With Heartbeat, Filebeat, and Metricbeat I tried to set a custom index - same name just removing the date. So instead of heartbeat-%{[agent.version]}-%{+yyyy.MM.dd} I was trying to make it: heartbeat-%{[agent.version]}"
My plan then was to use 6.7's index lifecycle policy to let it roll over when it hits 50G. Main reasoning for that is to save shards. Those 3 alone per month would be 90 shards versus probably - 3 or less.
I set each of them with this (using heartbeat as example).
heartbeat.elasticsearch.index: "heartbeat-%{[agent.version]}"
setup.template.name: "heartbeat"
setup.template.pattern: "heartbeat*"
as well as:
setup.dashboards.index: "heartbeat*"
But then index's won't show in kibana, and if I look at the logs I'll see something like:
Connection to backoff(elasticsearch(http://localhost:9200)) established
Failed to publish events: temporary bulk send failure
If I go back and remove the custom name part - it will send without issue again. Any ideas?