I have both Elasticsearch
and Logstash
in version 7.9.1-1
installed. Here's the policy I've created:
PUT _ilm/policy/test-policy
{
"policy": {
"phases": {
"hot": {
"actions": {
"rollover": {
"max_age": "2d"
}
}
}
}
}
}
And its corresponding template:
PUT _template/test-template
{
"index_patterns": ["test-*"],
"settings": {
"number_of_shards": 1,
"number_of_replicas": 1,
"index.lifecycle.name": "test-policy",
"index.lifecycle.rollover_alias": "test-read_n_write"
}
}
And, finally, the initial alias:
PUT test-000001
{
"aliases": {
"test-read_n_write":{
"is_write_index": true
}
}
}
After the first rollover, I'd like to have the alias point to the newly generated index (i.e. test-000002
) only for both read and write operations - instead of just writing to the most recent one and searching multiple indices with the test-read_n_write
alias.
Am I able to do that with automatic rollover?