How to set index template follow timestamp?

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
opensearch 2.7.0

Describe the issue:
for example. there are indexs

log-2023.07.08
log-2023.07.09
log-2023.07.10

today is 2023.07.10 and I put a log like this
{ “@timestamp”: 2023-07.08,
“type”:“firewall”}

I want to this log put “log-2023.07.08” index not today index

how to set index template???

now, I set just rollover that create index for 1day in index template

2

Index template only affects creating new index, I think it cannot resolve your problem, but you can use ingest pipeline to redirect the write index to another, like this:

PUT _ingest/pipeline/redirect
{
  "processors": [
    {
      "set": {
        "field": "_index",
        "value": "log-{{{@timestamp}}}"
      }
    }
  ]
}

, set this pipeline when do bulking or set this pipeline as the default pipeline of the original write index:

POST original_write_index/_doc?pipeline=redirect
{
   "@timestamp": 2023-07.08,
   "type":"firewall"
}
1 Like