Hi!
We have a logstash server that should be able to handle different types of beats. Previously we used an index pattern like this:
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"
Now, I'm trying to enable ILM. Since different types of beats are used, my thought was to put the metadata in the ilm_ configuration fields, like this:
ilm_rollover_alias => "%{[@metadata][beat]}-%{[@metadata][version]}"
ilm_pattern => "{now/d}-000001"
ilm_policy => "%{[@metadata][beat]}-%{[@metadata][version]}"
The corresponding rollover_alias and policy (e.g. metricbeat-7.0.0) already exists.
This configuration throws errors like:
[2019-05-27T15:15:09,712][ERROR][logstash.outputs.elasticsearch] Failed to install template. {:message=>"Malformed escape pair at index 11: /_template/%{[@metadata][beat]}-%{[@metadata][version]}", :class=>"Java::JavaNet::URISyntaxException"
Is this syntax supported? Or is there any other way to set ILM configurations for multiple beats?