Watcher action - Dynamic index creation

Elastic Stack Elasticsearch
1

I have a watcher that sends output to another index named "newindex". How can I set the dynamic value to target index such as date? Following approach doesn't work.

"actions": {
    "index_payload": {
      "index": {
        "index": "newindex-{now/d}",
        "doc_type": "docType2",
        "execution_time_field": "trigger_event.triggered_time"
      }
    }
  }

And it gives following error.

"last_execution": {
          "timestamp": "2017-09-25T21:12:46.413Z",
          "successful": false,
          "reason": "InvalidIndexNameException[Invalid index name [newindex-{now/d}], must not contain the following characters [ , \", *, \\, <, |, ,, >, /, ?]]"
        }

I have even tried with newindex-%{+YYYY.MM.dd} too. It too didn't work. Can you please help on how to do it?

1 Like
2

+1 on this. I am also attempting to do the same thing.

3

there is a slight glitch in your index syntax. You need to wrap the date math in the <> brackets, like <logstash-{now/d}>, then it should work.

1 Like
4

It worked. Thanks @spinscale

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.