Date math patterns in index name?

Security
1

Are the “date math” patterns in index name supported (Date math support in index names | Elasticsearch Guide [7.0] | Elastic)? For example logstash tries to create index “<logstash-{now/d}-0000>”, and always gets “MISSING_PRIVILEGES”, despite trying allowing various permissions, such as granting role

  • cluster permission “indices:admin/create” or
  • indexpattern “%3Clogstash-*” create_index permissions.
2

@kalev Did you get this sorted?

If anyone else is looking for this.
The permission need to be assigned to actual index name, as below:

testRole1:
  index_permissions:
    - index_patterns:
        - 'logstash-*'
      allowed_actions:
        - 'unlimited'

This can then be indexed and queried as a normal index using syntax:

POST %3clogstash-%7Bnow%2Fd%7D%3E/_doc/
{
  "manager": "testuser1",
  "host": "Brogan"
}

GET %3clogstash-%7Bnow%2Fd%7D%3E/_search