elasticsearch使用模板为logstash_yyyymmdd索引模式创建别名

时间:2020-08-13 19:15:30

标签: elasticsearch

我只想为使用模板创建的每个logstash_date索引创建别名“ logstash”。

别名“ logstash”始终应指向logstash_currentdate索引。

{
  "logstash" : {
    "order" : 0,
    "index_patterns" : [
      "logstash*"
    ],
    "settings" : {
      "index" : {
        "refresh_interval" : "5s",
        "analysis" : {
          "filter" : {
            "firsttoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^([^\.]*)\.?.*$"""
              ]
            },
            "secondtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.([^\.]*)\.?.*$"""
              ]
            },
            "thirdtoken" : {
              "type" : "pattern_capture",
              "preserve_original" : "false",
              "patterns" : [
                """^[^\.]*\.[^\.]*\.([^\.]*)\.?.*$"""
              ]
            }
          },
          "analyzer" : {
            "firsttoken" : {
              "filter" : [
                "firsttoken"
              ],
              "tokenizer" : "keyword"
            },
            "secondtoken" : {
              "filter" : [
                "secondtoken"
              ],
              "tokenizer" : "keyword"
            },
            "thirdtoken" : {
              "filter" : [
                "thirdtoken"
              ],
              "tokenizer" : "keyword"
            }
          }
        },
        "number_of_routing_shards" : "30",
        "number_of_shards" : "2",
        "number_of_replicas" : "4"
      }
    },
    "mappings" : {
      "properties" : {
        "msg" : {
          "type" : "text",
          "fields" : {
            "raw" : {
              "type" : "keyword"
            }
          }
        },
        "requestId" : {
          "type" : "keyword"
        },
        "logger" : {
          "type" : "keyword"
        },
        "host" : {
          "type" : "keyword"
        },
        "jwtOwner" : {
          "type" : "keyword"
        },
        "requestOriginator" : {
          "type" : "keyword"
        },
        "tag" : {
          "analyzer" : "firsttoken",
          "type" : "text",
          "fields" : {
            "disambiguator" : {
              "analyzer" : "keyword",
              "type" : "text"
            }
          }
        },
        "jwtAuthenticatedUser" : {
          "type" : "keyword"
        },
        "thread" : {
          "type" : "keyword"
        },
        "requestChainOriginator" : {
          "type" : "keyword"
        },
        "revision" : {
          "type" : "keyword"
        }
      }
    },
    "aliases" : { }
  }
}

上面的代码用于为带日期戳的logstash创建索引。

请帮助我找出使用别名将数据发布到当前日期索引的方式。

预先感谢...

0 个答案:

没有答案