# Rollover issue using logstash

**URL:** <https://discuss.elastic.co/t/rollover-issue-using-logstash/86892>\
**Category:** Logstash\
**Created:** [May 24, 2017, 5:12am UTC](https://discuss.elastic.co/t/rollover-issue-using-logstash/86892 "2017-05-24T05:12:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![kamran.matloob](https://avatars.discourse-cdn.com/v4/letter/k/e47c2d/32.png) [@kamran.matloob](https://discuss.elastic.co/u/kamran.matloob)\
**Post date:** [May 24, 2017, 5:12am UTC](https://discuss.elastic.co/t/rollover-issue-using-logstash/86892/1 "2017-05-24T05:12:14Z")

</div>

Hi,  
I am using 5.1 elk stack. My task is to rollover 2 indices. I came to know through below link that we can rollover through curator  
[https://www.elastic.co/guide/en/elasticsearch/client/curator/5.0/ex\_rollover.html](https://www.elastic.co/guide/en/elasticsearch/client/curator/5.0/ex_rollover.html)  
But for rollover I have to use aliases. I am successfully created aliase of my index on dev tools on kibana dashboard using below script  
[https://www.elastic.co/guide/en/elasticsearch/reference/5.1/indices-aliases.html](https://www.elastic.co/guide/en/elasticsearch/reference/5.1/indices-aliases.html)  
PUT /coffii\_amq-000001 {  
"aliases": {  
"amq-rollover-alias": {}  
}  
}  
But I want create aliases through my index template. Right now I am unable to create index through my template below script.

"\_aliases" : {  
"actions" : [  
{ "add" : { "index" : "coffii\_amq-000001", "alias" : "amq-rollover-alias" } }  
]

```
}

```

Kindly advise first is it achieve through template.Second is my syntax to create aliase through template is right.

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [May 24, 2017, 2:08pm UTC](https://discuss.elastic.co/t/rollover-issue-using-logstash/86892/2 "2017-05-24T14:08:16Z")

</div>

For the rollover use case, index templates will not work for setting aliases in the way you have described.

To use with rollover, you may still need to create an index template for certain settings, but those should _not_ include the rollover alias name. It should also match the new index pattern of `coffii_amq-*`.

If you choose to do rollover, I suggest managing your template using REST API calls, not Logstash. Once you've created the initial index + alias, as you've demonstrated already, Logstash will be configured to exclusively write to the alias you created, e.g.

```auto
index => "amp-rollover-alias"

```

No other work is necessary within Logstash. It will happily continue to write to that alias. You then handle all rollover within Curator. Curator sends the rollover API calls to Elasticsearch. Elasticsearch creates a new index, incrementing the index number from the last value, e.g. `coffii_amq_000001` to `coffii_amq_000002`, and then automatically points the alias `amq-rollover-alias` at the new index, `coffii_amq_000002`. You do not have to do anything but call `_rollover` and have your conditions met for these things to happen. You don't need any alias information in the index template.

---

<div class="post-metadata">

**Author:** ![kamran.matloob](https://avatars.discourse-cdn.com/v4/letter/k/e47c2d/32.png) [@kamran.matloob](https://discuss.elastic.co/u/kamran.matloob)\
**Post date:** [May 30, 2017, 10:08pm UTC](https://discuss.elastic.co/t/rollover-issue-using-logstash/86892/3 "2017-05-30T22:08:38Z")

</div>

Got it.Thanks.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 27, 2017, 10:08pm UTC](https://discuss.elastic.co/t/rollover-issue-using-logstash/86892/4 "2017-06-27T22:08:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.