Creating rollover alias to only point to the current day?

Plugins Index Management
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.19.2

Describe the issue: I would like to create an alias containing only the logs of “today”. So I need an alias containing exactly one index for today like “logs-today” pointing to index “logs-2025-10-10”, and that this alias will point to exactly one index tomorrow, ie. then to “logs-2025-10-11”. Currently newly created indices can be added but not old ones removed.

Configuration:

Relevant Logs or Screenshots:

2

@OpenAndreas Great question, there is no built in way to achieve this currently, You would need to create a cron/scheduled task to execute script similar to the following:

export TZ=Europe/Dublin
today=$(date +%F); yday=$(date -v-1d +%F) \
&& curl -k -u admin:admin -H 'Content-Type: application/json' -XPOST 'https://localhost:9200/_aliases' -d "{
  \"actions\": [
    { \"remove\": { \"index\": \"logs-${yday}\", \"alias\": \"logs-today\" } },
    { \"add\":    { \"index\": \"logs-${today}\", \"alias\": \"logs-today\" } }
  ]
}"
1 Like
3

Yes, I had that thought, too. This just feels like a workaround. But I will go this path if no solution within Opensearch shows up.

4

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.