# Workaround to Dynamic Index Names When Ussing ILM Policy

**URL:** <https://discuss.elastic.co/t/workaround-to-dynamic-index-names-when-ussing-ilm-policy/271311>\
**Category:** Logstash\
**Tags:** ilm-index-lifecycle-management\
**Created:** [April 27, 2021, 3:14am UTC](https://discuss.elastic.co/t/workaround-to-dynamic-index-names-when-ussing-ilm-policy/271311 "2021-04-27T03:14:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![scott\_stash](https://avatars.discourse-cdn.com/v4/letter/s/c89c15/32.png) [@scott\_stash](https://discuss.elastic.co/u/scott_stash)\
**Post date:** [April 27, 2021, 3:14am UTC](https://discuss.elastic.co/t/workaround-to-dynamic-index-names-when-ussing-ilm-policy/271311/1 "2021-04-27T03:14:32Z")

</div>

I apologize if this has been asked a lot, but I did a lot of reading and I'm still not quite clear. For instance:

```auto
https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#_writing_to_different_indices_best_practices
https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/858

```

In my current output I have this:

```auto
elasticsearch {
            hosts => ["https://mind.your.business:9200"]            
			manage_template => true
            template => "/etc/logstash/templates/outputs/business-core.json"
            template_overwrite => true
            template_name => "business-core"
            ilm_rollover_alias => "business-core"
            ilm_pattern => "000001"
            ilm_policy => "business-ilmpolicy"
            http_compression => true
            document_id => "%{[@metadata][document_id]}"
}

```

I will have 3 root index's, for example business, businessWealth, businessHappiness.

- business-core-\* (Index alias would be simply business-core)
- businessWealth-core-\*
- businessHappiness-core-\*

To make this work I would need 3 if clauses with in my output as I can not use dynamic variables here.

Reading the documentation it sounds like the ILM settings are used mainly for creating/updating the settings in ES.

Can I simply modify this setting above to:

```auto
elasticsearch {
            hosts => ["https://mind.your.business:9200"]            
			index => %{business}-core
			http_compression => true
            document_id => "%{[@metadata][document_id]}"
}

```

If I create all the templates outside of Logstash(I would use Ansible to post the template name in for the various combinations) does Logstash need to understand that ILM is even enabled? Or does it just need to be pointed to the correct index alias name and ES will  
handle all the rollovers?

If I didn't want to create the ILM settings externally, could I just create another logstash dummy pipeline that would just be a long list of outputs with  
all the various ILM settings. This would make my output sections a lot cleaner.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 27, 2021, 4:40am UTC](https://discuss.elastic.co/t/workaround-to-dynamic-index-names-when-ussing-ilm-policy/271311/2 "2021-04-27T04:40:32Z")

</div>

You can use your last example as long as all the ILM is configured in Elasticsearch and you are writing to the ILM write alias.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 25, 2021, 4:41am UTC](https://discuss.elastic.co/t/workaround-to-dynamic-index-names-when-ussing-ilm-policy/271311/3 "2021-05-25T04:41:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.