WatcherのIndex Actionで、Index名を可変にする方法がないか

Elastic Stack Elasticsearch
1

Watcherの実行時にAction句でIndexを作成しているのですが、
この時、作成される日付に応じて、Index名を変える（＝Watcherが実行されるたびに新しいIndexを作成する）ことができないでしょうか。

具体的にやりたいこととしては、
毎月月初にWatcherを実行し、実行日の前月の年月がIndex名の末尾に付記されるようにしたいです。
例: 6月1日にWatcherが実行され、watcher_201905というIndexが作成される

{
"trigger": {
"schedule": {
"monthly": {"on":1,"at":"midnight"} //毎月月初に実行
}
},
"input": {
・・・
},
"condition": {
・・・
},
"actions": {
"index_payload": {
"index": {
"index": "watcher", //Indexの末尾に、”YYYYMM”という形で、実行日の前月の年月を付記したい
"doc_type": "doc"
}
...
}

2

Hey,

see https://www.elastic.co/guide/en/elasticsearch/reference/current/date-math-index-names.html

You can use date math in index names, and just always go one month back with, see this example from the above link

<logstash-{now/M-1M{yyyy.MM}}>

--Alex

3

Hello,

Thank you for your replay.
Sorry that my description was not enough. The above code I posted is not for config file (like logstash.conf) or the part of API but the script for the watcher. So in my understand, it cannot contain such characters.
In case, I executed and I got following message.

message": "[watch_{now/M-1M{yyyy.MM}}] InvalidIndexNameException[Invalid index name [watch_{now/M-1M{yyyy.MM}}], must not contain the following characters [ , ", *, \, <, |, ,, >, /, ?]]",

Best regards.

4

this is supposed to be the index name so it can go straight into your watch. Judging from the error message the <> brackets are missing. Can you share the whole watch again including your changes, so one can try to reproduce locally? Thanks!

5

Finally worked! As you told me, the problem was just lacking of <>.
Thank you for your swift and helpful advice.

My latest code is like below.

"actions" : {
   "index_payload" : {
       "transform" : { ... },
       "index" : {
            "index" : "<logstash-{now/M-1M{yyyy.MM}}>",
            "doc_type" : "doc"
        }
    }
 }