Rollover issue using logstash

Elastic Stack Logstash
1

Hi,
I am using 5.1 elk stack. My task is to rollover 2 indices. I came to know through below link that we can rollover through curator
https://www.elastic.co/guide/en/elasticsearch/client/curator/5.0/ex_rollover.html
But for rollover I have to use aliases. I am successfully created aliase of my index on dev tools on kibana dashboard using below script
https://www.elastic.co/guide/en/elasticsearch/reference/5.1/indices-aliases.html
PUT /coffii_amq-000001 {
"aliases": {
"amq-rollover-alias": {}
}
}
But I want create aliases through my index template. Right now I am unable to create index through my template below script.

"_aliases" : {
"actions" : [
{ "add" : { "index" : "coffii_amq-000001", "alias" : "amq-rollover-alias" } }
]

}

Kindly advise first is it achieve through template.Second is my syntax to create aliase through template is right.

2

For the rollover use case, index templates will not work for setting aliases in the way you have described.

To use with rollover, you may still need to create an index template for certain settings, but those should not include the rollover alias name. It should also match the new index pattern of coffii_amq-*.

If you choose to do rollover, I suggest managing your template using REST API calls, not Logstash. Once you've created the initial index + alias, as you've demonstrated already, Logstash will be configured to exclusively write to the alias you created, e.g.

index => "amp-rollover-alias"

No other work is necessary within Logstash. It will happily continue to write to that alias. You then handle all rollover within Curator. Curator sends the rollover API calls to Elasticsearch. Elasticsearch creates a new index, incrementing the index number from the last value, e.g. coffii_amq_000001 to coffii_amq_000002, and then automatically points the alias amq-rollover-alias at the new index, coffii_amq_000002. You do not have to do anything but call _rollover and have your conditions met for these things to happen. You don't need any alias information in the index template.

1 Like
3

Got it.Thanks.

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.