Hi,
I have the latest elastic stack and I am using Logstash's generator
input
plugin to generate dummy data and I am pushing it to an elasticsearch index testindex
. I have ILM policy and template configured for testindex
, so that every time a message gets pushed, I am expecting the messages to be published to testindex-000001
, and once the ILM threshold meets, then to testindex-000002
and so on.
Below is my Logstash configuration;
input {
generator {
lines => [
"message 1",
"message 2",
"message 3",
"message 4",
"message 5"
]
count => 1000
}
}
filter {
mutate {
rename => ["message", "testfield_1" ]
}
}
output {
elasticsearch {
hosts => ["127.0.0.1:9200"]
ilm_rollover_alias => "testindex"
ilm_pattern => "000001"
ilm_policy => "testpolicy"
}
}
It creates 5000 messages in a single call, which works as expected. Now, when I call logstash again, still I can see only 5000 messages in my index, while the expected count was previous 5000 + current 5000 = 10000. Why is this happening and how to fix this?
Thanks.