Understanding ILM policy

Elastic Stack Logstash
1

Hi friends,,

It is noted i can set ILM policy in logstash attach to index

    output {
      elasticsearch {
        ilm_rollover_alias => "custom"
        ilm_pattern => "000001"
        ilm_policy => "custom_policy"
      }
    }

my index is currently

index => "%{[fields][myvalue]}-%{+yyyyMMdd}"

I want after few GB i need rollover so index wiil be

myvalue-date       <- it rollover

what is ilm_rollover_alias and ilm_pattern. How i can set it ot that behaviour?

2

It's not really efficient to roll over after a few GB. Shards should be 30-50GB in size.

No you cannot do that. The date in the index pattern is the date that the policy was first enacted.

3

wouldn't that be slow? instead of 1 gb?

4

Why would it be slow?

5

because the shared size is big, then it need each the data in a big shard rather than making it small but not too small