Rollover Indeces using Logstash and Elastic

Hi guys,

I have following use case:

I want to create new index every day, therefore my logstash output configuraiton looks as this:

output {
  elasticsearch {
	index => "metricbeat-linux-vms-%{+YYYY.MM.dd}"

I also have an ILM policy which defines rollover after 50gb and I have an index template which uses this ilm policy and is applied to all indeces with metricbeat-linux-vms*.

Where do I define that after 50gbs are reached a new index is created like: metricbeat-linux-vms-2020-07-31-000001?

Thank you very much

We aren't all guys :slight_smile:

What does your ILM policy look like?

Thank you for your response.

Sorry, by saying "guys" I do not have specific gender in my mind. So my ILM policy is pretty easy: I want to create a new index onces my existing one has reached 50GB. I created in in Kibana. And I have an Indx template, which is using this policy:

  "index": {
    "lifecycle": {
      "name": "ilm-metricbeat-my-policy"

But my struggle is: I have daily indeces. Every day I create a new index by using this configuration in logstash output:

index => "metricbeat-linux-vms-%{+YYYY.MM.dd}"

What I don't understand is: How can I define the creation of new index after 50 GB like


So during the day I have following indeces:


next day: