ILM event substitution PoC

[Battleroid]

This is more or less a POC for ILM event substitution via Logstash spun off from this issue here. The problems from this comment here can apply as well.

However, we're using this internally for about ~25 clusters and it works reasonably well with a setup such as:

elasticsearch {
  hosts => [
    ...
  ]
  index => "%{elasticsearch_index}"
  document_type => "log"
  codec => "json"
  user => "logstash"
  manage_template => false

  # ilm
  ilm_enabled => true
  ro_only_enabled => true
  ilm_set_rollover_alias => false
  ilm_rollover_alias => "catchall-example"
  ilm_event_alias => "%{elasticsearch_index}"
  ilm_cache_once => false
}

It's by no means perfect. Performance hit isn't that bad when set to cache once, we then have something external to attach the lifecycle rollover alias names and policies which solves our dynamic ILM event index name substitution problem at the moment.

I wrote a simple test to demonstrate the results here.