (Mark Walkom)]

@RickT

index => "data_test-%{+YYYY.ww}-1"

You can't do that sort of date math in the output unfortunately.

[RickT]

well, it means that there is no solution to do that (select the previous week's indice) !?
Surprising !

[RickT]

hi,
If someone is looking for an answer, look at this, it's mine !

config logstash plugin :
input {
elasticsearch {
hosts => ["SRV1001:9200"]
index => "data_test-${an}.${nbELK:NOVAL}"
}
}
...
Here, i'm using two SYSVAR called "an" and "nbELK" and that are declared in advance.
Be careful, in Logstash version 2.41, you must execute with the flag "--allow-env"
like this >>> logstash -f ficLogstash.conf --allow-env

It's OK on Windows env. Probably no problem also on Linux...