Send output to elastic search specific index with ilm_rollover?


Running elasticsearch kibana and filebeat I will like to make an index and pattern with ILM.
On Elasticsearch I did

          while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
          curl -X PUT "localhost:9200/_ilm/policy/daily?pretty" -H 'Content-Type: application/json' -d' { "policy": { "phases": { "hot": { "actions": { "rollover": { "max_age": "1d" }, "set_priority": { "priority": 100 } }, "min_age": "0ms"}, "delete": { "min_age": "7d", "actions": { "delete": {} } } } } } '

Which is working, now I am trying to make index connect to it.
I know on Logstash I can do:

output {

#       elasticsearch { 
#         hosts => "http://elasticsearch-master:9200" 
#         index => "myapp"
#         ilm_rollover_alias => "myapp"
#         ilm_pattern => "000001"
#         ilm_policy => "daily"
#         ilm_enabled => true
#       }
# }

How can I do the same setting for the output.elasticsearch: ?

When I tried:

        hosts: ["http://elasticsearch-master:9200"]
        index: "myapp-%{[beat.version]}-%{+yyyy.MM.dd}"

        name: 'myapp'
        pattern: 'myapp-*'
        enabled: true

But this did not work..

Thank you : )

Welcome to our community! :smiley:

It's a little hard for me to read that curl request in a long line like that, but this should work;

        hosts: ["http://elasticsearch-master:9200"]
        index: daily

TLDR you need to set the index to the write alias of the policy, which is commonly the same as the policy name.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.