I'm using the ELK Stack in version 7.5.2 in Docker container on a CentOS7 AWS Machine.
My goal is to load filebeat Kibana dashboards with custom index pattern set (to replace the filebeat-* default).
Here is the beginning of my filebeat.yml :
output.elasticsearch:
index: "neito_index-%{[agent.version]}-%{+yyyy.MM.dd}"
hosts: ["elasticsearch:9200"]
setup:
template:
name: "neito_index"
pattern: "neito_index-*"
fields: "./fields.yml"
dashboards:
index: "neito_index-*"
enabled: true
kibana:
host: "kibana:5601"
When I execute filebeat setup -e
in filebeat it still create index prefixed with filebeat-
instead of neito_index-
as specified in the .yml
file
Here is the output of the filebeat setup -e
command :
2020-06-30T08:52:49.784Z INFO [index-management] idxmgmt/std.go:182 Set output.elasticsearch.index to 'filebeat-7.5.2' as ILM is enabled.
2020-06-30T08:52:49.784Z INFO elasticsearch/client.go:171 Elasticsearch url: http://elasticsearch:9200
2020-06-30T08:52:49.785Z INFO [publisher] pipeline/module.go:97 Beat name: filebeat
2020-06-30T08:52:49.785Z INFO elasticsearch/client.go:171 Elasticsearch url: http://elasticsearch:9200
2020-06-30T08:52:49.789Z INFO elasticsearch/client.go:753 Attempting to connect to Elasticsearch version 7.5.2
2020-06-30T08:52:49.829Z INFO [index-management] idxmgmt/std.go:256 Auto ILM enable success.
2020-06-30T08:52:49.846Z INFO [index-management] idxmgmt/std.go:269 ILM policy successfully loaded.
2020-06-30T08:52:49.846Z INFO [index-management] idxmgmt/std.go:408 Set setup.template.name to '{filebeat-7.5.2 {now/d}-000001}' as ILM is enabled.
2020-06-30T08:52:49.846Z INFO [index-management] idxmgmt/std.go:413 Set setup.template.pattern to 'filebeat-7.5.2-*' as ILM is enabled.
2020-06-30T08:52:49.846Z INFO [index-management] idxmgmt/std.go:447 Set settings.index.lifecycle.rollover_alias in template to {filebeat-7.5.2 {now/d}-000001} as ILM is enabled.
2020-06-30T08:52:49.846Z INFO [index-management] idxmgmt/std.go:451 Set settings.index.lifecycle.name in template to {filebeat-7.5.2 {"policy":{"phases":{"hot":{"actions":{"rollover":{"max_age":"30d","max_size":"50gb"}}}}}}} as ILM is enabled.
2020-06-30T08:52:49.847Z INFO template/load.go:169 Existing template will be overwritten, as overwrite is enabled.
2020-06-30T08:52:49.966Z INFO template/load.go:109 Try loading template filebeat-7.5.2 to Elasticsearch
2020-06-30T08:52:50.031Z INFO template/load.go:101 template with name 'filebeat-7.5.2' loaded.
2020-06-30T08:52:50.031Z INFO [index-management] idxmgmt/std.go:293 Loaded index template.
2020-06-30T08:52:50.031Z INFO [index-management] idxmgmt/std.go:304 Write alias successfully generated.
What am I doing wrong ?