Hi everyone,
regarding to my needs i defined a index template with PUT _template API in kibana! on that template i set index pattern and specific index rollover alias.i send my logs from filebeat to logstash,,in logstash output i set elasticsearch and to my_alias index.my elasticsearch cluster has 3 nodes and logstash is installed on that nodes.sometime when i restart my nodes it seems that rollovered index use a different template...in another word the template change to something else..
is there anything wrong???
PUT /_template/my_template
{
"order" : 0,
"index_patterns" : ["my_index*"],
"settings" : {
"number_of_shards" : "5",
"number_of_replicas" : "0",
"index.lifecycle.name": "my_policy",
"index.lifecycle.rollover_alias": "my_alias",
"index.mapping.total_fields.limit": 5000,
"codec": "best_compression"
},
"mappings" : {
"date_detection": false,
"properties" : {
"timestamp" : {
"format": "date_time||strict_date_time",
"type" : "date"
},
"@timestamp": {
"format": "strict_date_optional_time",
"type": "date"
}
}
}
}