I’m using logstash 2.2, in a Centos 6. Logstash rotates the indices each day, is there any way to rotate index every 2 days or 3 days?. Or rotate the index by size?. I must save and keep open the index by 6 months. I want to create a new index with max size in 45GB.
You currently cannot do this natively, you’d have to build a process to monitor the time/size and then roll the index.
Understood, thank you.
A way to do this is by having an alias for the index you are writing into and use this in Logstash. You can then roll indices in the background through a script based on age and/or size. When the index being written to reaches the point when it should be rolled, create the next index and then switch the alias to point to the new index.
ok, Thanks Christian.