# Redirect logs to newly created Index by Index Roll over
**URL:** https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780
**Category:** Elasticsearch
**Tags:** docker
**Created:** [April 6, 2020, 9:02pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780 "2020-04-06T21:02:34Z")
**Posts on this page:** 16
**Page:** 1
### Author:  [@Ozil](https://discuss.elastic.co/u/Ozil)
#### Post date: [April 6, 2020, 9:02pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/1 "2020-04-06T21:02:35Z")
Hi All
I am using Elasticsearch 7.3 for my internal alerting module. I am planning to introduce the ILM policy in the data node to handle the high amount of data. I am facing an issue I am using custom logstash output, for example, index-01.while the rollover process the index name will change to index-000002.In my case I can't change the logstash output index name, again and again, .how can I redirect the logs to the newly created index with the new name.
Usually, I observed in other tools they will create a new file and move data to that one and the primary one will be static.
Please advise me on this
---
### Author:  [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [April 6, 2020, 11:49pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/2 "2020-04-06T23:49:36Z")
Hello @Ozil
You have 2 options.
# Use Logstash native ILM support
```auto
output {
elasticsearch {
ilm_rollover_alias => "yourcustomindexprefix"
ilm_pattern => "000001"
ilm_policy => "custom_policy"
}
}
```
Where:
- `yourcustomindexprefix` **cannot** be a variable (e.g. `%{[@metadata][index]}`)
- you already defined the `custom_policy` ILM Policy (via Kibana UI or via [API](https://www.elastic.co/guide/en/elasticsearch/reference/7.3/getting-started-index-lifecycle-management.html))
# Do not use the Logstash native ILM support
```auto
output {
elasticsearch {
index => "yourrolloveralias"
ilm_enabled => false
}
}
```
Where:
- `yourrolloveralias` is a rollover alias you've bootstrapped after following [all those steps](https://www.elastic.co/guide/en/elasticsearch/reference/current/getting-started-index-lifecycle-management.html), which means:
- create the ILM policy
- create an Index Template which makes use of the ILM Policy and specifies the `index.lifecycle.rollover_alias` name
- bootstrap the rollover alias
---
### Author:  [@Ozil](https://discuss.elastic.co/u/Ozil)
#### Post date: [April 6, 2020, 11:54pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/3 "2020-04-06T23:54:10Z")
@Luca_Belluccini Thank you so much for your support.i think my issue will be resolved by this help.
Thanks for your quick reply sir.
---
### Author:  [@Ozil](https://discuss.elastic.co/u/Ozil)
#### Post date: [April 7, 2020, 8:06pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/4 "2020-04-07T20:06:48Z")
Hi @Luca_Belluccini
i am getting an error like "elasticsearch - Unknown setting 'ilm\_enabled' for elasticsearch"
my configuration is
```auto
output {
elasticsearch {
hosts => ["http://localhost:9200"]
index => "testdata"
ilm_enabled => false
}
}
```
---
### Author:  [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [April 7, 2020, 8:32pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/5 "2020-04-07T20:32:16Z")
On which Logstash version are you? It must be 6.7 or more recent
- Please check the [documentation](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ilm)
- Ensure you're running an Elasticsearch on a Basic license
---
### Author:  [@Ozil](https://discuss.elastic.co/u/Ozil)
#### Post date: [April 7, 2020, 8:33pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/6 "2020-04-07T20:33:19Z")
i am using logstash version 6.4.2
---
### Author:  [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [April 7, 2020, 8:34pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/7 "2020-04-07T20:34:49Z")
To setup rollover with ILM, you need at least the Elastic Stack on 6.7.
You can use Logstash 6.8.x or 7.3 to write to Elasticsearch 7.3.
---
### Author:  [@Ozil](https://discuss.elastic.co/u/Ozil)
#### Post date: [April 7, 2020, 8:44pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/8 "2020-04-07T20:44:41Z")
Ok i understand . Thank you so much
---
### Author:  [@Ozil](https://discuss.elastic.co/u/Ozil)
#### Post date: [April 20, 2020, 9:39pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/9 "2020-04-20T21:39:23Z")
@Luca_Belluccini Hi Sir
I started using the logstash output with the Alias indexing method. but when a new index is created using the rollover process logstash getting stuck. In testing, I can restart the logstash but how I can proceed when I take this to production
Please advise on this
---
### Author:  [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [April 20, 2020, 11:25pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/10 "2020-04-20T23:25:07Z")
What is the configuration of the Logstash output?
Please ensure you're following the steps at
[https://www.elastic.co/guide/en/elasticsearch/reference/current/using-policies-rollover.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/using-policies-rollover.html)
---
### Author:  [@Ozil](https://discuss.elastic.co/u/Ozil)
#### Post date: [April 20, 2020, 11:27pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/11 "2020-04-20T23:27:51Z")
```auto
output {
stdout { codec => rubydebug }
elasticsearch {
hosts => ["http://10.55.50.105:9200"]
index => "aliasdata"
ilm_enabled => false
}
}
~~~
```
---
### Author:  [@Ozil](https://discuss.elastic.co/u/Ozil)
#### Post date: [April 20, 2020, 11:28pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/12 "2020-04-20T23:28:22Z")
This is how my Logstash output look like
---
### Author:  [@Ozil](https://discuss.elastic.co/u/Ozil)
#### Post date: [April 20, 2020, 11:31pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/13 "2020-04-20T23:31:43Z")
Thank You so much for the replay. I am using Curator yml to perform the rollover action
---
### Author:  [@Luca\_Belluccini](https://discuss.elastic.co/u/Luca_Belluccini)
#### Post date: [April 21, 2020, 10:40pm UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/14 "2020-04-21T22:40:49Z")
If you're using `ilm_enabled => false` and you want to use manual Rollover using Curator, you have to ensure the following:
1. Check there is no index template which matches `aliasdata` index.
If you're in doubt, please share the output of `GET _templates`
1. Create an Index Template, if necessary, matching the index name `data-*`
2. Bootstrap the index & write alias using.
In the example below, the index names will be `data-000001`, `data-00002`...
```auto
PUT /data-000001
{
"aliases": {
"aliasdata": { "is_write_index": true }
}
}
```
1. Start logstash
2. In Curator, use the `rollover` action ([documentation](https://www.elastic.co/guide/en/elasticsearch/client/curator/current/rollover.html)).
Example (change the conditions to match what you need):
```auto
action: rollover
options:
name: aliasdata
conditions:
max_age: 1d
max_docs: 1000000
max_size: 5gb
```
* * *
This should be enough to make it work.
---
### Author:  [@Ozil](https://discuss.elastic.co/u/Ozil)
#### Post date: [April 22, 2020, 8:54am UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/15 "2020-04-22T08:54:33Z")
Thank you @Luca_Belluccini for the detailed information. I am following the process that you mentioned above .will check closely .
thank you for the advises
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 20, 2020, 9:03am UTC](https://discuss.elastic.co/t/redirect-logs-to-newly-created-index-by-index-roll-over/226780/16 "2020-05-20T09:03:15Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.