Rotate elastic indices based on size

[abhiroyg]

Hi,

How to achieve rotation of elastic indices based on its size using elasticsearch-output plugin ? If I use an external program like Rollover API, will I lose data ? Do I have to bring logstash down, do the rollover, and bring it up ?

One more doubt, for custom index names (i.e., names not starting with 'logstash-'), should we need to set 'template' setting explicitly to the path of logstash provided default template (if we don't want custom templates) ?

[Christian_Dahlqvist]

@abhiroyg

If I use an external program like Rollover API, will I lose data ?

No

@abhiroyg

Do I have to bring logstash down, do the rollover, and bring it up ?

No, the switching of underlying indices is handled by Elasticsearch and invisible to Logstash. Logstash should just continue indexing into the appropriate write alias.

@abhiroyg

One more doubt, for custom index names (i.e., names not starting with ‘logstash-’), should we need to set ‘template’ setting explicitly to the path of logstash provided default template (if we don’t want custom templates) ?

The default template only applies to indices names logstash-*. If your underlying index name follows this pattern, it should continue to apply. If you have named your index something else, you will need to define a custom index template, even if this is just a copy of the default one with changed index pattern to match the new index name.

[abhiroyg]

Thank you! That resolves.