selin
(selin)
August 24, 2021, 7:01am
1
Hi friends,,
It is noted i can set ILM policy in logstash attach to index
output {
elasticsearch {
ilm_rollover_alias => "custom"
ilm_pattern => "000001"
ilm_policy => "custom_policy"
}
}
my index is currently
index => "%{[fields][myvalue]}-%{+yyyyMMdd}"
I want after few GB i need rollover so index wiil be
myvalue-date <- it rollover
what is ilm_rollover_alias and ilm_pattern. How i can set it ot that behaviour?
warkolm
(Mark Walkom)
August 25, 2021, 12:52am
2
It's not really efficient to roll over after a few GB. Shards should be 30-50GB in size.
No you cannot do that. The date in the index pattern is the date that the policy was first enacted.
selin
(selin)
August 25, 2021, 1:28am
3
wouldn't that be slow? instead of 1 gb?
selin
(selin)
August 25, 2021, 3:24am
5
because the shared size is big, then it need each the data in a big shard rather than making it small but not too small
system
(system)
Closed
September 22, 2021, 4:53am
7
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.