Why logstash generator input generated elasticsearch index size remains constant?

Hi,

I have the latest elastic stack and I am using Logstash's generator input plugin to generate dummy data and I am pushing it to an elasticsearch index testindex. I have ILM policy and template configured for testindex, so that every time a message gets pushed, I am expecting the messages to be published to testindex-000001, and once the ILM threshold meets, then to testindex-000002 and so on.

Below is my Logstash configuration;

input {
    generator {
        lines => [
            "message 1",
            "message 2",
            "message 3",
            "message 4",
            "message 5"
        ]
        count => 1000
    }
}

filter {
    mutate {
        rename => ["message", "testfield_1" ]
    }
}

output {
    elasticsearch {
        hosts => ["127.0.0.1:9200"]
        ilm_rollover_alias => "testindex"
        ilm_pattern => "000001"
        ilm_policy => "testpolicy"
    }
}

It creates 5000 messages in a single call, which works as expected. Now, when I call logstash again, still I can see only 5000 messages in my index, while the expected count was previous 5000 + current 5000 = 10000. Why is this happening and how to fix this?

Thanks.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.