elasticsearchlogstashkibanatimelion

ElasticSearch query specifying an indexname using todays date

I'm using logstash to populate ES with a number of metrics from our live services across a number of machines. Logstash creates a new index each day and i am finding that querying ES without specifying the index, is running slowly. ( i currently maintain 5 days of indicies). If i specify the specific index eg today 

.es(index=logstash-2018.01.15, q= examplequery

it runs very quickly Is there a way i can specify todays index using the date field?

eg

.es(index=logstash-'get date', q= examplequery
Solution

  • You can use the query for getting the indices of today's date:

     .es(index='<logstash-{now/d}>')

    An interesting read with all the options available in elastic search to include date math in index names:

    https://www.elastic.co/guide/en/elasticsearch/reference/current/date-math-index-names.html