Elastic version 8.17.1
Context: multiple systems logging to a datastream, so we want to create one dataview in Kiabana for each system. Infra provisioned via ansible, and our elastic/kibana objects/configs provisioned via terraform, but I would guess this is irrelevant.
We have filebeat sending logs to a datastream with ilm enabled. Datastream called "foo-8.17.1", so backing indexes are like ".ds-foo-8.17.1-2025.02.04-000001".
We also created an index template with aliases (one for each system), via terraform:
resource "elasticstack_elasticsearch_index_template" "foo_index_template" {
name = "foo-index-template"
priority = 200
index_patterns = ["foo-*"]
dynamic "template" {
for_each = var.data_views
content {
alias {
name = template.key
filter = jsonencode({
wildcard = {
"kubernetes.pod.name" = "${template.value}*"
}
})
}
}
}
}
What we found is that this only worked when we first created the index template above, and then create the data stream later.
If the datastream is already present, and then we create the index template, we don't get the aliases to the new indexes when we rollover.
1 post - 1 participant