Skip to content

Doc: Use index with/out datemath OR alias/datastream#1252

Open
karenzone wants to merge 2 commits intologstash-plugins:mainfrom
karenzone:2761-datemath-2
Open

Doc: Use index with/out datemath OR alias/datastream#1252
karenzone wants to merge 2 commits intologstash-plugins:mainfrom
karenzone:2761-datemath-2

Conversation

@karenzone
Copy link
Copy Markdown
Contributor

@karenzone karenzone commented Mar 23, 2026

@karenzone karenzone self-assigned this Mar 23, 2026
@karenzone karenzone added the docs label Mar 23, 2026
@karenzone karenzone changed the title Doc: Use index with/out datamatch OR alias/datastream Doc: Use index with/out datamath OR alias/datastream Mar 23, 2026
@karenzone karenzone changed the title Doc: Use index with/out datamath OR alias/datastream Doc: Use index with/out datemath OR alias/datastream Mar 23, 2026
Comment thread docs/index.asciidoc
Time-based routing in this plugin follows *one* model at a time. _Do not_ mix models.

* *Data streams.* Use <<plugins-{type}s-{plugin}-data_stream,`data_stream`>> and related settings.
* *Index lifecycle management (ILM) rollover.* The value you set using <<plugins-{type}s-{plugin}-ilm_pattern,`ilm_pattern`>> is used for naming, and should align with {ref}/indices-rollover-index.html#_using_date_math_with_the_rollover_api[Elasticsearch rollover naming].
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Data streams can use ILM or DLM. The callout is alias.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the clarification, @stefnestor. Please put the change you'd like to see in as a suggestion.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Uh, sorry. 🙈. I'm feeling unhelpful in you trying to help me. Starting with what you said already but said way worse:

Time-based routing in this plugin allows *one* target model at a time: data stream, alias, or index.
 _Do not_ mix models. Data stream supports ILM+DLM. Aliases support ILM. Index supports ILM 
but not ILM rollover.

Note `index` stands for an ingest target. It allows dynamic content via placeholders `%{...}`, such
as date math. Placeholders might make sense with data streams and aliases, but results should be
validated against cluster index templates and ILM setup. Placeholder date math should not normally
be used with aliases nor data streams.

Comment thread docs/index.asciidoc

* *Data streams.* Use <<plugins-{type}s-{plugin}-data_stream,`data_stream`>> and related settings.
* *Index lifecycle management (ILM) rollover.* The value you set using <<plugins-{type}s-{plugin}-ilm_pattern,`ilm_pattern`>> is used for naming, and should align with {ref}/indices-rollover-index.html#_using_date_math_with_the_rollover_api[Elasticsearch rollover naming].
* *Explicit index names.* Use the <<plugins-{type}s-{plugin}-index,`index`>> setting and `%{+...}` syntax for daily (or other) rotation.
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I really appreciate your help & don't mean to be pedantic, but I think "explicit" index name indicates static vs date math rotation is still a form of implicit naming convention 🙃.

@karenzone
Copy link
Copy Markdown
Contributor Author

cc:/ FYI @robbavey for your and your team

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Website]: Logstash ES output date math vs ILM Rollover

2 participants