# Elasticsearch Features and Practical Usage 🌊 The era of manually rotating ` is over. With data streams your app just keeps writing to the same name, and all the backing-index management is handled for you. 🏷️ Title: Data stream (logical stream for append-only time-series data) 🔗 URL: 📘 Overview A data stream is an abstraction layer that lets you address a set of indices, optimized for append-only time-series data, under a single name. It suits continuously flowing data like logs, events, and metrics — you read and write to one resource name without worrying about the hidden "backing indices" behind it. ⚙️ How It Works ・A data stream is made of multiple auto-generated, hidden backing indices. The naming is `.ds--<>-`, where the generation is a six-digit, zero-padded integer starting at `000001` (e.g. `.ds-logs-myapp-prod-2026.06.10-000001`). ・Only the most recent "write index" accepts new documents. You cannot write directly to older backing indices. ・Searches automatically route to all backing indices, so queries span the entire dataset. ・Every document needs an `@timestamp` field mapped as `date` or `date_nanos`. If the template omits it, a default `date` mapping is applied automatically. ・A matching index template containing a `data_stream` definition is mandatory; it holds the mappings, settings, and lifecycle policy. One template can be shared across multiple data streams. ・When an age or size threshold is hit, a "rollover" creates a new backing index and switches the write index. This is automated via ILM or data stream lifecycle. 🛠️ Practical Usage First, define an index template that includes `data_stream`. `PUT _index_template/logs-myapp-template` `{ "index_patterns": ["logs-myapp-*"], "data_stream": {}, "template": { "mappings": { "properties": { "@timestamp": { "type": "date" } } } } }` Then your app simply keeps writing to the same name. `POST logs-myapp-prod/_doc` `{ "@timestamp": "2026-06-10T09:00:00Z", "level": "INFO", "message": "started" }` 💡 Use Cases A common setup is writing application logs to a `logs-myapp-prod` data stream and letting backing-index rollover be managed automatically. The app no longer rotates date-based indices (` itself; it just POSTs to the same endpoint every time. ⚠️ Caveats ・Backing index names are an internal implementation detail. They can change during restore or shrink, so never build logic (like dates) off the names. ・It is a poor fit for frequently overwriting the same ID (last-write-wins); for that, use a regular index or an alias. ・Use dedicated APIs like `update by query` and `delete by query` for modifications, and remember you cannot write directly to anything but the write index. ・You cannot delete an index template that is in use by a data stream. #Elasticsearch# #DataStreams#