Send output to elastic search specific index with ilm_rollover?

Elastic Stack Beats
,
1

Hello,

Running elasticsearch kibana and filebeat I will like to make an index and pattern with ILM.
On Elasticsearch I did

          while [[ "$(curl -s -o /dev/null -w '%{http_code}\n' $ES_URL)" != "200" ]]; do sleep 1; done
          curl -X PUT "localhost:9200/_ilm/policy/daily?pretty" -H 'Content-Type: application/json' -d' { "policy": { "phases": { "hot": { "actions": { "rollover": { "max_age": "1d" }, "set_priority": { "priority": 100 } }, "min_age": "0ms"}, "delete": { "min_age": "7d", "actions": { "delete": {} } } } } } '

Which is working, now I am trying to make index connect to it.
I know on Logstash I can do:

output {

#       elasticsearch { 
#         hosts => "http://elasticsearch-master:9200" 
#         index => "myapp"
#         ilm_rollover_alias => "myapp"
#         ilm_pattern => "000001"
#         ilm_policy => "daily"
#         ilm_enabled => true
#       }
# }

How can I do the same setting for the output.elasticsearch: ?

When I tried:

output.elasticsearch:
        hosts: ["http://elasticsearch-master:9200"]
        index: "myapp-%{[beat.version]}-%{+yyyy.MM.dd}"

setup.template:
        name: 'myapp'
        pattern: 'myapp-*'
        enabled: true

But this did not work..

Thank you : )

2

Welcome to our community! :smiley:

It's a little hard for me to read that curl request in a long line like that, but this should work;

output.elasticsearch:
        hosts: ["http://elasticsearch-master:9200"]
        index: daily

TLDR you need to set the index to the write alias of the policy, which is commonly the same as the policy name.