Cannot specify index name on elastic cloud

Elastic Stack Beats
1

Hello wonderful people!

I would like to create different indexes for each environment that I have (test / staging / production)

I am using elastic cloud setup with filebeat 7.1.x but I cannot specify custom index name for some reason.

This is what my filebeat.yaml file looks like;

setup.template.name: "test-filebeat"
setup.template.pattern: "test-filebeat-*"

output.elasticsearch:
  index: "test-filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"
  hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
  username: ${ELASTICSEARCH_USERNAME}
  password: ${ELASTICSEARCH_PASSWORD}


cloud.id: ${ELASTIC_CLOUD_ID}
cloud.auth: ${ELASTIC_CLOUD_AUTH}

I expect to see it like this: test- in front of my indexes... but this is how it shows up:

filebeat-7.1.1-2019.06.06-000001

image
image.png2490×770 65.3 KB

What am I doing wrong here? I went thru a lot of support articles and cannot figure this out.

1 Like
2

ILM default setting are probably making your setup.template settings ignored. When ILM is enabled, and it is by default, in auto mode, it wins over.

setup.ilm.enabled: false
if you want to disable ILM.

Check the doc here carefully:
https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html

1 Like
3

Thanks for pointing me to right resource @martinr_ubi :+1:

I am new to elasticsearch and this wasn't obvious at all. Every single thing I can find online talks about changing output.elasticsearch.index value.

Thank you!

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.