How to Forward Logs to Elasticsearch

Log data is the lifeblood of modern infrastructure, application monitoring, and security operations. From web servers and databases to microservices and cloud-native applications, every system generates vast amounts of log data that hold critical insights into performance, errors, user behavior, and security threats. However, managing and analyzing this data at scale is a complex challenge. Thats where Elasticsearch comes in.

Elasticsearch, a distributed, RESTful search and analytics engine built on Apache Lucene, is one of the most powerful tools for ingesting, indexing, and querying structured and unstructured log data. When paired with the Elastic Stack particularly Filebeat, Fluentd, or Logstash it becomes an industry-standard solution for centralized log management.

Forwarding logs to Elasticsearch means collecting log entries from multiple sources, transforming them into a consistent format, and sending them to an Elasticsearch cluster for real-time search, visualization, and alerting. This process enables DevOps and SRE teams to detect anomalies faster, troubleshoot issues proactively, and maintain system reliability across distributed environments.

In this comprehensive guide, youll learn exactly how to forward logs to Elasticsearch from choosing the right tool and configuring agents to optimizing performance and securing your pipeline. Whether youre managing on-premises servers, Kubernetes clusters, or hybrid cloud infrastructure, this tutorial provides the actionable steps and best practices needed to build a scalable, resilient log forwarding pipeline.

Step-by-Step Guide

Step 1: Understand Your Log Sources and Requirements

Before you begin forwarding logs, identify the systems generating logs and the type of data you need to collect. Common log sources include:

• Web servers (Apache, Nginx)
• Application servers (Node.js, Java, Python)
• Database systems (PostgreSQL, MySQL, MongoDB)
• Operating systems (Linux syslog, Windows Event Logs)
• Container platforms (Docker, Kubernetes)
• Cloud services (AWS CloudWatch, Azure Monitor)

Determine your goals:

• Are you monitoring for errors and performance degradation?
• Do you need compliance auditing or security incident detection?
• Will you visualize trends over time using Kibana?

These answers will influence your choice of log forwarding tool, data schema, retention policy, and indexing strategy.

Step 2: Set Up an Elasticsearch Cluster

Before forwarding logs, ensure you have a running Elasticsearch cluster. You can deploy Elasticsearch in several ways:

• Self-hosted: Install on physical or virtual machines using official packages from elastic.co.
• Cloud-hosted: Use Elastic Cloud for a fully managed service with autoscaling, backups, and monitoring.
• Kubernetes: Deploy using the Elastic Cloud on Kubernetes (ECK) operator.

For production environments, follow these minimum recommendations:

• Use at least three master-eligible nodes for high availability.
• Separate data nodes from coordinating nodes for better resource isolation.
• Enable TLS/SSL for node-to-node and client-to-node communication.
• Configure adequate heap size (no more than 50% of system RAM, capped at 30GB).
• Set up disk usage alerts to prevent index failures.

After deployment, verify your cluster is healthy using the cluster health API:

curl -X GET "localhost:9200/_cluster/health?pretty"

Ensure the status is green. If its yellow or red, investigate shard allocation issues or node connectivity problems.

Step 3: Choose a Log Forwarding Agent

There are three primary tools used to forward logs to Elasticsearch. Each has strengths depending on your environment:

Filebeat

Filebeat is a lightweight, Go-based shipper developed by Elastic. Its ideal for forwarding logs from files on disk especially on servers where resource usage must be minimized. Filebeat reads log files, parses them using processors, and sends them directly to Elasticsearch or via Logstash for further processing.

Use Filebeat when:

• Youre collecting from flat log files (e.g., /var/log/nginx/access.log)
• System resources are limited (e.g., edge devices, containers)
• You want minimal configuration overhead

Fluentd

Fluentd is an open-source data collector with a plugin-based architecture. It supports over 700 plugins and is highly extensible. Fluentd excels in complex environments where log transformation, filtering, and routing across multiple destinations are required.

Use Fluentd when:

• You need to enrich logs with metadata (e.g., Kubernetes labels)
• Youre aggregating logs from diverse sources (JSON, CSV, syslog, etc.)
• You require dynamic routing or multi-output pipelines

Logstash

Logstash is a server-side data processing pipeline with powerful filtering and transformation capabilities. Its written in Ruby and can handle heavy parsing, grok patterns, and conditional logic. However, it consumes more memory and CPU than Filebeat or Fluentd.

Use Logstash when:

• You need advanced parsing (e.g., extracting fields from unstructured logs)
• Youre applying complex transformations (e.g., geolocation, date formatting)
• Youre integrating with legacy systems or non-standard log formats

For most modern deployments, Filebeat ? Elasticsearch is preferred for simplicity and efficiency. Use Logstash or Fluentd only when advanced processing is required.

Step 4: Install and Configure Filebeat (Recommended Approach)

For this guide, well use Filebeat as the primary log forwarder due to its efficiency and native integration with Elasticsearch.

Install Filebeat

On Ubuntu/Debian:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo "deb https://artifacts.elastic.co/packages/8.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-8.x.list
sudo apt update
sudo apt install filebeat

On RHEL/CentOS:

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch
cat > /etc/yum.repos.d/elastic-8.x.repo 
[elastic-8.x]
name=Elastic repository for 8.x packages
baseurl=https://artifacts.elastic.co/packages/8.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=1
autorefresh=1
type=rpm-md
EOF
sudo yum install filebeat

Configure Filebeat

Edit the configuration file:

sudo nano /etc/filebeat/filebeat.yml

Start with a basic configuration to forward Nginx access logs:

filebeat.inputs:
- type: filestream
enabled: true
paths:
- /var/log/nginx/access.log
output.elasticsearch:
hosts: ["https://your-elasticsearch-host:9200"]
username: "filebeat_internal"
password: "your-secure-password"
ssl.certificate_authorities: ["/etc/pki/tls/certs/ca.crt"]
ssl.verification_mode: "full"
setup.template.name: "nginx-access"
setup.template.pattern: "nginx-access-*"
setup.template.overwrite: true
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx-access"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.pattern_rotation: daily
setup.ilm.rotation_strategy: count
setup.ilm.enabled: true
setup.ilm.rollover_alias: "nginx