title: How to use Elasticsearch rollover API where alias is updated to point to the latest created index?
body: <p>I have a Logstash pipeline that runs on a daily schedule and pushes data to Elasticsearch using <code>agent_index_%{+YYYY_MM_dd}</code> index signature. So every day I would get a new index created eg: agent_index_2020_05_05 for 5th May 2020 and agent_index_2020_05_06 for 6th May 2020. </p>
  
  <p>For this agent index alias is updated using it's mapping, which works fine, but my requirement is that the agent alias should always point to only 1 index that is the latest index.</p>
  
  <p>mapping </p>
  
  <pre><code>PUT /_template/agent_template
  {
    "order": 0,
    "index_patterns": [
      "agent_index_*"
    ],
    "aliases": {
      "agent": {}
    }
  }
  </code></pre>
  
  <p>I looked into <a href="https://www.elastic.co/guide/en/elasticsearch/reference/5.4/indices-rollover-index.html" rel="nofollow noreferrer">this</a>, but looks like the index name must end in incremental numbers.</p>
  
  <pre><code>POST /agent/_rollover?dry_run
  {
    "conditions": {
      "max_age": "1d"
    }
  }
  </code></pre>
  
  <p>Error</p>
  
  <pre><code>{
    "error": {
      "root_cause": [
        {
          "type": "illegal_argument_exception",
          "reason": "index name [agent_index_2020_05_06] does not match pattern '^.*-\\d+$'"
        }
      ],
      "type": "illegal_argument_exception",
      "reason": "index name [agent_index_2020_05_06] does not match pattern '^.*-\\d+$'"
    },
    "status": 400
  }
  </code></pre>
  
  <p>Is there a way to use elasticsearch rollover API to only allow the latest created index to be updated in the alias, that means at a given point alias points to only one index which is the latest index?</p>
  
  <p>Note: Using Elasticsearh v6.2.4</p>
  
  <p><strong>Update</strong></p>
  
  <p>My Logstash configuration</p>
  
  <pre><code>input {
      jdbc {
          jdbc_driver_library =&gt; "ojdbc7.jar"
          jdbc_driver_class    =&gt; "Java::oracle.jdbc.OracleDriver"
          jdbc_connection_string =&gt; "jdbc:oracle:thin:@EDM:1521/aba"
          jdbc_user =&gt; "read"
          jdbc_password =&gt; "read"
          schedule =&gt; "50 6 * * *"
          statement_filepath =&gt;"agent.sql"
         }
  }
  output {
      elasticsearch {
          hosts =&gt; "localhost:17002"
          index =&gt; "agent_index_%{+YYYY_MM_dd}"
          document_type =&gt; "agent"
      }
  }
  </code></pre>
  
  <p><strong>Update</strong></p>
  
  <p>Using <a href="https://www.elastic.co/guide/en/logstash/current/node-stats-api.html#event-stats" rel="nofollow noreferrer">monitoring API</a> to get details as suggested by @Val, but everytime I run <code>curl -XGET "localhost:15050/_node/stats/events?pretty"</code> I get different IN count. Please check screenshot below. So how do I determine if total events are fetched?</p>
  
  <p><a href="https://i.stack.imgur.com/dL1q9.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/dL1q9.png" alt="enter image description here"></a></p>