handling rollover and life-cycle of casual indices is much harder than dealing with data-streams
nothing special yet – see policy-mgmt
do not send logs yet, prepare the write index first
Dev Tools
PUT test-000001 { "aliases": { "test-alias":{ "is_write_index": true } } }
name test-tpl type index pattern test-* alias NONE (NOT ROLLOVER ALIAS) adv settings
{ "index.plugins.index_state_management.rollover_alias": "test-alias" }
mapping
{ "numeric_detection": true, "dynamic": "true", "date_detection": false }
send some logs to the rollover alias and define an index pattern to check the index
field
==> goes to test-000001
also back to index mgmt, that index shows up under the test policy
https://opster.com/guides/elasticsearch/data-architecture/index-lifecycle-policy-management/