Why is a new index created with 0001 if you restart logstash?

Elastic Stack Logstash
1

Why is a new index created with 0001 if you restart logstash? And does not continue to write to the main one, without numbers. But if you restart it again, it keeps writing to 0001 without creating 0002?

/etc/logstash/conf.d/logstash.conf

ilm_enabled => true
ilm_policy => "logstash-policy"
ilm_rollover_alias => "actions-logs"
ilm_pattern => "{now/d}-00001"
2

Hi,

the rollover operation (which would increment the sequence number and create actions-logs-{now/d}-00002 ) is not handled by Logstash, but by Elasticsearch's ILM. The rollover happens based on the conditions defined in your ILM policy (like max size, max age, or max documents)

Regards

3

why not handled ? ilm settings are in logstash.conf

here's my Logstash.conf part..

    data_stream => false
    ilm_enabled => true
    ilm_policy => "logstash-policy"
    ilm_rollover_alias => "actions-logs"
    ilm_pattern => "{now/d}-00001"

i delete the index and it created without any date only name i mean "actions-logs" instead of "actions-logs-2024.01.16"
i stop logstash, delete this log and start logstash. new index is "actions-logs-2024.01.16-00001" instead of "actions-logs-2024.01.16"

This new index has two aliases instead of one
"actions-logs, actions-logs-alias"
And the error "illegal_argument_exception: rollover target [actions-logs-alias] does not point to a write index"

Why all this happens ?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.