Watcher: how to dynamically calculate indices

Elastic Stack Elasticsearch
1

Is there a way to use scripts/template to calculated indices dynamically, to achieve the following?
"indices" : [ "logstash-2016.{{Calendar.getInstance().MONTH}}.{{Calendar.getInstance().DAY_OF_MONTH}}

Here is some background
o A watcher is used to monitor application logs for critical errors
o A new index is created daily (older index indexes are periodically deleted). Indexes are named as follows: logstash-YYYY-MM.DD
o The watcher is configured to run every 15 min and to search for critical errors that occurred in the last 15 min "range": {"@timestamp": {"gt": "now-15m"}
o Currently the indices for the watcher are specified using wildcard as follows: "indices" : [ "logstash-2016.." ]

Thank you for your help,
Eric

2

Hi Eric,

When using Watcher to query Elasticsearch, you should be able to use index name date math.

Fun fact: that feature was originally developed for Watcher :slight_smile:

Thanks,
Steve

3

That is exactly what I was looking for.

Thank you for your help,
Eric