Rollover api and dynamic indices based on fields

Elastic Stack Elasticsearch
1

Hello,

I have a logstash that pushes the data in a dynamic index based on a field value. I want to use the rollover API to let elasticsearch manage my index+shard creation.

mutate {
    add_field => {
      "[@metadata][index]" => "wilco-%{site}-%{fwot_type}-%{layout_id}-v1"
output {
  elasticsearch {
    index           => "%{[@metadata][index]}"

The problem is that I have to precreate the indices with the alias, but I cannot know the names in advance as it comes from the fields.

Is there a solution like the _template solution to say to es

if you create an index with this pattern, then create this associated alias

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.