Template Rollover alias doesn't work with {index}

Elastic Observability
1

Index Template set rollover alias is doesn't work with {index}

{
  "index": {
    "lifecycle": {
      "name": "k8s-logs",
      "rollover_alias": "{index}"
    },
    "routing": {
      "allocation": {
        "include": {
          "_tier_preference": "data_content"
        }
      }
    },
    "refresh_interval": "30s",
    "number_of_shards": "2"
  }
}

show err

image
image1586×332 52.8 KB

logstash setting:

output {
      if [fields][env] == "canary" {
        elasticsearch {
          hosts => ["elastic-cluster:9200"]
          ilm_enabled => true
          ilm_policy => "k8s-logs"
          index => "k8s-%{[kubernetes][namespace]}-%{[kubernetes][labels][app]}-%{+YYYY.MM.dd}"
          ilm_pattern => "%{+YYYY.MM.dd}"
          ilm_rollover_alias => "k8s-%{[kubernetes][namespace]}-%{[kubernetes][labels][app]}"
        }
        #stdout { codec => rubydebug { metadata => true}}
      }
    }
2

Do you have an alias in place that is called that?

3

I wish I could use the variable {{index}}.
Such as the index = k8s - kube - system - 2021.11.08, rollover alias= K8S-kube-system-2021.11.09, The index is updated by date.

So i set logstash

ilm_pattern => "%{+YYYY.MM.dd}"
ilm_rollover_alias => "k8s-%{[kubernetes][namespace]}-%{[kubernetes][labels][app]}"

Set template

"rollover_alias": "{index}"

But it's doesn't work.Am I missing something？

4

That will not work, no. You need to be explicit there.

5

Is there another way to fulfill my needs？

6

You will need to create each one manually at this point.