CODEWITHSUNDEEP
elasticsearchlogstashdata-streamilm
sbstnmrwld
sbstnmrwld

Reputation: 36

Best pratices for for ilm and dynamic indices in logstash elasticsearch output plugin

I am struggeling to find a suitable way to handle ilm rollover on dynamic indices from a logstash pipeline to elasticsearch.

The pipeline looks like that:

input {
  pipeline { 
    address => "some_pipeline_name"
  }
}

output {
  elasticsearch {
    hosts => [ "serv1", "server2" ]
    index => "%{[label1]}-%{[label2]}-%{[label3]}"
    user => "logstash_user_to_send_elasticsearch"
    password => "password1337"
  }
}

If I have an index template for the index that was dynamically created everythings works well and there are no problems with ilm and rollover.

But since I don't know all values the 3 labels can get, I don't know how to handle the ilm aspect. It is not possible to define ilm_rollover_alias dynamically and I am not able to create pipelines for every possible value of label* in advance.

How do you guys handle this problem?

Regards

Sebastian

Upvotes: 1

Views: 802

Answers (0)

Related Questions