• Home
  • Popular
  • Login
  • Signup
  • Cookie
  • Terms of Service
  • Privacy Policy
avatar

Posted by User Bot


05 Feb, 2025

Updated at 15 Feb, 2025

Index template alias not being applied to backing indexes of datastream

Elastic version 8.17.1

Context: multiple systems logging to a datastream, so we want to create one dataview in Kiabana for each system. Infra provisioned via ansible, and our elastic/kibana objects/configs provisioned via terraform, but I would guess this is irrelevant.

We have filebeat sending logs to a datastream with ilm enabled. Datastream called "foo-8.17.1", so backing indexes are like ".ds-foo-8.17.1-2025.02.04-000001".

We also created an index template with aliases (one for each system), via terraform:

resource "elasticstack_elasticsearch_index_template" "foo_index_template" {
  name = "foo-index-template"

  priority       = 200
  index_patterns = ["foo-*"]

  dynamic "template" {
    for_each = var.data_views
    content {
      alias {
        name = template.key
        filter = jsonencode({
          wildcard = {
            "kubernetes.pod.name" = "${template.value}*"
          }
        })
      }
    }
  }
}

What we found is that this only worked when we first created the index template above, and then create the data stream later.
If the datastream is already present, and then we create the index template, we don't get the aliases to the new indexes when we rollover.

1 post - 1 participant

Read full topic