Why logstash generator input generated elasticsearch index size remains constant?


I have the latest elastic stack and I am using Logstash's generator input plugin to generate dummy data and I am pushing it to an elasticsearch index testindex. I have ILM policy and template configured for testindex, so that every time a message gets pushed, I am expecting the messages to be published to testindex-000001, and once the ILM threshold meets, then to testindex-000002 and so on.

Below is my Logstash configuration;

input {
    generator {
        lines => [
            "message 1",
            "message 2",
            "message 3",
            "message 4",
            "message 5"
        count => 1000

filter {
    mutate {
        rename => ["message", "testfield_1" ]

output {
    elasticsearch {
        hosts => [""]
        ilm_rollover_alias => "testindex"
        ilm_pattern => "000001"
        ilm_policy => "testpolicy"

It creates 5000 messages in a single call, which works as expected. Now, when I call logstash again, still I can see only 5000 messages in my index, while the expected count was previous 5000 + current 5000 = 10000. Why is this happening and how to fix this?


This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.