Using index name in rollover alias

Elastic Stack Beats
1

We're trying to set up filebeat to use ILM with "automatic" index naming from our Kubernetes cluster.

Output configuration:

    output:
      elasticsearch:
        bulk_max_size: 1000
        enable: true
        hosts:
          - <ES_HOST>
        index: logs-filebeat
        indices:
          - index: logs-filebeat-%{[kubernetes.namespace]}
        password: <password>
        path: /
        username: <username>

ILM configuration:

    setup:
      ilm:
        enabled: true
        rollover_alias: "{elasticsearch.index.name}"
        pattern: "{now/d}-000001"
        policy_name: "logs-ilm-policy"
        overwrite: false
        check_exists: false
      template:
        name: logs-filebeat
        pattern: logs-filebeat*

I've tried any combination of fields / values for the rollover_alias but it either doesn't expand the variable or it errors out with a key not found error

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.