Cannot specify index name on elastic cloud

Hello wonderful people!

I would like to create different indexes for each environment that I have (test / staging / production)

I am using elastic cloud setup with filebeat 7.1.x but I cannot specify custom index name for some reason.

This is what my filebeat.yaml file looks like;

setup.template.name: "test-filebeat"
setup.template.pattern: "test-filebeat-*"

output.elasticsearch:
  index: "test-filebeat-%{[agent.version]}-%{+yyyy.MM.dd}"
  hosts: ['${ELASTICSEARCH_HOST:elasticsearch}:${ELASTICSEARCH_PORT:9200}']
  username: ${ELASTICSEARCH_USERNAME}
  password: ${ELASTICSEARCH_PASSWORD}


cloud.id: ${ELASTIC_CLOUD_ID}
cloud.auth: ${ELASTIC_CLOUD_AUTH}

I expect to see it like this: test- in front of my indexes... but this is how it shows up:

filebeat-7.1.1-2019.06.06-000001

What am I doing wrong here? I went thru a lot of support articles and cannot figure this out.

ILM default setting are probably making your setup.template settings ignored. When ILM is enabled, and it is by default, in auto mode, it wins over.

setup.ilm.enabled: false
if you want to disable ILM.

Check the doc here carefully:
https://www.elastic.co/guide/en/beats/filebeat/current/ilm.html

1 Like

Thanks for pointing me to right resource @martinr_ubi :+1:

I am new to elasticsearch and this wasn't obvious at all. Every single thing I can find online talks about changing output.elasticsearch.index value.

Thank you!

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.