I am in the process of upgrading our Elastic Stack instance from 7.5 -> 8, and am going through all of the migration tasks.
It looks like migration to component templates is going to be a pain.
Currently, I am using template inheritance/merging, making use of the order field.
For our logs where we have domain specific fields not captured in the ECS, we have dedicated indices which inherit from filebeat in the first instance, and we map as much as possible to the ECS fields. Then our other higher-order number templates define all the other fields we require.
Additionally, I use dynamic_templates to override the log.original field to not truncate the log message at 1024 characters. This is required when parsing the message fails, we log the whole original message to a separate index from which we can look at the message and attempt to re-index the message after fixing the filters.
Having tried setting up composable template using filebeat 8.7.1, I have noticed that it has no components, it is just a monolithic composable template, which means we can inherit nothing as I understand it.
Here is the command I used:
.\filebeat.exe setup --index-management -E output.logstash.enabled=false -E output.elasticsearch.hosts=["localhost:9200"] -E output.elasticsearch.username="#####" -E output.elasticsearch.pa ssword="#####" -E setup.template.type="component"
Here is the index management page in Kibana showing the filebeat template
I do not want to have to maintain our own version of the filebeat template, it defeats the purpose of having composable templates, and the original "legacy" templates did allow this reuse.
For the time being I will have to continue with the legacy templates until this is resolved.
Is there a plan for the beats to create their templates in a more component template style allowing reuse?
Thanks in advance.