# Index alias for multiple indices

**URL:** <https://forum.opensearch.org/t/index-alias-for-multiple-indices/2804>\
**Category:** Index Management\
**Created:** [May 15, 2020, 11:30am UTC](https://forum.opensearch.org/t/index-alias-for-multiple-indices/2804 "2020-05-15T11:30:55Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![allanjohn909](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@allanjohn909](https://forum.opensearch.org/u/allanjohn909)\
**Post date:** [May 15, 2020, 11:30am UTC](https://forum.opensearch.org/t/index-alias-for-multiple-indices/2804/1 "2020-05-15T11:30:56Z")

</div>

Hi,

I am currently working with Opendistro elasticsearch and we have been using ISM. The process is when a new Logstash configuration is created with a new index, we manually create a template for the index and create a new index with an alias and place the alias in Logstash.

We have a new requirement, where we will need to setup the same way we use currently but for new application. For example the new index will look like `logstash-%%{app}` where the app will be a tag, or a field from filebeat.

I am stuck now, because in this situation we may not know the application name in advance and hence not sure how to proceed. Can someone help here?

---

<div class="post-metadata">

**Author:** ![allanjohn909](https://avatars.discourse-cdn.com/v4/letter/a/5fc32e/32.png) [@allanjohn909](https://forum.opensearch.org/u/allanjohn909)\
**Post date:** [May 29, 2020, 7:42am UTC](https://forum.opensearch.org/t/index-alias-for-multiple-indices/2804/2 "2020-05-29T07:42:51Z")

</div>

Any response for this issue?

---

<div class="post-metadata">

**Author:** ![larwied](https://avatars.discourse-cdn.com/v4/letter/l/2bfe46/32.png) [@larwied](https://forum.opensearch.org/u/larwied)\
**Post date:** [June 8, 2020, 9:39pm UTC](https://forum.opensearch.org/t/index-alias-for-multiple-indices/2804/3 "2020-06-08T21:39:19Z")

</div>

Same issue here. We are looking for some ISM options in in the Logstash plugin.  
Something like this → [Elasticsearch output plugin | Logstash Reference [8.4] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-ilm)

---

<div class="post-metadata">

**Author:** ![jbarnett](https://avatars.discourse-cdn.com/v4/letter/j/ba8739/32.png) [@jbarnett](https://forum.opensearch.org/u/jbarnett)\
**Post date:** [June 26, 2020, 4:05pm UTC](https://forum.opensearch.org/t/index-alias-for-multiple-indices/2804/4 "2020-06-26T16:05:06Z")

</div>

Also same issue here. I have logs being sent via logstash to indices named `syslog-YYYY.MM.DD`.

logstash.conf output looks like this:

```
output {
   elasticsearch { 
       hosts => ["https://localhost:9200"]
       index => "%{type}-%{+YYYY.MM.dd}"
       ssl => true

```

These are associated to an alias named `syslog` using the index regex `syslog-20*`

```
{
    "actions": [
      {
        "add": {
          "index": "syslog-20*",
          "alias": "syslog"
        }
      }
    ]
  }

```

Since the indices are named with a date suffix, and not the `-00001` format that the rollover function looks for, I need to create a separate index named `syslog-00001` and set `is_write_index: true` for the `syslog` alias. Then my logs get rolled, but I’m constantly incrementing a separate (albeit smaller) index…

It would be nice to be able to configure logstash output to specify alias/pattern as @ [larwied](https://forum.opensearch.org/u/larwied) mentioned or have the option to rollover indices matching a custom regex and not just “^.\*-\d$”

---

<div class="post-metadata">

**Author:** ![GSmith](https://avatars.discourse-cdn.com/v4/letter/g/bbe5ce/32.png) [@GSmith](https://forum.opensearch.org/u/GSmith)\
**Post date:** [June 30, 2020, 3:09pm UTC](https://forum.opensearch.org/t/index-alias-for-multiple-indices/2804/5 "2020-06-30T15:09:44Z")

</div>

@dbbaughe Don’t know if you saw this since it wasn’t under the Index Management category…can you provide any guidance here?

---

<div class="post-metadata">

**Author:** ![dbbaughe](https://avatars.discourse-cdn.com/v4/letter/d/bbe5ce/32.png) [@dbbaughe](https://forum.opensearch.org/u/dbbaughe)\
**Post date:** [June 30, 2020, 4:15pm UTC](https://forum.opensearch.org/t/index-alias-for-multiple-indices/2804/6 "2020-06-30T16:15:39Z")

</div>

I did not see this @GSmith, thanks 🙂  
Moving to ISM section and will look into this

---

<div class="post-metadata">

**Author:** ![nico007](https://avatars.discourse-cdn.com/v4/letter/n/9de0a6/32.png) [@nico007](https://forum.opensearch.org/u/nico007)\
**Post date:** [July 31, 2020, 1:58pm UTC](https://forum.opensearch.org/t/index-alias-for-multiple-indices/2804/7 "2020-07-31T13:58:50Z")

</div>

Bumping for any updates?  
We have similar indices named with variables such as beat version and date, that we don’t know in advance. Our setup is FB\>LS\>ES and we want to roll based on size.  
filebeat\_testing-7.2.4  
filebeat\_testing-7.5.0  
…  
filebeat\_testing-7.5.0-2020-07-29

Any help is appreciated,  
Currently we are using the following template with no luck. Bootstrapping works only if LS outputs to a constant “filebeat\_testing”.

PUT \_template/ism-test-template  
{  
“index\_patterns”: [  
“filebeat\_testing\*”  
],  
“order”: 10,  
“settings”: {  
“opendistro.index\_state\_management.rollover\_alias”: “filebeat\_testing”,  
“opendistro.index\_state\_management.policy\_id”: “simple\_rotate\_100GB”,  
“number\_of\_shards”: 4,  
“number\_of\_replicas”: 1,  
“refresh\_interval”: “30s”  
}  
}