Use of metadata in ILM configuration


We have a logstash server that should be able to handle different types of beats. Previously we used an index pattern like this:
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

Now, I'm trying to enable ILM. Since different types of beats are used, my thought was to put the metadata in the ilm_ configuration fields, like this:

ilm_rollover_alias => "%{[@metadata][beat]}-%{[@metadata][version]}"
ilm_pattern => "{now/d}-000001"
ilm_policy => "%{[@metadata][beat]}-%{[@metadata][version]}"

The corresponding rollover_alias and policy (e.g. metricbeat-7.0.0) already exists.

This configuration throws errors like:

[2019-05-27T15:15:09,712][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Malformed escape pair at index 11: /_template/%{[@metadata][beat]}-%{[@metadata][version]}", :class=>"Java::JavaNet::URISyntaxException"

Is this syntax supported? Or is there any other way to set ILM configurations for multiple beats?

Same error..

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.