Hello there.
I got a simple question:
When i'm using filebeat, i would like to create a daily index and use index lifecycle policies.
Im currently using ilm with this settings in filebeat.yml:
setup.ilm.enabled: auto
setup.ilm.rollover_alias: "filebeat"
setup.ilm.pattern: "{now/d}-000001"
But as far as i saw, this way elastic doesn't create a daily index.
I also tried using "index" in filebeat.yml like this:
output.elasticsearch:
hosts: xxxxxxxxx
Index: "filebeat-%{now/d}"
(Setting up later setup.ilm.enabled: false + templates)
But this way i can't use index lifecycle policies...
Any suggestion?
Thanks!