I have been using the following code for the elasticsearch output plugin of a logstash, but it creates the index named as mt-raw-00001
output {
elasticsearch {
hosts => [ "${ECK_ES_HOSTS}" ]
user => "${ECK_ES_USER}"
password => "${ECK_ES_PASSWORD}"
ssl_certificate_authorities => "${ECK_ES_SSL_CERTIFICATE_AUTHORITY}"
index => "mt-raw-%{+YYYY.MM.dd}"
# index => "mt-raw"
data_stream => false
ilm_enabled => "true"
ilm_pattern => "00001"
ilm_rollover_alias => "mt-raw"
ilm_policy => "mt-ilm"
manage_template => "true"
template_name => "mt"
}
I tried with
index => "mt-raw-%{+YYYY.MM.dd}"
and
index => "mt-raw-%{+yyyy.MM.dd}"
but the result is the same.
How can I resolve this issue?