What are the default rollover settings? How to identify rollover settings in Logstash?

(Shankar) #1

I started working on an existing ELK installation. I see that it has rollover option daily. The logs are written to the logstash-* indices, rolling over daily, like this index name - logstash-2018.05.09.

I am trying to identify where this setting is applied.
I can see that it is not applied in the conf file. This is the output conf -

output {
elasticsearch { hosts => "localhost:9200" }

Notice that the index is not specified. I can see that the indexes do not have an alias either. There is no alias in the template "logstash-*".

I also checked the curator and cannot see any rollover settings there.

Is this rollover happening by default? What steps can i take to troubleshoot and identify the rollover settings in this ELK installation? Thanks.


That is the default for the index option to the elasticsearch output if you do not supply one.

(Christian Dahlqvist) #3

This is not using the rollover feature in Elasticsearch. Instead the index name is created in Logstash based on the value of the @timestamp field, before they are sent to Elasticsearch.

(system) #4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.