Weekly ilm pattern

[wedkarz014 (Patryk)]

Hi,
I have a problem with ILM configuration. I'd like to set up an ilm policy to create index like that: index_name-yyyy.ww-000001. When i set it with default format- index_name-yyyy.MM.dd-000001, it works good but with weekly indices there is something wrong because only part with numbers changes, week is steel the same as at the begging.
basic info for you:
Ship agent - filebeat v.6.6.2, there is nothing special settings about ilm
logstash v.6.6.1
elasticsearch v.6.6.1
ilm policy:

    {
  "oss_kibana_policy" : {
    "version" : 3,
    "modified_date" : "2019-10-01T15:27:26.105Z",
    "policy" : {
      "phases" : {
        "hot" : {
          "min_age" : "0ms",
          "actions" : {
            "rollover" : {
              "max_size" : "50gb",
              "max_age" : "7d"
            }
          }
        },
        "delete" : {
          "min_age" : "14d",
          "actions" : {
            "delete" : { }
          }
        },
        "warm" : {
          "min_age" : "0ms",
          "actions" : {
            "shrink" : {
              "number_of_shards" : 1
            }
          }
        }
      }
    }
  }
}

template
{
"oss_kibana" : {
"order" : 0,
"index_patterns" : [
"oss_kibana*"
],
"settings" : {
"index" : {
"lifecycle" : {
"name" : "oss_kibana_policy",
"rollover_alias" : "oss_kibana"
},
"number_of_shards" : "3",
"number_of_replicas" : "1"
}
},
"mappings" : { },
"aliases" : { }
}
}

i created first index with is write alias
PUT oss_kibana-2019.40-000001
{
"aliases": {
"oss_kibana":{
"is_write_index": true
}
}
}

and here is my weekly logstash output:
elasticsearch {
# index => "oss_kibana-%{+yyyy.ww}"
ilm_pattern => "{now/w{yyyy.ww}}-000001"
index => "oss_kibana"
hosts => [
"elasticsearch:9200"
]
ssl => true
user => logstash
password => password
cacert => "/usr/share/logstash/config/root-ca.pem"
}

ilm_pattern => "{now/w}-000001" didn't work too

Would you be so kind and help with that issue?

[dakrone (Lee Hinman)]

The index date math "inherits" the math from the first index created, so in your case it's created as oss_kibana-2019.40-000001, but it really needs to be created as <oss_kibana{now/w{yyyy.ww}}-000001>:

PUT %3Coss_kibana%7Bnow%2Fw%7Byyyy.ww%7D%7D-000001%3E
{
  "aliases": {
    "oss_kibana":{
      "is_write_index": true
    }
  }
}

You can confirm this by checking the "provided_name" setting in the index settings, it should have the <...{...}> parts in it.