Using 'index per day' for index actions

alerting

#1

HI,

Can I name the index in an indexaction, so I get an index per day? Like:

        "index": {
            "index": "alerts-%{+YYYY.MM.dd}",
            "doc_type": "some_alert"
        }

(Alexander Reelsen) #2

Hey,

so this example works and creates an alert named index with a date component:

PUT _xpack/watcher/watch/_execute
{
  "watch": {
    "trigger": {
      "schedule": {
        "interval": "5h"
      }
    },
    "input": {
      "simple": {
        "foo" : "bar"
      }
    },
    "actions": {
      "second" : {
         "index": {
            "index": "<alerts-{now/M}>",
            "doc_type": "some_alert"
        }
      }
    }
  }
}

--Alex


(system) #3