- 使用通配符index的時候，需把use_strftime_index 設為true
use_strftime_index： true - index應該修改為如下格式
index: logstash-vpn-%Y.%m.%d
以下是官方參考文檔
index
index: The name of the index that will be searched. Wildcards can be used here, such as: index: my-index-* which will match my-index-2014-10-05. You can also use a format string containing %Y for year, %m for month, and %d for day. To use this, you must also set use_strftime_index to true. (Required, string, no default)
use_strftime_index
use_strftime_index : If this is true, ElastAlert will format the index using datetime.strftime for each query. See
https://docs.python.org/2/library/datetime.html#strftime-strptime-behavior
for more details. If a query spans multiple days, the formatted indexes will be concatenated with commas. This is useful as narrowing the number of indexes searched, compared to using a wildcard, may be significantly faster. For example, if
index is logstash-%Y.%m.%d , the query url will be similar to
elasticsearch.example.com/logstash-2015.02.03/...
or elasticsearch.example.com/logstash-2015.02.03,logstash-2015.02.04/... .
