Confg `setup.template.settings.index.lifecycle.name` is not working

Elastic Stack Beats
1

I'm using official filebeat and metricbeat docker image in kubernetes.

I set setup.template.settings.index.lifecycle.name config as log-policy and checked that config is properly set in beat pods, but log shows

2019-01-30T03:51:37.269Z        INFO    instance/beat.go:850    Set setup.template.name to 'filebeat-6.6.0' as ILM is enabled.
2019-01-30T03:51:37.269Z        INFO    instance/beat.go:856    Set setup.template.pattern to 'filebeat-6.6.0-*' as ILM is enabled.
2019-01-30T03:51:37.269Z        INFO    instance/beat.go:863    Set settings.index.lifecycle.rollover_alias in template to filebeat-6.6.0 as ILM is enabled.
2019-01-30T03:51:37.269Z        INFO    instance/beat.go:868    Set settings.index.lifecycle.name in template to beats-default-policy as ILM is enabled.

and lifecycle name in elasticsearch template is also beats-default-policy.

It seems lifecycle name config doesn't work and always set default value.

2

Could you please share your whole configuration formatted using </>?

3 
filebeat:
  modules:
  - auth:
      enabled: false
      var.paths:
      - /var/log/auth.log
    module: system
    syslog:
      enabled: true
      var.paths:
      - /var/log/syslog
  prospectors:
  - enabled: true
    paths:
    - /var/log/*.log
    - /var/log/messages
    - /var/log/syslog
    type: log
  - containers.ids:
    - '*'
    processors:
    - add_kubernetes_metadata:
        in_cluster: true
    - drop_event:
        when:
          equals:
            kubernetes.container.name: filebeat
    type: docker
filebeat.config:
  modules:
    path: ${path.config}/modules.d/*.yml
    reload.enabled: false
  prospectors:
    path: ${path.config}/prospectors.d/*.yml
    reload.enabled: false
filebeat.prospectors:
- enabled: true
  paths:
  - /var/log/*.log
  - /var/log/messages
  - /var/log/syslog
  type: log
- containers.ids:
  - '*'
  processors:
  - add_kubernetes_metadata:
      in_cluster: true
  - drop_event:
      when:
        equals:
          kubernetes.container.name: filebeat
  type: docker
http.enabled: false
http.port: 5066
output:
  elasticsearch:
    enabled: true
    hosts:
    - es-monitoring-elasticsearch-client.monitoring.svc.cluster.local:9200
    ilm:
      enabled: true
  file:
    enabled: false
    filename: filebeat
    number_of_files: 5
    path: /usr/share/filebeat/data
    rotate_every_kb: 10000
  logstash:
    enabled: false
    hosts:
    - logstash.monitoring.svc.cluster.local:5044
output.file:
  filename: filebeat
  number_of_files: 5
  path: /usr/share/filebeat/data
  rotate_every_kb: 10000
processors:
- add_cloud_metadata: null
- add_kubernetes_metadata:
    in_cluster: true
- drop_event:
    when:
      equals:
        kubernetes.container.name: filebeat
- decode_json_fields:
    fields:
    - message
    max_depth: 1
    overwrite_keys: false
    process_array: false
    target: json
queue.spool:
  file:
    page_size: 16KiB
    path: ${path.data}/spool.dat
    size: 1024MiB
  write:
    buffer_size: 10MiB
    flush.events: 1024
    flush.timeout: 5s
setup:
  dashboards:
    enabled: true
  kibana:
    host: es-monitoring-kibana.monitoring.svc.cluster.local:443
    path: /monitoring
  template:
    enabled: true
    overwrite: true
    settings.index.lifecycle.name: log-policy
xpack:
  monitoring:
    enabled: true
4

I also found that es index doesn't roll by day with ilm.enabled: true.

logs after jan, 30 are continuously written in filebeat-6.6.0-2019.01.30-000001 which generated in jan, 30

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.