Hey,
our usecase is, that we host several Kubernetes Clusters and currently we use the following index pattern: “%{[@metadata][k8s_cluster_name]}-%{[kubernetes][namespace]}-%{[kubernetes][container][name]}-%{+xxxx.ww}”
Because now the first Indices get very big, we would like to use the ISM rollover feature with our setup. (of course we can get rid of the Year.Calender Week at the end of the index name)
For this to work, opensearch ism would need to somehow intercept the Index creation and create first index with 000001 at the end and create the needed alias.
To my understanding this is not possible with ism correct?
Maybe this could be a very interesting feature for the logstash opensearch plugin?
By letting the logstash opensearch plugin doing the heavy lifting, the usage of the feature could be greatly simplified.
If you have questions, just ask away