Rotate elastic indices based on size



How to achieve rotation of elastic indices based on its size using elasticsearch-output plugin ? If I use an external program like Rollover API, will I lose data ? Do I have to bring logstash down, do the rollover, and bring it up ?

One more doubt, for custom index names (i.e., names not starting with 'logstash-'), should we need to set 'template' setting explicitly to the path of logstash provided default template (if we don't want custom templates) ?

(Christian Dahlqvist) #2


No, the switching of underlying indices is handled by Elasticsearch and invisible to Logstash. Logstash should just continue indexing into the appropriate write alias.

The default template only applies to indices names logstash-*. If your underlying index name follows this pattern, it should continue to apply. If you have named your index something else, you will need to define a custom index template, even if this is just a copy of the default one with changed index pattern to match the new index name.


Thank you! That resolves.

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.