Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add guidance on using CCR with Logstash #36609

Merged
merged 5 commits into from
Dec 13, 2018
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 36 additions & 2 deletions docs/reference/ccr/requirements.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,8 @@ For more information about index settings, see {ref}/index-modules.html[Index mo
If you want to replicate indices created by APM Server or Beats, and are
allowing APM Server or Beats to manage index templates, you need to configure
soft deletes on the underlying index templates. To configure soft deletes on the
underlying index templates, add the following changes to the relevant APM Server
or Beats configuration file.
underlying index templates, incorporate the following changes to the relevant
APM Server or Beats configuration file.

["source","yaml"]
----------------------------------------------------------------------
Expand All @@ -62,3 +62,37 @@ setup.template.settings:
For additional information on controlling the index templates managed by APM
Server or Beats, see the relevant documentation on loading the Elasticsearch
index template.

[float]
[[ccr-overview-logstash]]
==== Setting soft deletes on indices created by Logstash

If you want to replicate indices created by Logstash, and are using Logstash to
manage index templates, you need to configure soft deletes on a custom Logstash
index template. To configure soft deletes on the underlying index template,
incorporate the following change to a custom Logstash template.

["source","js"]
----------------------------------------------------------------------
{
"settings" : {
"index.soft_deletes.retention.operations" : 1024
}
}
----------------------------------------------------------------------
// NOTCONSOLE

Additionally, you will need to configure the Elasticsearch output plugin to use
this custom template.

["source","ruby"]
----------------------------------------------------------------------
output {
elasticsearch {
template => "/path/to/custom/logstash/template.json"
}
}
----------------------------------------------------------------------

For additional information on controlling the index templates managed by
Logstash, see the relevant documentation on the Elasticsearch output plugin.