For various reasons I can't have my Beats talking directly to Elasticsearch on all the networks I will be monitoring. So I need to use Logstash as a proxy. Beats will ship to Logstash, Logstash will ship to Elasticsearch.
I have this working. The part I don't have working is the Beats "setup" for ILM and Templates.
The docs for the Elasticsearch output plugin make it clear that Logstash can manage ILM and Templates. The part I'm stuck on is how do I tell Logstash to use the same settings the Beats would?
That said, it occurs to me this might be solvable just by placing the needed Beats on my Elasticsearch nodes, and giving those specific Beats the ability to output directly to ES. That assumes I don't somehow need all instances of my Beats to run the setup tasks individually. Would that work?
When searching, I found this unanswered topic: ILM Support for beat-logstash-elastic that is very similar to my question. I thought I'd mention it here.