Rollover Indeces using Logstash and Elastic

Hi guys,

I have following use case:

I want to create new index every day, therefore my logstash output configuraiton looks as this:

output {
  elasticsearch {
	index => "metricbeat-linux-vms-%{+YYYY.MM.dd}"

I also have an ILM policy which defines rollover after 50gb and I have an index template which uses this ilm policy and is applied to all indeces with metricbeat-linux-vms*.

Where do I define that after 50gbs are reached a new index is created like: metricbeat-linux-vms-2020-07-31-000001?

Thank you very much

We aren't all guys :slight_smile:

What does your ILM policy look like?

Thank you for your response.

Sorry, by saying "guys" I do not have specific gender in my mind. So my ILM policy is pretty easy: I want to create a new index onces my existing one has reached 50GB. I created in in Kibana. And I have an Indx template, which is using this policy:

{
  "index": {
    "lifecycle": {
      "name": "ilm-metricbeat-my-policy"
    }

But my struggle is: I have daily indeces. Every day I create a new index by using this configuration in logstash output:

index => "metricbeat-linux-vms-%{+YYYY.MM.dd}"

What I don't understand is: How can I define the creation of new index after 50 GB like

"metricbeat-linux-vms-%{+YYYY.MM.dd}-000001"

So during the day I have following indeces:

"metricbeat-linux-vms-2020.08.04"
"metricbeat-linux-vms-2020.08.04-000001"
"metricbeat-linux-vms-2020.08.04-000002"

next day:

"metricbeat-linux-vms-2020.08.05"