Sample run(s) with ILM changes

cat indices

health status index                  uuid                   pri rep docs.count docs.deleted store.size pri.store.size
green  open   test-2019.06.14-000001 Uojm0KlsTN-MAIuCrypmjg   5   1        100            0     98.8kb         41.6kb
green  open   ghi-2019.06.14-000001  wnK2VzqDTnCs7yfBcfc84Q   5   1        100            0    124.8kb         49.6kb
green  open   def-2019.06.14-000001  C-wMZRCOT-GzasLJWecNpQ   5   1        100            0      138kb         56.3kb
green  open   abc-2019.06.14-000001  20q8O_8zTXKTgEfB_jrxoQ   5   1        100            0      118kb         49.6kb

logstash.conf

input {
  generator {
    lines => [
      # Standard cases
      '{"alias_name": "abc", "message": "hello 1"}',
      '{"alias_name": "def", "message": "hello 2"}',
      '{"alias_name": "ghi", "message": "hello 3"}',

      # In this case, no alias_name field exists
      '{"message": "hello 4"}'
    ]
    count => 100
  }
}

filter {
  json {
    source => "message"
  }
}

output {
  elasticsearch {
    hosts => [
      "localhost:9200"
    ]
    codec => "json"
    user => "username"
    password => "password"
    manage_template => false
    ilm_enabled => true
    ilm_policy => "default"
    ilm_rollover_alias => "test"
    ilm_event_alias => "%{alias_name}"
  }
}