Make ES output plugins write to an alias instead of directly to index
Description
Gliffy Diagrams
Activity
Jordan Sissel June 6, 2014 at 5:47 AM
Marking fixed because I'm pretty sure Elasticsearch 1.1.0 solves this via index templates + alias creation with those templates.
Jordan Sissel June 6, 2014 at 5:46 AM
You're in luck! Elasticsearch 1.1.0 solves by allowing alias creation with indexes using index templates.
http://www.elasticsearch.org/guide/en/elasticsearch/reference/current/indices-templates.html
Look for this section: "It is also possible to include aliases in an index template as follows:"
Nick Willever June 6, 2014 at 5:37 AM
I would also like to show my support for this feature. I've been doing this manually, by creating the indices ahead of time and creating aliases that logstash will write to. Though when you have this the actual index name, not alias shows up in kibana search; but it all still works exactly the same. And as said in the ticket, it provides ES admins some flexibility in redirecting data, fixing mapping, etc.. without downtime.
The ES output module creates an index per 24 hours. Logstash writes directly to these indexes. If however the ES output modules could (optionally) create an alias along with the newly created index, and write to that alias, it would give flexibility to ES admins to redirect incoming data to other indexes when required without causing downtime to the Logstash writer(s).
Following behavior:
add new optional parameter "alias" to ES output plugin definition.
when new index is created also an alias is created to it
logstash writes to this alias
Ticket https://logstash.jira.com/browse/LOGSTASH-293 refers to the same functionality but got closed.