Question

We are using es 6.7 and serilog 7.1 in our dotnet core application.

In our logger implementation vi are using the following index "app-{0:yyyy.MM}-1" for our ElasticsearchSinkOptions.

This creates an index called app-2019.04-1 as expected.

However we set up an alias and a lifecycle policy which do a roll over action and creates a new index called app-2019.04-000002 after some conditions have been met - as expected.

The issue is that our dot net core application still logs to the first index app-2019.04-1 . How do we update the index format being used in the dot net core application when elastic search has performed a roll over action?

Answer 1

Well I figure it out. Maybe it will help someone else. I had to log it to the alias and not the index.

For making it work you need to:

Create an index with format xxxx-1
Create an alias and ad it to the index e.g. xxxx
Create index pattern xxxx-*
Create lifecycle policy
Create template with indexpattern, alias and lifecycle policy
Make sure your indexformat in serilog is the alias.

Start logging :)

友情链接