# Rollover daily indexes **URL:** \ **Category:** Elasticsearch\ **Created:** [April 25, 2017, 12:54pm UTC](https://discuss.elastic.co/t/rollover-daily-indexes/83568 "2017-04-25T12:54:48Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![pbmsys](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@pbmsys](https://discuss.elastic.co/u/pbmsys)\ **Post date:** [April 25, 2017, 12:54pm UTC](https://discuss.elastic.co/t/rollover-daily-indexes/83568/1 "2017-04-25T12:54:48Z")
Hi. I am currently looking into the rollover feature in elasticsearch. At the moment i have timebased indexes from filebeats, eg: filebeat.2017-25-05 I would actually like to still keep filebeat create a new daily index and the the rollover to split these when they reach a certain amount of documents. But cant figure out from the documentation if this is possible? Thanks in advance Peter ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [April 25, 2017, 3:06pm UTC](https://discuss.elastic.co/t/rollover-daily-indexes/83568/2 "2017-04-25T15:06:15Z")
If I understand you correctly, you want a daily alias, with rolling indices underneath? Like this? ```auto daily-2017.04.23-1 daily-2017.04.23-000001 daily-2017.04.23-000002 daily-2017.04.23-000003 .... daily-2017.04.24-1 daily-2017.04.24-000001 daily-2017.04.24-000002 daily-2017.04.24-000003 .... daily-2017.04.25-1 daily-2017.04.25-000001 daily-2017.04.25-000002 daily-2017.04.25-000003 .... ``` Something like this? While it _is_ possible, it is not automatic. You would have to use some process to make the daily indices/aliases _before_ the rollover time came, so that Beats could just point to it without having to think about it, otherwise Beats would create a new _index_ named `daily-YYYY.MM.DD-1` instead of pointing at a rollover-capable alias. ---
**Author:** ![pbmsys](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@pbmsys](https://discuss.elastic.co/u/pbmsys)\ **Post date:** [April 26, 2017, 6:07am UTC](https://discuss.elastic.co/t/rollover-daily-indexes/83568/3 "2017-04-26T06:07:04Z")
@theuntergeek You got the structure just right. That answers the question, i dont know i am that confident on relaying on a schedulet job 🙂 Thank you ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [April 26, 2017, 6:15am UTC](https://discuss.elastic.co/t/rollover-daily-indexes/83568/4 "2017-04-26T06:15:35Z")
You can set indices to roll over based on document count and/or time, so you could set it up with a pure rolling index and still make sure no index contains data for more than one day if that is the granularity you need in order to manage retention. ---
**Author:** ![pbmsys](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@pbmsys](https://discuss.elastic.co/u/pbmsys)\ **Post date:** [April 26, 2017, 6:28am UTC](https://discuss.elastic.co/t/rollover-daily-indexes/83568/5 "2017-04-26T06:28:19Z")
@Christian_Dahlqvist That could be an option. Just have to make sure Curator dont nuke that index. Nice idea. ---
**Author:** ![pbmsys](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@pbmsys](https://discuss.elastic.co/u/pbmsys)\ **Post date:** [May 2, 2017, 7:56am UTC](https://discuss.elastic.co/t/rollover-daily-indexes/83568/6 "2017-05-02T07:56:23Z")
@Christian_Dahlqvist How would you control the index-name from logstash when it does a rollover each day and each time it reaches a document count? /Peter ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [May 2, 2017, 7:59am UTC](https://discuss.elastic.co/t/rollover-daily-indexes/83568/7 "2017-05-02T07:59:10Z")
The rollover mechanism controls the underlying index names and Logstash will be indexing into a single write alias. Look at [this blog post](https://www.elastic.co/blog/managing-time-based-indices-efficiently) and [the documentation](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-rollover-index.html) for more details. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 30, 2017, 8:07am UTC](https://discuss.elastic.co/t/rollover-daily-indexes/83568/8 "2017-05-30T08:07:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.