弹性搜索索引模板中可以使用变量吗? [英] Can variables be used in elasticsearch index templates?

问题描述

我有很多的弹性搜索索引，它们是由logstash每天创建的，格式为:

I have a variety of elasticsearch indices which are created daily by logstash with the format:

"logstash-%{cluster_type}-%{cluster_name}-jobaccounting-v2-%{+YYYY.MM.dd}"

我想在elasticsearch中创建一个别名，该别名将从索引名称中删除版本号.我打算将我的kibana实例指向别名索引而不是版本索引，以便我可以更改版本号而不影响kibana.

I would like to create an alias in elasticsearch which drops the version number from the index name. I am planning to point my kibana instance at the aliased index rather than the versioned index so that I can change the version numbers without impacting kibana.

index: "logstash-%{cluster_type}-%{cluster_name}-jobaccounting-v2-%{+YYYY.MM.dd}"

alias: "logstash-%{cluster_type}-%{cluster_name}-jobaccounting-%{+YYYY.MM.dd}"

Elasticsearch索引模板可在每次创建新索引时用于创建别名. https://www.elastic.co/blog/aliases-ftw

Elasticsearch index templates can be used to create an alias everytime a new index is created. https://www.elastic.co/blog/aliases-ftw

不幸的是，我没有找到任何在别名中使用变量的好方法.我想避免必须为每个cluster_type，cluster_name和日期创建一个模板.

Unfortuantely, I have not found any good way to use variables in the alias name. I would like to avoid having to create a template for every cluster_type, cluster_name, and date.

如果每个变量cluster_name和cluster_type都有2个条目，那么我每天将有4个索引，每天将需要4个别名.

If I had 2 entries for each variable cluster_name and cluster_type, I would have 4 indices every day, which would require 4 aliases for each day.

如果我可以使用日期变量，那么我每天只能有4个模板，而不是4个模板.

If I could use a date variable, then I could just have 4 templates rather than 4 templates for each day.

是否可以在别名中使用日期变量?采用这种方法有意义吗?

Is there a way to use a date variable in the alias name? Does taking this approach make sense?

推荐答案

唯一可用的占位符是{index}，因此您不能在模板内编写更复杂的别名. https://www.elastic.co/blog/aliases-ftw

The only available placeholder is {index}, so you can't compose more complex alias name inside template. https://www.elastic.co/blog/aliases-ftw

这篇关于弹性搜索索引模板中可以使用变量吗?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！