Beats - custom index issue

With Heartbeat, Filebeat, and Metricbeat I tried to set a custom index - same name just removing the date. So instead of heartbeat-%{[agent.version]}-%{+yyyy.MM.dd} I was trying to make it: heartbeat-%{[agent.version]}"

My plan then was to use 6.7's index lifecycle policy to let it roll over when it hits 50G. Main reasoning for that is to save shards. Those 3 alone per month would be 90 shards versus probably - 3 or less.

I set each of them with this (using heartbeat as example).

heartbeat.elasticsearch.index: "heartbeat-%{[agent.version]}" "heartbeat"
setup.template.pattern: "heartbeat*"

as well as:

setup.dashboards.index: "heartbeat*"

But then index's won't show in kibana, and if I look at the logs I'll see something like:

Connection to backoff(elasticsearch(http://localhost:9200)) established
Failed to publish events: temporary bulk send failure

If I go back and remove the custom name part - it will send without issue again. Any ideas?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.