# What are the default rollover settings? How to identify rollover settings in Logstash?

**URL:** <https://discuss.elastic.co/t/what-are-the-default-rollover-settings-how-to-identify-rollover-settings-in-logstash/131234>\
**Category:** Logstash\
**Created:** [May 9, 2018, 11:16pm UTC](https://discuss.elastic.co/t/what-are-the-default-rollover-settings-how-to-identify-rollover-settings-in-logstash/131234 "2018-05-09T23:16:52Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![shankarps](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shankarps/32/78663_2.png) [@shankarps](https://discuss.elastic.co/u/shankarps)\
**Post date:** [May 9, 2018, 11:16pm UTC](https://discuss.elastic.co/t/what-are-the-default-rollover-settings-how-to-identify-rollover-settings-in-logstash/131234/1 "2018-05-09T23:16:52Z")

</div>

I started working on an existing ELK installation. I see that it has rollover option daily. The logs are written to the logstash-\* indices, rolling over daily, like this index name - logstash-2018.05.09.

I am trying to identify where this setting is applied.  
I can see that it is not applied in the conf file. This is the output conf -

> output {  
> elasticsearch { hosts =\> "localhost:9200" }  
> }

Notice that the index is not specified. I can see that the indexes do not have an alias either. There is no alias in the template "logstash-\*".

I also checked the curator and cannot see any rollover settings there.

Is this rollover happening by default? What steps can i take to troubleshoot and identify the rollover settings in this ELK installation? Thanks.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [May 10, 2018, 12:26am UTC](https://discuss.elastic.co/t/what-are-the-default-rollover-settings-how-to-identify-rollover-settings-in-logstash/131234/2 "2018-05-10T00:26:22Z")

</div>

> [@shankarps](#):
>
> The logs are written to the logstash-\* indices, rolling over daily, like this index name - logstash-2018.05.09.

That is the default for the [index option](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-index) to the elasticsearch output if you do not supply one.

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [May 10, 2018, 6:21am UTC](https://discuss.elastic.co/t/what-are-the-default-rollover-settings-how-to-identify-rollover-settings-in-logstash/131234/3 "2018-05-10T06:21:16Z")

</div>

This is not using the rollover feature in Elasticsearch. Instead the index name is created in Logstash based on the value of the `@timestamp` field, before they are sent to Elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 7, 2018, 6:21am UTC](https://discuss.elastic.co/t/what-are-the-default-rollover-settings-how-to-identify-rollover-settings-in-logstash/131234/4 "2018-06-07T06:21:23Z")

</div>

Closed on June 7, 2018, 6:21am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.