new_indexedit

This optional setting is only used by the rollover action.

description: >-
  Rollover the index associated with alias 'name'.  Specify new index name using
  date math.
options:
  name: aliasname
  new_index: "<prefix-{now/d}-1>"
  conditions:
    max_age: 1d
  wait_for_active_shards: 1

A new index name for rollover should still end with a dash followed by an incrementable number, e.g. my_new_index-1, or if using date math, <prefix-{now/d}-1> or <prefix-{now/d}-000001>

date_mathedit

This setting may be a valid Elasticsearch date math string.

A date math name takes the following form:

<static_name{date_math_expr{date_format|time_zone}}>

static_name

is the static text part of the name

date_math_expr

is a dynamic date math expression that computes the date dynamically

date_format

is the optional format in which the computed date should be rendered. Defaults to YYYY.MM.dd.

time_zone

is the optional time zone . Defaults to utc.

The following example shows different forms of date math names and the final form they resolve to given the current time is 22rd March 2024 noon utc.

Expression Resolves to

<logstash-{now/d}>

logstash-2024.03.22

<logstash-{now/M}>

logstash-2024.03.01

<logstash-{now/M{YYYY.MM}}>

logstash-2024.03

<logstash-{now/M-1M{YYYY.MM}}>

logstash-2024.02

<logstash-{now/d{YYYY.MM.dd|+12:00}}>

logstash-2024.03.23

There is no default value for new_index.