Does Elasticsearch curator Rollover action doesn't support Date math in the name?

Question

I'm trying to use the date math in the elasticsearch curator rollover action, but it seems like it doesn't support alias name as a date math like '<indexname-{now/d}>'

---
# Remember, leave a key empty if there is no value.  None will be a string,
# not a Python "NoneType"
#
# Also remember that all examples have 'disable_action' set to True.  If you
# want to use this action as a template, be sure to set this to False after
# copying it.
actions:
  1:
    action: rollover
    description: >-
      Rollover the index associated with alias 'indexname-{now/d}', index should be in the format of indexname-{now/d}-000001.
    options:
      disable_action: False
      name: '<indexname-{now/d}>'
      conditions:
        max_age: 1d
        max_docs: 1000000
        max_size: 50g
      extra_settings:
        index.number_of_shards: 3
        index.number_of_replicas: 1

It is taking that name '<indexname-{now/d}>' as a string/ alias name and gives an error

Failed to complete action: rollover. <class 'ValueError'>: Unable to perform index rollover with alias "<indexname-{now/d}>".

I'll suggest adding the support for date math in the alias name for rollover action in the elasticsearch curator.

Answer 1

What it appears you are trying to do is to rollover an alias named indexname-2021.10.28. Is that correct? I mention this because the name directive is for the alias name rather than the index name. Additionally, using this pattern would be looking for an alias with today's date {now/d}, but the rollover conditions appear to be looking for something older than 1 day (or 1M docs, or over 50g). If that alias is older than 24 hours, the lookup will fail because it's looking for something that has likely not been created yet.

I presume you are more likely looking for an alias with a name like index name that points to indices that look like indexname-YYYY.MM.dd. Did you know that this behavior is automatic if the original index and alias combination are created with date math?

For example, if I had created this index + alias combination yesterday (and it's URLencoded for use in the dev tools console):

# PUT <my-index-{now/d}-000001>
PUT %3Cmy-index-%7Bnow%2Fd%7D-000001%3E
{
  "aliases": {
    "my-index": {
      "is_write_index": true
    }
  }
}

The results would say:

{
  "acknowledged" : true,
  "shards_acknowledged" : true,
  "index" : "my-index-2021.10.27-000001"
}

And if I forced a rollover today:

POST my-index/_rollover
{
  "conditions": {
    "max_age": "1d"
  }
}

This is the resulting output:

{
  "acknowledged" : true,
  "shards_acknowledged" : true,
  "old_index" : "my-index-2021.10.27-000001",
  "new_index" : "my-index-2021.10.28-000002",
  "rolled_over" : true,
  "dry_run" : false,
  "conditions" : {
    "[max_age: 1d]" : true
  }
}

With this behavior, it's very simple to get a date in the index name while still using default rollover behavior.